The Privacy Class Action Review - 2023 - Report - Page 30
countermeasure” upon the declaration of a public health emergency by the Secretary of
the Department of Health and Human Services. The court held that PREP Act immunity
did not apply because the Food and Drug Administration had not approved the Turing
Shield, meaning that the device did not satisfy the definition of a “covered
countermeasure.” Id. at *32. For these reasons, the court denied the defendant’s motion
to dismiss.
In Staley, et al. v. UMAR Services, 2022 U.S. Dist. LEXIS 168497 (N.D. Ill. Sept. 19,
2022), the plaintiffs, a group of individuals who donated blood plasma at the defendants’
donation centers for money, alleged that they were required to provide their fingerprint
scans to the defendants at kiosks for identity and tracking purposes. The plaintiffs
contended that the defendants violated §§ 15(a) and 15(b) of the BIPA by: (i) failing to
provide notice of the specific limited purpose or length of time for which the defendants
collected, stored, or used their biometrics; (ii) failing to provide retention policies,
guidelines, or schedules for deletion of their biometric data; (iii) failing to obtain their
authorization to store their data; and (iv) failing to destroy the data in the requisite time
period. Id. at *2.
The defendants moved to dismiss on the grounds that: (i) federal law regarding
plasmapheresis preempts the BIPA; (ii) several of the plaintiffs provided informed
consent for the collection of their biometric data, and therefore, their § 15(b) claims
could not survive; (iii) the BIPA did not apply to the collection of the plaintiffs’ fingerprints
under three statutory exemptions; (iv) the plaintiffs’ claims were untimely; and (v) the
plaintiffs failed to state claims for reckless violations of the BIPA. First, the court
addressed the federal preemption argument. The defendants asserted that there was
conflict between the Food and Drug Administration (FDA) regulations and the BIPA
because the former requires plasmapheresis to establish a “donor identification system”
and to keep the “donor records” for “10 years after the records of processing are
completed.” Id. at *9. Since the BIPA requires destruction of biometric identifiers within
three years, the defendants argued that the resulting conflict must be resolved in favor
of federal law.
The court rejected the defendants’ argument. It held that the federal law did not require
the use of biometric data to verify plasma donors’ identities. The court opined that the
only requirement was to “obtain proof of identity of the donor” and that the requisite
proof could be established with photographic identification. Id. at *10. Further, the court
found no merit to the defendants’ argument that fingerprint scans best served the
purpose of the FDA regulations requiring donor identification systems. Instead, it
determined that there was “no authority that fingerprint scans are superior to the other
forms of identification that regulations accept.” Id. at *11. Second, the court analyzed the
defendants’ contention that several of the plaintiffs signed consent forms and thus could
not assert § 15(b) claims. The court reasoned that § 15(b) requires not just a signed
consent form, but also written notice that the biometric information is being collected
and stored, and the purpose and length of time of the storage. Since the court found
that the consent agreements did not contain the full information required, it rejected the
defendants’ argument. Third, the court ruled that the defendants’ argument that the
29
© Duane Morris LLP 2023
Duane Morris Privacy Class Action Review – 2023
