Biometric Privacy, BIPA Litigation and Database Analysis
Biometric Data Expert Witnesses for BIPA Class Actions
In a biometric privacy case, what matters is what the system captured, where the templates went and how many people the database really reflects, and a row count answers none of it. We restore the database, trace each template from the scanner to every recipient and deduplicate the records into a population figure another examiner can reproduce. That is the work GDF did for plaintiffs' counsel in Rogers v. BNSF Railway, the first BIPA class action to reach a jury.
Why Biometric Class Actions Come to Global Digital Forensics
Rogers v. BNSF Railway required analysis of the records behind the identity verification systems at Illinois rail facilities and of the population those records reflected. GDF restored that database, normalized and deduplicated it and reported what the system stored and who was reflected in it, and the full account of the matter is set out further down this page.
That matter is the model for how we work. A biometric system is scanners, the applications that use them and the databases that store the templates and images, and we examine all three. Joseph Caruso, whose case experience includes Rogers v. BNSF Railway, has worked with databases and transaction systems since his technology career began in 1980.
Review the primary references NIST Face Technology Evaluations (FRTE and FATE) and NIST OSAC forensic standards registry for the technical background behind our reports.
If a biometric privacy complaint or a template database breach is already on your desk, describe the system and the schedule and we will say what the records can establish before you commit to an expert.
The engagement
Turn Biometric System Records Into Findings a Court Can Weigh
The engagement begins with the system, not the statute. We identify the scanners, the matching software and its version, the enrollment and verification applications, the databases that hold templates and images and every party that received a copy. Only then do we ask what the records can establish: who was enrolled, when, how the data was labeled, whether templates were derived from images, how long each record persisted and where it was sent.
Counting is where biometric privacy cases are won and lost, and a row count is not a count of people. Repeat enrollments, duplicate identifiers, system migrations and partial records all change the population a database appears to describe. We document the normalization and deduplication rules we apply, show the effect of each one on the result and tie every figure to the records behind it, so the number that goes before the court is one we can defend question by question.
Where a matter turns on a comparison result rather than a data flow, we identify the matching algorithm or algorithm class, the decision threshold and the error rates the record supports for the operating population. Whatever the legal theory, the technical account beneath it is complete, checkable and stated at the level the records support.
The first call settles who would restore the database and who would take the stand, from examiners with court experience.
Scope
BIPA and biometric privacy class actions
We examine what identifiers a system actually captured, retained and shared, distinguish templates from source images and reconstruct retention and destruction behavior from the records. In Rogers v. BNSF Railway that work produced a normalized account of the identity verification database for the plaintiffs, and the same analysis serves class certification and merits questions on either side.
Database restoration and population analysis
Biometric databases arrive as backups, exports and partial tables from several vendors. We restore them, reconcile schemas across versions and migrations, deduplicate individuals and document each rule so the population count can be reproduced by another qualified examiner.
Face recognition system review
We establish which algorithm version, threshold and search mode the deployed system ran, what it stored and where it sent results, and we read the published NIST evaluation of that algorithm against the deployed population, sensor and image quality.
Fingerprint capture and template storage
We examine how the scanners captured fingerprint images, whether templates were derived and retained, how long each record persisted and which parties received copies, which is the system record a fingerprint privacy claim turns on.
Voice and behavioral biometric systems
For voice, keystroke, touch and gait systems in fraud and insider matters, we examine enrollment, what the system actually retains, which parties received it and whether a recorded result is linked to a person.
Biometric patents and ITC 337 proceedings
We analyze template generation and matching in accused products against the asserted claims, review prior art and prepare Markman declarations on limitations that describe matcher behavior, on the Commission's compressed schedule where the matter requires it.
Expert Rebuttal, Cross Examination, and Daubert Motion Support
We review the opposing biometric report and its workpapers, reproduce what can be reproduced and prepare rebuttal declarations, cross examination questions and demonstratives built from templates and records already in evidence.
