Amazon Sued for Profiting From Biometric Data Under N.Y. Privacy Law

Amazon profited from using biometric technology to automatically link individuals’ biometrics with other forms of personal information and “hold out their database of biometrics/Amazon One as a product/service to other companies,” alleges a Thursday class action (docket 1:23-cv-00901) in U.S. District Court for Southern New York in Manhattan.

“Unlike payment cards -- which can be changed or replaced if stolen or compromised -- fingerprints and palmprints are permanent, unique biometric identifiers associated with particular consumers,” said the complaint. That exposes consumers to “serious and irreversible privacy risks,” it said. If a device or database containing palm print data is hacked or otherwise exposed, “consumers have no means by which to prevent identity theft and unauthorized tracking,” it said.

The New York City Council passed the Biometric Identifier Information Law (BIIL) in July 2021 in response to developments in facial recognition and other biometric technology that “pose new consumer protection challenges in an atmosphere where there are already growing concerns about privacy and personal data." The New York City Council noted the use of biometric technology raises "significant concerns about accuracy, especially for women, children, African Americans, and Asians for whom … algorithms are known to be less accurate,” the complaint said.

Plaintiff Richard McCall, of Brooklyn, visited an Amazon Go store in Manhattan and made a purchase using his palm print, as directed by Amazon, which required McCall to place his palm over an Amazon One scanner. At that point, the retailer “collected, retained, converted, stored and/or shared his palmprint biometric identifier information,” but Amazon never disclosed to McCall “through clear and conspicuous signage” near the store’s customer entrances that it “collects, retains, converts, stores or shares” biometric information in violation of BIIL, it said.

NYC’s BIIL makes it unlawful for a company to “sell, lease, trade, share in exchange for anything of value or otherwise profit from the transaction of biometric identifier information,” said the complaint. Any commercial establishment that collects, retains, converts, stores or shares BII must place a clear sign that it is being collected.

The complaint cited the City Council’s argument that AI systems “learn what they are taught,“ and if they're not taught with “robust and diverse data sets, accuracy and fairness could be at risk.” That’s because systems trained “within only a narrow context of a specific data set will inevitably acquire bias that skews its learning toward the specific characteristics of that data set.” That’s potentially damaging for individuals, including those “mistakenly entered into a criminal database, for example, of supposed shoplifters.” The Council cited a case where a “flawed facial recognition hit” resulted in the New York Police Department going to an individual’s home to arrest him "for crimes he had no part in."

Plaintiff is seeking statutory damages, reasonable attorneys’ fees and legal costs. It also seeks an order enjoining Amazon from “continuing the illegal practices” and requiring the company to undertake a “corrective advertising campaign.”