Follow the Personal Data From Collection to Disclosure

Global Digital Forensics was founded in 1992, and its examiners have been accepted by federal and state courts, deposed and cross examined in civil and criminal matters. Founder Joseph Caruso's technology career began in 1980 and spans software development, mainframe databases, real time transaction systems, mobile devices and cellular networks, which is the background that lets him read a biometric enrollment database or a consent flow as an engineer before he explains it as a witness. His engineering training at Stevens Institute of Technology and his CISSP sit behind that reading.

In Rogers v. BNSF Railway, the first Illinois Biometric Information Privacy Act class action to reach a jury, plaintiffs' counsel retained GDF as database, data analysis and computer forensics experts. We restored and analyzed the records of the identity verification system, normalized and deduplicated the data and reported what the system held and whom it reflected. Our expert practice spans federal district court, multidistrict litigation, arbitration and ITC Section 337 proceedings.

If your matter turns on records like these, read how the Rogers v. BNSF records were reconstructed before deciding who should examine yours.

A privacy notice, a consent screen and a vendor contract describe intended practice. The database schema, the application code paths, the integration configuration and the retained logs describe what actually happened, and privacy litigation lives in the gap between the two. Within the agreed scope we examine configurations, data inventories, access records, application behavior, retention settings and the notices themselves, and we record the exact conditions under which every observation was made.

Take a dispute over whether a web form sent a particular field to an analytics or advertising service. The question is not whether an integration existed but which fields it carried, to which destination, under which conditions and during which period. We identify each of those elements from the record, test the current behavior where that is useful, and use version records and deployment history to establish which build was live during the class period.

Attorneys with a disputed integration can describe the field, the destination and the class period and we will say which records would need to be preserved first.

Permission to access data is not evidence that anyone accessed it. A disclosed recipient is not a confirmed transfer. A deduplicated count of enrollees is not a count of scans. Those distinctions decide class definitions and they decide cross examination, so every opinion we offer names the record behind it and exactly what that record proves.

Where historical logs have aged out, the surviving configuration history, version records and application behavior often still carry the answer. Current testing is labeled as current testing and tied to the version history, so any reconstruction of the past stands on records rather than on assumption.

Is retention already a problem in your case? Call (800) 868-8189 and we will discuss what the surviving configuration and version records may still support.

GDF explains the system and the records in terms a court can weigh. Before we accept an engagement we discuss the technology at issue, the disputed questions, the experience the proposed expert needs and the procedural schedule, so the retaining firm knows at the outset what can be examined and defended before the report deadline.

The written work describes data flows, retention behavior and the differences between stated and observed operation, with each factual proposition tied to its source and every reconstructed configuration traced to the version records behind it. That structure lets the court evaluate the technical opinion on its own terms.

To see how observations and opinions are separated in a report, read the digital forensics process guide before the first call.

Biometric privacy matters raise questions ordinary data cases do not. A fingerprint or face template is created at enrollment, stored in a database, matched on each use and sometimes shared with a vendor or an integrator, and each step leaves records in different systems with different retention. We examine the scanners, the applications that use them and the databases that hold templates, images and match events, which is the same work our biometrics and identity sciences practice performs outside litigation.

The Illinois Biometric Information Privacy Act supplies the statutory context in many of these matters. Our role is to explain how the system collected, stored, used and retained the biometric data and who was reflected in those records.

The same discipline applies to personal data outside the biometric context: website and application data collection, third party integrations, consent and preference records, retention and deletion behavior, and the access records that show who reached what. In each case the examination follows the data from collection to disclosure and documents the evidence at every step.

Biometric matters have their own evidence trail, and our biometrics expert witness practice explains how enrollment, matching and vendor records are examined.

Truck driver Richard Rogers brought a class action alleging that BNSF Railway violated the Illinois Biometric Information Privacy Act when fingerprint information was registered and used through identity verification systems at Illinois rail facilities, and the matter became the first BIPA class action to reach a jury trial. Global Digital Forensics was retained for the plaintiffs as database, data analysis and computer forensics experts.

Our work restored the identity verification database, normalized and deduplicated its records and reported which biometric information the system held and whom it reflected. The jury found 45,600 violations and the district court entered judgment for $228 million; the court later vacated the damages award and ordered a new trial limited to damages while leaving liability in place, and the parties' settlement agreement provides for a $75 million fund. Read the Rogers v. BNSF case study and the linked court records.

The statutory text most often at issue in biometric privacy matters is published by the Illinois General Assembly as BIPA section 15 ↗.

Joseph Caruso, founder, CEO and CTO of Global Digital Forensics, brings the database and systems background to privacy matters. His selected case experience includes Rogers v. BNSF Railway, and his class action work has covered reservation systems, mainframe databases, source code and transaction systems, the same kinds of records a privacy matter turns on. Meet the GDF team, then ask for a current CV. Availability and conflicts for the proposed expert are settled before any disclosure is drafted.

Want to know who would testify? Ask which expert would be proposed for your matter and we will confirm availability and conflicts before any disclosure is drafted.