Methodology
Building the Biometric Opinion From Retention to Testimony
-
Define the expert role, conflicts and the system in scope
We confirm the retention letter, run conflicts across biometric vendors and prior retentions, and reduce the legal team's questions to written technical propositions. The scope names the scanners, applications, databases and parties involved, so the opinion addresses the system in the case rather than biometrics in general.
-
Restore the records and reproduce the result
We restore database backups and exports, reconcile them across migrations and, where the record allows, reproduce enrollment counts, match scores or decisions from preserved probes, galleries and matcher configuration. Where a record is missing, the report names it and shows what the surrounding evidence supports in its place.
-
Write the report so it can be checked
The report states the method, the normalization and deduplication rules, the algorithm and threshold where relevant, the error considerations and every assumption, and ties each finding to a record. Where independent verification is agreed, a second qualified examiner reviews material findings before the draft goes to the retaining firm.
-
Testify at deposition, hearing and trial
The examiner who did the work prepares with counsel and explains the findings at deposition, evidentiary hearing and trial, in person or remotely where the court permits. Workpapers are retained for the agreed period so the opinion can support later proceedings, including a damages retrial or an appeal.
Want to see this method applied in a matter that reached a jury? Read the Rogers v. BNSF case study and the court records it cites.
Evidence commonly examined
Biometric Evidence We Examine
The database behind the system comes first: enrollment tables, template and image stores, audit logs, vendor exports and the backups that show how the population changed over time. Around it sit the matcher configuration, algorithm version records and threshold guidance, the relevant NIST FRTE and FATE evaluations and the applicable OSAC standards, the retention and destruction policies as written and as actually implemented, and the contracts and integration records that show which third parties received biometric data. The opposing expert's reports, workpapers and score outputs, together with the court's orders, protective orders and any biometric ESI protocol, define what we may examine and how.
What you can expect
Expert Reports and Testimony Support
The deliverable is an expert report or declaration that identifies the system, the records, the method, the algorithm and threshold where relevant and the error considerations behind each finding, with a reproducibility appendix recording tool versions, deduplication rules, gallery composition and every deviation so another qualified examiner can follow the work. Where the matter calls for it we add a rebuttal declaration on the opposing biometric expert's report, Daubert declarations and questions for the cross examination of that expert, demonstratives built from records already in evidence, and deposition and trial testimony delivered in person or remotely where the court permits.
If a report with a reproducibility appendix is what your Daubert motion needs, request a written scope that names the records, the method and the deliverables.
Biometric Privacy Cases Begin With How the System Handles Data
A biometric deployment is rarely one system. Scanners from one vendor feed an enrollment application from another, templates are generated by a matching service, and the records land in databases maintained by the employer, the integrator and the vendor in turn. An examination has to identify what each component collected and stored, how records relate to individuals and which parties received the data, because the answer to a section 15 question often changes depending on which copy of the data you are looking at.
The database tells the story if it is read properly. Enrollment dates establish when collection began, template fields show whether derived data or source images were retained, audit tables show access and transfers, and the absence of destruction records can be as significant as their presence. We read all of it against the policy documents and the contracts so the record shows where the written practice and the implemented practice diverge.
Illinois BIPA section 15 addresses collection, retention, disclosure and destruction, and each of those duties leaves a trace in the system's records. We read a label such as fingerprint or template against the fields and files actually stored, because the label and the data often disagree, and the report states each technical fact at the level the records support.
Not sure yet whether your system stored templates, images or both? Call (800) 868-8189 and walk an examiner through the capture devices and the vendors involved.
Trace Biometric Data From Capture to Sharing
- Enrollment
We identify what the scanners and applications collect and how the resulting information is labeled and stored.
- Template and matching
We distinguish derived templates from the source images and the comparison results the system actually retains.
- Database population
We measure the effect of duplicates, repeat enrollments and migrations on the count of individuals.
- Retention and sharing
We connect storage duration and recipient findings to the records and contracts that prove them.
If your matter turns on how many people, not how many rows, a database holds, tell us about the system and we will plan the restoration and the count.
