Legislative Trends: Biometrics in Human Capital Management
Companies utilizing biometric time clocks or other devices that collect biometric information for security or other purposes should take note of recent developments with workplace compliance implications. The term "biometrics" generally refers to certain biological characteristics of an individual, such as fingerprints, facial geometry, retinal scans and voiceprints. In the workplace, employers may rely on biometric technology to help verify employees' identities when they clock in or out by scanning a portion of the employee's finger or hand.
Legal and Compliance Considerations – Focus on Illinois
Many locations consider biometric information to be particularly sensitive data. In the United States, several states, such as Illinois, have laws regulating the treatment of biometrics, generally mandating specific notice and expressed consent before collecting such information.
To date, the law with the broadest reach is the Illinois Biometrics Information Privacy Act ("BIPA"), which requires that companies develop a written policy that is available to the public, and establish a retention schedule and guidelines for permanently destroying biometric data within a certain period of time. BIPA also requires that companies make certain disclosures and obtain a written consent from the individual before collecting and storing his or her biometric data ― and use an appropriate standard of care to store, transmit and protect the data from disclosure.
BIPA allows individuals to file lawsuits and receive statutory damages. Since July 2017, more than 200 lawsuits have been filed under BIPA against employers operating in Illinois, most of which are class actions seeking statutory damages ranging between $1,000 and $5,000 per violation.
A recent decision of the Illinois Supreme Court held that the collection and use of an individual's biometric information without consent entitles the individual to statutory damages even in the absence of any actual harm. This development makes it easier to bring BIPA class actions, and employers should expect to see increased litigation in this area. Because employers with significant workforces in Illinois could face potentially catastrophic exposure, it is critical for employers using biometric time clock technology in Illinois to take immediate steps to help ensure that they are compliant with BIPA.
An immediate and appropriate first step is to review existing policies and practices, and assess compliance with BIPA. ADP is committed to assisting clients with compliance requirements resulting from rapidly evolving legislation. To that end, ADP has published and distributed sample policies and consent forms to assist clients with BIPA compliance. These forms are available at websites accessible to ADP clients. If you are unable to locate them, please contact your ADP Service Consultant for assistance.
On the Horizon
While this update has focused on developments in Illinois, other states also have laws regulating the use of biometric technology generally (e.g., Washington and Texas), or fingerprint collection specifically (e.g., New York and California). New laws like the California Consumer Privacy Act (CCPA), and existing state data breach laws, include biometrics in the definition of personal data and must be considered. Still other states are considering new legislative proposals to regulate biometrics (e.g., Arizona, New Hampshire, Michigan, Florida and New York).
ADP Compliance Resources
ADP maintains a staff of dedicated professionals who carefully monitor federal and state legislative and regulatory measures affecting employment-related human resource, payroll, tax and benefits administration, and help ensure that ADP systems are updated as relevant laws evolve. For the latest on how federal and state tax law changes may impact your business, visit the ADP Eye on Washington Web page located at www.adp.com/regulatorynews.
ADP is committed to assisting businesses with increased compliance requirements resulting from rapidly evolving legislation. Our goal is to help minimize your administrative burden across the entire spectrum of employment-related payroll, tax, HR and benefits, so that you can focus on running your business. This information is provided as a courtesy to assist in your understanding of the impact of certain regulatory requirements and should not be construed as tax or legal advice. Such information is by nature subject to revision and may not be the most current information available. ADP encourages readers to consult with appropriate legal and/or tax advisors. Please be advised that calls to and from ADP may be monitored or recorded.
If you have any questions regarding our services, please call 855-466-0790.
ADP, LLC.
One ADP Boulevard,
Roseland, NJ 07068
Updated on March 1, 2019
