Amazon ordered to share ‘limited source code’ in biometric data privacy dispute

Amazon’s legal representation in a lawsuit filed under Illinois’ Biometric Information Privacy Act has taken the awkward position that its Just Walk Out software which analyzes hand geometry does not collect biometrics, and that plaintiffs should not be allowed to examine the technology’s source code to make their case that they do. A U.S. District Court disagrees.

The District Court for the Northern District of Illinois rejected Amazon’s attempt to block plaintiffs from examining the source code of its Just Walk Out technology. Just Walk Out technology is distinct from Amazon’s “One” palm biometric payment system, which the company discontinued for retail settings earlier this year.

Plaintiffs filed the lawsuit in September of 2023, alleging the usual lack of informed consent before the retail giant collected their biometrics.

Amazon’s position is that the system does not collect biometric identifiers, as defined by BIPA, because one of its engineers says so.

“Defendants submit the declaration of one of these knowledgeable Amazon engineers, Tian Lan, as evidence that JWO Technology ‘is designed to track product interactions within a store using the location of hand as an anchor’ and not to ‘identify individuals using hand geometry or biometric identifiers as defined by BIPA,’” the decision says (via Law.com).

But the interactions are clearly between a product and a specific individual, otherwise people checking out would be charged for each others’ selections. An Amazon representative told Biometric Update in a 2023 email that Just Walk Out “uses a combination of sophisticated AI technologies like computer vision, sensor fusion, and deep learning to distinguish shoppers from one another, link a customer to their method of payment, and determine ‘who took what.’”

The key distinction, for Amazon, is a semantic one: “Defendants summarily assert that the critical aspects of the JWO Technology’s use of that geometry, by the dictionary definition of a certain word, fall short of what BIPA would consider customer-specific or unique biometric information,” the Court summarizes.

The problem with this argument, the court ruled, is that plaintiffs point out language in Lan’s testimony that indicates the geometric features may qualify as biometric identifiers under BIPA, and are under no obligation to accept Amazon’s preferred definition of the term in question.

Invited to define “biometrics” at the time of the above email exchange, the company declined.

The District Court found that asking for limited source code is proportional to the expectations of discovery, and that Amazon’s argument that the code is not relevant is unpersuasive.

Amazon has been instructed to turn over the source code by March 31, but the overall discovery process is expected to drag into August.

Article Topics

Amazon  |  biometric identifiers  |  Biometric Information Privacy Act (BIPA)  |  data privacy  |  data protection  |  hand biometrics  |  lawsuits  |  retail biometrics