Rogers v. BNSF Railway, the First BIPA Jury Trial
Truck driver Richard Rogers brought a class action alleging that BNSF Railway violated the Illinois Biometric Information Privacy Act when fingerprint information was registered and used through identity verification systems at Illinois rail facilities. Plaintiffs' counsel retained Global Digital Forensics as database, data analysis and computer forensics experts. We restored and analyzed the database records associated with the identity verification system, normalized and deduplicated the data and reported findings about the biometric information the system stored and the individuals reflected in those records.
The jury found that BNSF recklessly or intentionally committed 45,600 violations and the district court entered judgment for $228 million. The court later vacated the damages award and ordered a new trial limited to damages, leaving the liability finding in place, and the parties' settlement agreement provides for a $75 million fund. Read the Rogers v. BNSF case study and the linked court records.
BIPA, NIST and Standards References Behind the Opinion
Our biometric privacy work is most often read against Illinois General Assembly: BIPA section 15, which governs the collection, retention, disclosure and destruction of biometric identifiers and biometric information.
Meet the Examiner Behind the Opinion
Joseph Caruso, founder, CEO and CTO of Global Digital Forensics, brings the database and systems background to biometric matters. His case experience includes Rogers v. BNSF Railway biometric information litigation, his technology career began in 1980 with mainframe databases and real time transaction systems, and he holds the CISSP. Meet the GDF team, then ask for a current CV. Expert selection, availability and conflicts are settled before the engagement begins.
Request a free consultation, and the first call will settle which of these steps your matter needs.
Frequently asked
Choosing a Biometrics Expert
Do you work for plaintiffs or defendants in BIPA class actions?
Both. In Rogers v. BNSF Railway the plaintiffs retained us as database, data analysis and computer forensics experts. The same examination of what a system captured, stored, shared and deleted serves a defense team testing a class definition or a damages model. A conflict check across vendors and prior retentions runs before any engagement is accepted.
How do you turn a biometric database into a count of affected people?
We restore the records, reconcile tables across versions and migrations, identify duplicate identifiers and repeat enrollments, and document each normalization and deduplication rule together with its effect on the total. The result is a population figure tied to specific records that another qualified examiner can reproduce.
Can you tell whether the system stored templates, images or both?
Yes. We read the template and image stores, the enrollment tables, the field definitions and the vendor exports to establish which the system retained, for how long and where each copy went, because that answer often decides which statutory duties are in play.
How is demographic performance handled in a face recognition matter?
Where the record identifies the relevant demographic groups, the report states the supported false match and false nonmatch considerations for those groups. Where it does not, the report identifies the algorithm's public evaluation record and the additional discovery that would answer the question for this case.
Can you examine the vendor’s or integrator’s copy of the data?
Yes, through discovery or subpoena returns. Vendors and integrators often hold their own copies of templates and match logs, and we reconcile those copies with the employer’s database so the population and retention findings cover every party that held the data.
Can the examiner testify remotely?
Yes, where the court permits it. The appearance plan covers secure display of probe and reference material, score exhibits and any restrictions in the protective order before testimony begins, and the examiner appears in person wherever the tribunal requires it.
Talk with an examiner
Plan the biometric examination before the deadline closes
Tell us the system, the records in dispute and the schedule. We review experience, conflicts and scope before any engagement, and the first consultation is free.
Database, data analysis and computer forensics experts in Rogers v. BNSF Railway, with a 24/7 hotline and a firm in practice since 1992.
Talk with an examiner
Put a Biometric Database Expert on Your Case
Expect questions about the system, the vendors and the records you hold. By the end of the first call you will know what a restoration and population count involves, how long it takes and who would sign the report, and the consultation is free.
Our 24/7 hotline is (800) 868-8189.
GDF does not accept pro se litigation cases, and GDF may decline matrimonial or family law cases at our discretion.
Reviewed by Joseph Caruso, Founder, CEO and CTO, CISSP. Last reviewed .