This article originally appeared in the July 2023 issue of Security Business magazine. When sharing, don’t forget to mention Security Business magazine on LinkedIn and @SecBusinessMag on Twitter.
When I was in law school, I had an internship with the District Attorney’s Office in Cambridge, Mass. It was a great learning experience. As a student, all of my cases had to be supervised by a professor or an Assistant District Attorney. This enhanced the learning experience and ensured I did not commit malpractice.
One of my cases involved a theft in the Harvard Coop – which was and is the bookstore for Harvard University. The Coop was more like a department store than a bookstore. It sold various items across several departments. One day, a young couple entered the store carrying various shopping bags from a day of shopping in Harvard Square. They browsed several sections in the store, eventually settling into the shoe department. The female asked the salesperson to try on some shoes. The salesperson went to the storage room to retrieve the appropriate size. While the salesperson was away, the male and the female took various items – including belts and shoes – and stuffed them into their other shopping bags. It was a clear case of shoplifting.
Thankfully, an undercover loss prevention officer was in the area. He observed the theft, waited for the couple to leave that area of the store, and then apprehended them. The couple was separated and questioned. The brief investigation revealed that the couple was shopping that day at various stores using a stolen credit card. All of the shopping bags they carried that day were full of stolen items.
Proving that most criminals are stupid, they could have continued to use that credit card at the Harvard Coop, but, instead, tried to steal the items without offering any payment. This was their last and final mistake.
These dumb criminals were prosecuted and punished appropriately – yes, by me, a student prosecutor. Although they were uniquely foolish, their story is not at all unusual. Shoplifting is a common problem. This is why retail stores are increasingly using advanced surveillance systems – including biometric systems.
Biometrics Meets Loss Prevention
In the Sept. 2021 edition of this column, I wrote about a July 2021 law passed in New York City requiring certain retail stores, places of entertainment, and dining establishments to notify customers if they use biometric identifier technology in their stores (www.securityinfowatch.com/21235071). More specifically, the NYC law includes:
- A requirement that any commercial establishment that collects, retains, converts, stores, or shares biometric identifier information of customers to place a “clear and conspicuous” sign near all of the customer entrances notifying customers that their biometric identifier information is being collected, retained, converted, stored, or shared;
- Makes it unlawful to sell, lease, trade, or share in exchange for anything of value or otherwise profit from the transaction of biometric identifier information; and
- Creates a private right of action for any person aggrieved by a violation of the law.
The NYC law defines biometric identifier information as physiological or biological characteristics used to identify individuals, including retina scans, fingerprints, voiceprints, scans of hand or face geometry, or “any other identifying characteristic.”
Amazon Class Action
In March 2023, a customer in New York City brought a class action against Amazon under this New York City biometric law, claiming that he was aggrieved by Amazon’s use of biometric security in its Amazon Go retail store. Among other things, the complaint alleged that Amazon did not timely post any notification of the use of an alleged biometric security system.
The plaintiff alleged that he entered an Amazon Go store in Manhattan on Jan. 30, 2023, by scanning a code in his Amazon app. Upon entering the store, the plaintiff alleged that Amazon's system identified him through the shape and size of his body and then tracked every single movement he made in the store to identify where he went, what items he removed from the shelves, and what items he put back on the shelves.
The plaintiff left the store with some groceries, and subsequently received an Amazon receipt for $13.17 (showing that the amount spent is not relevant to whether a violation this law has occurred). Several weeks later, the plaintiff sent the required notice to Amazon claiming a violation of the NYC biometric law – because of an alleged lack of signage in the store.
In defense, Amazon claimed that the NYC biometric law is inapplicable for two reasons. First, they claim the technology used in the store does not collect biometric identifier information covered by the law – such as fingerprints, retina scans or facial geometry. This appears to be true. It is an open question, however, whether scanning body shape and size fits within the “any other identifying characteristic” circumscribed by the law. That issue will have to be resolved – perhaps in another case. Second, Amazon claims that the biometric information actually collected – palm prints – is done before the customer ever enters the store, is used at the customer’s absolute discretion, and subject to a written disclosure agreed to by the customer during the enrollment process. This, it seems, is a solid defense for Amazon since advance notice is at the heart of the NYC law.
Amazon also raised a series of other legal defenses, challenging the plaintiff’s standing to bring his claims because he was on notice of Amazon’s practices before entering the store; alleging the claims were duplicative; and claiming that plaintiff had no basis to bring a class action because he did not and cannot show that other putative class members gave notice to Amazon and an opportunity to cure (a pre-condition to bringing suit).
Ultimately, this lawsuit was dismissed (likely on consent) in early June 2023. At the time, Amazon’s motion to dismiss was pending. I suspect plaintiff and the special interest groups backing him decided that Amazon had viable defenses which justified withdrawing the claims. Perhaps there was a small monetary settlement – although that cannot be discerned explicitly from the public record.
Be Ready for Increased Scrutiny
The lesson here is that business and the security companies that protect them are facing increased public and private scrutiny of their use of biometric security technologies.
While undercover loss prevention officers may still be roaming retails stores (including in the Harvard Coop), the use of biometric security technology continues to grow. As it does, government regulation and private lawsuits will continue to grow – not just in New York.
Amazon succeeded in this latest lawsuit. Not all companies are as well prepared – but your company and the customers you serve should be. Make sure of it.
Timothy J. Pastore, Esq., is a Partner in the New York office of Montgomery McCracken Walker & Rhoads LLP (www.mmwr.com), where he is Vice-Chair of the Litigation Department. Before entering private practice, Mr. Pastore was an officer and Judge Advocate General (JAG) in the U.S. Air Force and a Special Assistant U.S. Attorney with the U.S. Department of Justice. Reach him at (212) 551-7707 or by e-mail at [email protected].
