Finally get that promotion? Get exclusive content, tips and tools to help you excel.
Shawn Premer shows how doing the right thing for employees leads to positive business results.
Is your employee handbook keeping up with the changing world of work? With SHRM's Employee Handbook Builder get peace of mind that your handbook is up-to-date.
Build competencies, establish credibility and advance your career—while earning PDCs—at SHRM Seminars in 12 cities across the U.S. this spring.
#SHRM18 will expand your perspective – on your organization, on your career, and on the way you approach HR. Join us in Chicago June 17-20, 2018
Ensure compliance with biometric privacy statutes and data-breach laws
Members may download one copy of our sample forms and templates for your personal use within your organization. Please note that all such forms and policies should be reviewed by your legal counsel for compliance with applicable law, and should be modified to suit your organization’s culture, industry, and practices. Neither members nor non-members may reproduce such samples in any other way (e.g., to republish in a book or use for a commercial purpose) without SHRM’s permission. To request permission for specific items, click on the “reuse permissions” button on the page where you find the item.
Imagine a new technology that enables HR professionals to accurately monitor employee attendance and ensure facilities are accessed only by authorized personnel. Best of all, this technology is impervious to abuse and falsification, cuts costs and administrative time, and can be operated by anyone with just the touch of a finger.
Companies are increasingly incorporating technologies into the workplace that use employee biometric data to accomplish these objectives. But the benefits of these technologies are accompanied by legal scrutiny, so companies must remain aware of their obligations regarding employee biometric data.
What Is Biometric Information?
Biometric data refers to unique, measurable human biological or behavioral characteristics that can be used for identification. Biometric identifiers include fingerprints, voiceprint, retina or iris scans, and scans of hand or face geometry.
In the workplace, the most common example of biometrics involves the use of employee fingerprints to access facilities or clock in and out through timekeeping systems. Companies are gradually incorporating biometric identifiers into other consumer transactions, such as using facial recognition software or fingerprint scans to authenticate users' identities when making ATM withdrawals or unlocking their phones, for example.
What Legal Restrictions Apply?
As biometric technologies become more common, laws continue to develop and provide more guidance to employers about properly collecting, storing and using biometric information:
Biometric information privacy statutes. Several states have passed laws that regulate how companies may collect, store and disclose biometric information from employees or other individuals. Illinois took the lead with this legislation, passing its Biometric Information Privacy Act (BIPA) in 2008. Citing the public's concern with the use of biometrics for business transactions and the heightened risk of identity theft that biometric information entails, the Illinois Legislature sought to protect individual privacy and encourage private entities to bolster information security. The statute flew under the radar until a surge of class-action lawsuits was filed in 2015, targeting companies such as Facebook and Shutterfly for alleged violations. More-recent lawsuits have taken aim at smaller employers in Illinois. And it's easy to see why attorneys have taken notice: The penalties associated with BIPA range from $1,000 to $5,000 per violation and include attorney fees.
BIPA requires employers to adopt policies regarding biometric data collection and retention, obtain consent before collecting biometric data, and take steps to securely store and protect from disclosure any biometric information that is collected. Additionally, employers may not disclose biometric information except in limited circumstances. Employers may not sell, lease, trade or otherwise profit from any individual's biometric information.
Other states have followed Illinois' lead on biometric-information privacy laws: Texas and Washington have similar laws on the books, although they entail less-comprehensive requirements and do not offer the opportunity for individuals to bring private lawsuits for violations. Comparable legislation is pending in several other states. As concerns about privacy increase, this trend is likely to expand to more and more states.
Data breach notification statutes. State data-breach notification statutes include biometric information in the definition of protected personal information. Under these statutes, an employer must notify an employee if his or her biometric information is exposed through a breach of the employer's records. Each statute includes specific requirements regarding when notification must be provided and what type of activity constitutes a breach that triggers the notification requirement. Violations of these laws can lead to state agency investigations and steep penalties. For example, the New Mexico statute authorizes civil penalties of up to $150,000.
[SHRM members-only toolkit: Introduction to the Discipline of Human Resources Technology]
Practical Suggestions for Compliance
To ensure compliance, employers should:
Lauren A. Daming is an attorney with Greensfelder, Hemker & Gale PC in St. Louis.
Was this article useful? SHRM offers thousands of tools, templates and other exclusive member benefits, including compliance updates, sample policies, HR expert advice, education discounts, a growing online member community and much more. Join/Renew Now and let SHRM help you work smarter.
You have successfully saved this page as a bookmark.
Please confirm that you want to proceed with deleting bookmark.
You have successfully removed bookmark.
Please log in as a SHRM member before saving bookmarks.
Please sign in as a SHRM member before saving bookmarks.
Please purchase a SHRM membership before saving bookmarks.
An error has occurred
Recommended for you
Choose from dozens of free webcasts on the most timely HR topics.
SHRM’s HR Vendor Directory contains over 3,200 companies