Coinbase Info Processor Jumio Fails to Destroy Facial Scans Once Account Identities Are Verified, Class Action Claims

New to ClassAction.org? Read our Newswire Disclaimer

Coinbase information processor Jumio faces a proposed class action that alleges the company has violated Illinois law by collecting, storing and otherwise obtaining users’ facial scans. 

Want to stay in the loop on class actions that matter to you? Sign up for ClassAction.org’s free weekly newsletter here. 

The 13-page privacy lawsuit explains that Jumio is the entity tasked with scanning the selfie uploaded by a new Coinbase user upon creating an account on the cryptocurrency exchange, ostensibly to produce a biometric template of the person’s face for identity confirmation purposes. 

According to the complaint, Jumio, in violation of the Illinois Biometric Information Privacy Act (BIPA), has no written, publicly available policy establishing a retention schedule and guidelines for permanently destroying the sensitive biometric data in its care once the initial purpose for collecting the information—e.g., verifying the identity of a new account—has been satisfied, or within three years of a user’s last interaction with the company, whichever occurs first. 

Per the case, the facial geometry scans of the plaintiff, an Illinois resident, should have been permanently destroyed by Jumio once he opened his Coinbase account. However, the company unlawfully retained the plaintiff’s biometric facial scan, the lawsuit claims, and Coinbase allegedly failed to inform the user in writing that Jumio was collecting or storing his biometric information. 

“Instead, Coinbase simply instructed Plaintiff to upload his state issued identification forms and ‘selfie’ photographs as part of the overall account opening process,” the suit claims. “In fact, Jumio made no mention of biometric information, collection of biometric information, or storage of biometric information.” 

Moreover, the complaint says, Jumio did not inform the plaintiff in writing of the specific purpose and length of time for which his facial scan would be collected, stored and used, in violation of the BIPA. 

Further still, the lawsuit alleges Jumio “disclosed, redisclosed, or otherwise disseminated” the plaintiff’s biometric data without consent. 

“Upon information and belief, Jumio is part of numerous third parties, including Onfido, Inc., Au10tix LTD, Solaris AG, and Liquid Co., Ltd., all of which have had Plaintiff’s biometric information disclosed, redisclosed or otherwise disseminated to them via their role as a processor for Coinbase,” the filing states. 

The lawsuit looks to cover all Illinois residents who had their biometric information collected by Jumio while using Coinbase at any point within the last five years. 

Get class action lawsuit news sent to your inbox – sign up for ClassAction.org’s free weekly newsletter here.