Ver la versión en español aquí

Unless you recently woke up from a cryogenic slumber, your biometric information is out there. In today’s world, devices scan our palms before taking standardized tests. We unlock our phones with our fingers and our face. And we bicker with our named audio speakers in order to turn down the tunes. But whatever the method, biometric identification devices are mainstream, and employers will have to decide whether using this technology is worthwhile.

What are the benefits?

Biometrics refers to the measurement and statistical analysis of a person’s physical and behavioral traits. The most common biometric devices are thumbprint scanners, retina or iris scanners, voice recognition, facial recognition, and signature verification technologies.

More and more, employers are using these devices to accurately track employees in order to stop “buddy punching,” where employees clock in and out for each other. Systems like this can severely limit employee time theft and increase the accuracy of time records, facilitating employers’ making with the FLSA and other employment laws.

Another benefit is that employers can better ensure that authorized employees are the only ones accessing certain information, equipment, software, and areas of their facilities. This can help save costs for employers who use passwords or key cards which may be lost or stolen. The benefits of biometrics fall to a company’s bottom line, but employers looking to improve profits will have to face a changing legal landscape.

What are the risks?

The legal risks stem from privacy concerns. While there is no specific federal law banning biometric scanners, several states have passed laws protecting their citizens from biometric data mining. Illinois, Washington, and Texas have passed laws requiring varying levels of notice, consent, and other restrictions on the types of permitted biometric devices. So far, these are the only three states with legislation applicable to employers and other commercial actors, but more states, including Florida, have taken action to preserve privacy.

In 2014, Florida banned public schools and school districts from collecting or retaining any biometric information—specifically fingerprints, hand scans, retina or iris scans, voice prints, and facial geometry scans. Fla. Stat. § 1002.222(1)(a). And, currently pending before the Florida legislature is a bill (S. 1270) called the Florida Biometric Information Privacy Act, fashioned after the Illinois law, which would create restrictions on private entities’ ability to collect, use and maintain biometric information.

Among other things, the proposed law would require private entities seeking to collect such information to inform people of their intention to do so, identify the purpose for which the information is to be collected and the length of time the biometric data will be collected, stored and used, and obtain a written release from the individual whose biometric data is to be collected.  Additionally, a private entity in possession of biometric information would be required to publish policies establishing retention schedules and guidelines for deleting such information from their systems.

The proposed law also would require private entities to develop procedures to ensure that they store, transmit and protect from disclosure all biometric data using a reasonable standard of care, one that is at least as protective as the manner in which the entity safeguards is confidential information and other sensitive information. The bill would permit persons claiming to be harmed by a violation of the law to assert claims in court where they could recover actual damages or liquidated damages up to $5000 per violation as well as recovery of attorneys’ fees, if successful.

The patterns are clear to see. While Biometric technology will continue to grow in its use, employers should be aware of laws regulating the use of biometrics.

Even though it currently may be legal for Florida’s employers to collect biometric information from their employees it would be wise to implement policies and procedures that protect your employees’ privacy and biometric information if you are collecting such data. Here are some of the measures that employers should consider implementing:

  • Develop policies and procedures designed to ensure the proper handling and safeguarding of biometric data.
  • Provide written notification to your employees that their biometric information will be collected.
  • Explain the purposes of the data collection, how the data will be used and for how long it will be maintained.
  • Obtain written consent to use your employees’ biometric information and be prepared to make reasonable accommodations to anyone who may object to the collection of their biometric data on religious grounds (Yes, an employee at a West Virginia coal mine successfully challenged a hand scan requirement on a sincerely held conviction that the scan violated his religious beliefs).
  • Advise your employees that you will not be transferring their data to any third party without their consent.
  • Determine whether your insurance policy will cover claims under the proposed law.
  • Ensure your IT systems are sufficiently secure so as to protect your employees’ biometric information in at least the same manner as you protect other confidential and sensitive information.

Register Here for our 2nd Annual Tampa Labor & Employment Law Seminar from 8am-4pm on Friday May 10, 2019 at the Tampa Bay History Museum.

Register Here for our 29th Annual Miami Labor & Employment Law Seminar from 8am-4:15pm on Friday, May 17, 2019 at the Hard Rock Stadium.

*Special thanks to Thomas Raine, who assisted in the drafting of this post. Thomas is a third year Juris Doctor Candidate at the University of Miami School of Law.