On August 18, a federal judge in the Southern District of New York entered an injunction forbidding Verified Identity Pass, Inc. (VIP) to sell or transfer any of the confidential customer information it compiled while operating the CLEAR express airport check-in program. The CLEAR program collected a range of customer biographic information (e.g., name, address, etc.) as well as biometric information, including the customer’s fingerprints and iris scan. This information was used to expedite the airport check-in process.
In June, VIP announced that it would be discontinuing the program due to its inability to “negotiate a settlement” with its creditor. At the time, VIP assured its customers that “[t]he personally identifiable information that customers provided to Clear may not be used for any purpose other than a Registered Traveler program operated by a Transportation Security Administration authorized service provider. Any new service provider would need to maintain personally identifiable information in accordance with the Transportation Security Administration’s privacy and security requirements for Registered Traveler programs. If the information is not used for a Registered Traveler program, it will be deleted.”
Despite this assurance from VIP, many customers expressed concern over the handling of the personal data they had provided to CLEAR. In addition, customers objected to VIP’s statement that it would not issue refunds to customers, some of whom had paid in advance for years of service.
A week after VIP’s announcement of its discontinuation of the program, CLEAR customers brought a putative class action against VIP in the Southern District of New York. As amended, plaintiffs’ claims include breach of contract, negligence, and unjust enrichment. Plaintiffs also sought a preliminary injunction, explaining that "VIP’s cessation of the CLEAR program and other factors indicate a significant risk that the confidential information of Plaintiffs . . . will be compromised.” Plaintiffs expressed concern that VIP would not honor its contractual obligation not to disclose or sell its customers’ data. In the same motion, plaintiffs also sought an order requiring the preservation of evidence.
Judge Holwell agreed, and issued an order enjoining VIP from 1) selling any confidential information obtained from Clear members of applicants, 2) disclosing any such information to any other entity, and 3) maintaining or storing information in a manner that permits disclosure of the information. Judge Holwell also ordered that VIP take all necessary steps to preserve evidence relevant to the case. As news outlets have reported, however, VIP’s lawyers may challenge the order on the grounds that the judge failed to give them an opportunity to respond to plaintiff’s motion.
Regardless of whether this particular order remains in place, the controversy surrounding VIP’s cessation of CLEAR service underscores the security and privacy issues that arise when companies entrusted with customers’ personal information are no longer financial viable.
Links:
- Order enjoining VIP (.pdf)
- VIP announcement: discontinuation of Clear program
- ComputerWorld article reporting on discontinuation of Clear
- Plaintiffs’ Amended Complaint (.pdf)
- Plaintiffs’ Motion for Preliminary Injunction (.pdf)
- Plaintiffs’ Memorandum of Law in Support of Preliminary Injunction (/.
- ComputerWorld article reporting on preliminary injunction