Dear Littler: We are going to replace the punch-card timeclocks in our U.S. facilities with timeclocks that allow employees to “clock in” each day using their fingerprint. I’ve read about a flood of recently filed class action litigation against companies that collected biometric information and understand that many of these cases have been filed against employers that use biometric timeclocks. Can we go ahead and roll out the timeclocks? Or is there something more that we need to do?
—Concerned in Chicago
Dear Concerned in Chicago,
Your question is a good one, and of topical interest. The recent rash of class actions against employers that use timeclocks that collect information about employees’ fingerprints highlights the importance of understating the relevant laws, and planning ahead before replacing your company’s current system.
The timeclock that your company intends to use is a “biometric timeclock.” This timekeeping technology uses a scan of an employee’s body feature, such as a fingerprint, retina or iris, to verify the employee’s identity and clock the employee into, and out of, work. Biometric timeclocks prevent timeclock fraud, increase timekeeping efficiency, and enhance the accuracy of wage calculations.
However, as illustrated by the mounting number of class action lawsuits, implementing a biometric timeclock system must be done with care. There are several laws that govern the collection and storage of biometric information. These laws may require your company to, among other things, obtain written consent from employees before collecting biometric information from them. Here is a summary of key considerations.
Understand the Data Collected by the Biometric Timeclock
Your company’s legal obligations will depend on the type of information the biometric timeclock collects and the states in which your company rolls out the timeclock. Not all states regulate biometric timeclocks, and the state laws differ based on the type of information that the timeclock collects. Let’s focus on the timeclock first.
You will find many different types of biometric timeclocks on the market, and they use differing technology. Timeclocks that require employees to place a finger on the device are most common, but face-scanning and iris-scanning technology is also available. Another key difference is whether the technology collects an image of the body feature itself, such as a photograph of an actual fingerprint, or creates a unique identifier based on the body feature. For example, many models do not store an exact image of an employee’s fingerprint. Instead, the timeclock measures the distance between points on the fingerprint and then applies an algorithm to create a mathematical representation of the employee’s fingerprint. This “template” is linked to the employee’s identity. Each time the employee clocks in or out, the biometric timeclock applies the same process to the fingerprint and compares the result to the template to confirm the identity of the person who clocked in or out.
State Laws Regulating the Collection of Biometric Information
Over the past year, biometric privacy legislation has been introduced in several states, including most recently in Michigan.1 To date, however, only three states have enacted biometric privacy laws: Illinois, Texas, and Washington State. Washington’s law, effective July 23, 2017, is the most recent, but the law does not apply to an employer’s use of a biometric timeclock as part of a timekeeping system. Washington’s law applies when biometric data is stored in a database for a “commercial purpose,” which is defined as “a purpose in furtherance of the sale or disclosure to a third party of a biometric identifier for the purpose of marketing of goods or services.” Therefore, only the biometric privacy laws in Illinois and Texas are relevant for your company’s purposes. In addition to these biometric privacy laws, New York’s Labor Code includes a provision governing fingerprinting of employees that is applicable to biometric timeclocks. Here’s a summary of each state’s law:
Illinois
Illinois’ Biometric Information Privacy...
