Privacy Ref Blog

Is Your Biometric Clock Ticking?

I recently read an article published on the Society for Human Resource Management’s website on the prevalence of biometrics in the employment context. Specifically, the author referenced a Spiceworks’ survey of IT professionals from February 2018 that provided, in my mind, surprising results.

And the survey says…

The survey showed that 62% of the respondent companies presently use biometrics for security and business purposes (for example, fingerprint scanning, facial recognition, or retinal scan), with an additional 24% planning to use such within the next 2 years. A quick Google search showed that, at a minimum, biometric time clocks (which are used by a multitude of employers for time and attendance tracking) are alive and well and quickly becoming the norm in many industries – and not just for defense contractors or companies into super-secret, competitive research.

Given this growing, across-the-board popularity of biometrics in the workplace, I immediately wondered about the privacy and security issues surrounding such use. Granted, a few states include biometrics as protected personal information in the event of a data breach, but should companies be allowed to obtain such unique data at all absent explicit consent? If they collect it, how do they store it and protect it? Are they allowed to sell it to or share it with third-parties, including the government, without consent? Clearly, this is just one of many examples of where technology has outpaced the law.

Legal requirements

At present, there are only a small number of U.S. states that have laws specifically addressing the collection, use, protection, and sharing of biometric data – cue Illinois, Texas, and Washington. While other states (less than half) do protect biometric data in some fashion, their laws currently aren’t as comprehensive as those in the aforementioned three states (although the new California Consumer Protection Act comes close). And, naturally, U.S. law has not kept pace with the EU, which generally prohibits (under the GDPR) the use of biometric data as a unique identifier of an individual, although an exception for employment purposes is recognized (albeit with prior approval from the EU or Member State or if collectively bargained) – cue France, whose Data Protection Authority just issued a proposed regulation on “work biometrics.”

To be clear, I am not advocating for or against the use of biometrics – there are pros and cons on both sides of the equation. But I do find such academic discussions quite interesting, privacy nerd that I am. In the meantime, I will continue to wait (with not-so-bated-breath) to see if our U.S. government steps in with an all-encompassing (and, hopefully, preemptive) federal law to put all discussions to bed, once and for all (rumor has it that federal consumer privacy “standards” are in the works).

What you should do

Until that happens, however, if you are a company collecting the biometrics of your employees (or any individual, for that matter), make sure you keep abreast of relevant state (or, as applicable, international) law and update your policies and procedures accordingly. Otherwise, that ticking you hear from your biometric time clock could turn out to be a biometric time bomb.

Privacy Ref provides consulting and assessment services to build and improve organizational privacy programs. For more information call Privacy Ref at (888) 470-1528 or email us at

Posted on September 21, 2018 by Kelly Cheary

« »

No Responses

Comments are closed.

« »

Subscribe to our mailing list

Please fill out the form below.


Want to find out more?

Simply go to the contact page, fill out the form, and someone from Privacy Ref will be in touch with you. You can also send an email to or call (888) 470-1528.


April 16, 2018

IAPP Training Classes
Privacy Ref is proud to announce that we are an official training partner of the IAPP. You now have the opportunity to learn from one of our knowledgeable privacy professionals using the most respected training content in the industry. The robust interactive training offered, aids in the understanding of critical privacy concepts. The contents of the courses are integral to obtaining your privacy certifications and to educate your new team. Learn more here.

Latest Blog Posts

February 1, 2019

In praise of a privacy compliance program

Opening my newsfeed this morning I was not surprised to find an article about another data breach. Over the coming days I am sure we will discover that the organization's policies were well defined, that training and awareness had taken place, and it was just that the procedures weren't followed by one individual. The skeptic in me would say that if one person isn't following procedures, there are probably others. To prevent situations like these, an organization must establish a privacy compliance regimen. Continue reading this post...

December 19, 2018

Political Campaigns Need Privacy Policies and Training
When I made the transition from working in American Politics to learning about Privacy, the first tidbit of information I was given was that there was a difference in terminology between the American  and the European practice. In America, we use the term Privacy but in Europe they use the term Data Protection. As I continued my journey in “Privacy” and I considered how my new-found training would have impacted my career in politics, I have come to feel that the term data protection is more applicable to the needs of political campaigns. If I were to review the numerous political campaigns that I have managed, marketed, and organized, data protection has always been woefully inadequate throughout them all. Continue reading this post...

Other Recent Posts