A California judge has greenlit a class-action lawsuit against Toronto-based media conglomerate Thomson Reuters, in a scathing ruling that underscored the “tremendous” harm that the company’s controversial investigation software Clear allegedly caused. 

The lawsuit claims that the company profited from collecting and selling the intimate personal data of millions of Americans without their consent. Its certification as a class action clears the way for all affected California residents to join the suit. 

The class action sheds new light on controversy surrounding the company’s role in brokering sensitive personal data for law enforcement and other investigations in the U.S. 

In the recently unsealed July 31 ruling, U.S. district judge Edward Chen determined that plaintiffs Cat Brooks and Rasheed Shabazz provided enough evidence to show that nearly 40 million people’s information could have been “collected, aggregated, and offered for sale by Reuters on the Clear platform.” 

Clear, one of Thomson Reuters’ legal-technology products, collects public and private data on customers from an exhaustive pool of sources, including social media, location data from licence-plate detections, real-time booking information, property records, utility bills, credit agencies, fishing licences, court records and bankruptcy filings. It packages and sells the data to customers like governments, law enforcement agencies, banks, credit unions and universities. 

The alleged harm to plaintiffs was “tremendous,” Chen said in his ruling. “An all-encompassing invasion of plaintiffs’ privacy, whereby virtually everything about them—including their contact information, partially redacted social security number, criminal history, family history, and even whether they got an abortion, to name just a few—is transmitted to strangers without their knowledge, let alone their consent.” 

Despite the judge’s tone, Chen has not ruled on the merits of the plaintiffs’ claims—their allegations remain unproven. 

In an email to The Logic, Thomson Reuters spokesperson Dave Moran said the company was “disappointed” with the ruling. “We will petition a higher court to review … the judge’s decision. We remain confident that plaintiffs’ claims lack merit,” said Moran, rejecting claims that Clear contains medical records, including “records of individuals who have had an abortion, or other protected health information.” He also said the platform does not collect live cellphone records or immigration status. 

Brooks, a 2018 Oakland, Calif., mayoral candidate, and Shabazz, a journalist, are both Black activists who sued Thomson Reuters in 2020, after discovering their personal information was collected and searched on Clear. The plaintiffs say the platform ascribed them high “risk inform scores,” a numerical value that tells an investigator using the platform if a person is “safe” or “risky.” Shabazz claims the platform contained incorrect data about his marital status and whether he has children. 

Along with its news agency Reuters, the company also operates a suite of tools for the legal, corporate, and tax and accounting services. The company reported US$6.6 billion in revenue in 2022, up four per cent from a year earlier, with its legal-services business accounting for US$2.8 billion. 

Clear came under fire in 2021, amid news that U.S. Immigration and Customs Enforcement officers had used the platform to track and arrest immigrants. In response, the B.C. General Employees’ Union (BCGEU), a Thomson Reuters shareholder, filed a proposal urging the company to investigate and report on possible human rights abuses, citing ICE’s use of the Clear platform. 

In an interview with The Logic in June, Thomson Reuters CEO Steve Hasker said the company responded to the shareholders’ concerns by signing the UN Guiding Principles on Business and Human Rights. “I’d like to think that any controversy around Clear is behind us,” Hasker said at the time. The company has also conducted a human rights assessment for the entire organization. 

Emma Pullman, a capital stewardship officer at BCGEU, said the class action “raises vital data privacy questions and echoes concerns BCGEU shares. We believe that robust human rights and privacy safeguards would make Thomson Reuters a better-managed company,” she told The Logic by email. “We will closely track this case and continue to actively engage with Thomson Reuters on these paramount issues.”

Thomson Reuters has sought to have the class action denied, arguing that plaintiffs’ claims were unique to each individual and should not be grouped together in one lawsuit. 

The company also argued that personal information on Clear “is lawfully obtained” and “includes nothing that qualified subscribers could not get individually on their own.” 

Chen ultimately found the plaintiffs’ claims met the standards for a class action, namely that there is a large enough group of people who could have been similarly affected by the company’s alleged violations.

Former Ontario privacy commissioner Ann Cavoukian remarked on the tone of Chen’s ruling, saying she was “delighted” to see him use bold language. “They were quite strong in their view that this was completely inappropriate, which there is no doubt it is,” said Cavoukian.

Clear operates across the U.S. and is not sold in Canada. The class action applies specifically to residents of California whose information may have been collected and sold through the platform. That amounts to virtually all the state’s residents, the plaintiffs claim. 

Brooks and Shabazz are seeking damages for themselves and other class members, including disgorgement of profits that Thomson Reuters reaped from alleged “unlawful and unfair business practices and conduct.” They also want the company to stop selling class members’ personal data without their consent, “except for legally permissible uses.” 

In his statement for the company, Moran said Clear contains only “lawfully obtained information” and relies mainly on public records and information that’s already in the public domain. 

But Cavoukian said the scope of personal information on the platform and the ease with which customers can access it—the plaintiffs claim that Clear receives more than 100,000 searches a day—“should never be allowed.” 

Thomson Reuters had argued that the plaintiffs had not shown that they suffered injuries that can be traced directly to the Clear platform. But Chen said the loss of control over their personal information—even if it wasn’t published or sold—is injury enough. 

Cavoukian echoed this position. “Privacy is all about control,” she said. “Personal control, relating to the use and disclosure of your personal information. If independent third parties can gain total access like this, you have no control. You have nothing. Your privacy [is] out the door.”