How Can My Biometric Data Be Used in the Workplace?

Some employers require biometric data to grant workers access to restricted areas or sensitive data. Employers may use employee fingerprints or face scans to use a laptop or for timekeeping. Many employees don’t like the idea of giving their employer their biometric data and may have concerns over privacy issues or worry about a data breach.

In most cases, employees have few privacy protections against employer-required biometric data. Only a few jurisdictions give employees a private right over their biometric data. For legal advice about your biometric data privacy rights, talk to a local employment law attorney.

What Is Biometric Data?

Biometric data is personal data based on an individual’s biological and behavioral characteristics. Generally, biometric data can identify an individual with distinguishing information using voice recognition, facial recognition, and hand and finger identification. Such data includes:

• Fingerprints
• Palmprints
• Retina scans
• Facial scans
• Voiceprints

Many people use their fingerprints or face IDs to unlock their phones as a security measure. Businesses are increasingly asking employees to use biometric technology in the workplace. Some employers require workers to unlock their laptops with a fingerprint or iris scan.

Fight for Your Employee Rights at Work

If your employer is violating your rights, you can find a top employment law attorney near you in the Super Lawyers directory who will stand up for you.

Find a lawyer today

State Biometric Privacy Protections

In 2008, the Illinois Biometric Information Privacy Act (BIPA) was quite ahead of its time. It took seven years before the first lawsuit was even filed under the BIPA. BIPA prohibits private companies from collecting an individual’s biometric data without consent.

“At the time, Chicago served as a sort of a pilot case in the commercial industry for conducting financial transactions via the use of biometrics,” says Stefan Dandelles, an insurance attorney with Kaufman Dolowich who also practices in data privacy. “The state of Illinois responded by saying, ‘Okay, well, in that case, we’re going to need to protect the use of consumer biometric identifiers when people engage in these financial transactions.'”

Fast forward several years to companies’ almost daily use of biometric data. In addition to Illinois, Washington, and Texas have also passed biometric data collection protections. There is still no federal employment law that prohibits biometric collection and use.

How Is Biometric Data Commonly Used?

“The biggest way the collection of biometric data is used in the employment context is for timekeeping — punching in and out,” says Dandelles. “It’s intended to be more efficient and more transparent for employees.” Employees might think, “Wait a second — is using my fingerprint and thus giving this unique sensitive information to my employer safe?” 

“It’s not only not harming employees, but also it’s helping them have clear employment and time clock records,” he says. “For example, there’s a lot of wage and hour litigation around employees saying, ‘Oh, I was on the clock, and I wasn’t paid the proper overtime.’ Biometrics are going to make it abundantly clear when you were on the clock and when you weren’t. And it’s done knowingly. No employee goes in and puts their finger on a scanner not knowing what’s happening, so there’s implicit consent there already.”

What Requirements Must Employers Follow to Use Biometric Data?

For employers to utilize such biometric practices in Illinois, there are employee biometric privacy laws and certain steps they have to take. “Most notably, it requires an explicit permission and a written release,” Dandelles says. 

Employers must inform employees in writing about the collection, storage, and retention of their biometric data. Employers must also disclose the specific purpose and timeline for collecting and storing. Employees should understand any potential use of that data.

“Biometrics are good because they can’t really be faked or duplicated,” says Dandelles. “But once it’s gone, it’s gone. You can’t un-ring that bell. If your credit card is stolen, you can cancel your credit card or get a new one. If your bank account is compromised, you can close that bank account and open a new one. But if your fingerprint or retinal scan is taken, you can’t change that. There is a permanence to it.”

What Happens if Your Employer Violates Your Biometric Data Rights?

But what can someone do with data like a fingerprint scan?

“It’s not like they have your finger, right, but they do have, for example, a pattern of activity,” Dandelles says, referring to the 2019 case Rosenbach v. Six Flags Entertainment Corp. The Illinois Supreme Court held that a person can seek damages based on a technical violation of BIPA. Even if that person has suffered no actual injury as a result of the violation, they can get damages. 

At issue in Rosenbach was a 14-year-old who had his fingerprint scanned to enter Six Flags under his season pass. His mother alleged that Six Flags did not inform them they would collect biometric data. “What Six Flags could have done is track you: ‘Oh, this kid came to Six Flags 10 times in the month of June,'” Dandelles says. “While they can’t sell a fingerprint to marketers, they can sell the tracked data that came from it.” 

Facebook, too, was recently at the heart of a BIPA class action lawsuit: It settled for $650 million with Illinois users under the act. “What Facebook does is they use facial recognition technology and face geometry based on pictures that are posted,” Dandelles says. “There are many millions of pictures posted to Facebook every single day. They can then say, ‘We recognize this face,’ and tag you. But they did not inform users that they’d be collecting and storing digital scans of their faces.”  

Are There Ways to Strengthen Biometric Data Protections?

Dandelles appreciates the consumer protections BIPA allows and says Illinois has the strictest such statutes in the nation. However, he would also like to see reform that ensures compliance and focuses on education and awareness.

“We need something more than just a bunch of litigation around something that’s really not causing, in most instances, any actual harm to consumers, especially as the advancement of biometrics becomes more accepted around the country,” Dandelles says.

“I imagine many states will begin to enact laws to regulate and protect that information, and hopefully they do so in a measured way. As Illinois was a leader in providing these protections, it needs to also be a leader in saying, ‘Okay. We’re going to right-size this. We’re going to modify it, reform it so that it better suits the real world while still safeguarding consumers.’ Other states can then take the experience and enact similar statutes without setting businesses up for failure with this strict liability, ‘gotcha’-type mechanism, which is what we currently have on the books in Illinois.”

Learn More About Biometric Laws and Get Legal Help

If you have concerns over the use of your biometric data in the workplace, reach out to an experienced employment law attorney in your area. To learn more about this area of law, see our resources on data privacy and cybersecurity.