Privacy Ref Blog

Is Your Biometric Clock Ticking?

I recently read an article published on the Society for Human Resource Management’s website on the prevalence of biometrics in the employment context. Specifically, the author referenced a Spiceworks’ survey of IT professionals from February 2018 that provided, in my mind, surprising results.

And the survey says…

The survey showed that 62% of the respondent companies presently use biometrics for security and business purposes (for example, fingerprint scanning, facial recognition, or retinal scan), with an additional 24% planning to use such within the next 2 years. A quick Google search showed that, at a minimum, biometric time clocks (which are used by a multitude of employers for time and attendance tracking) are alive and well and quickly becoming the norm in many industries – and not just for defense contractors or companies into super-secret, competitive research.

Given this growing, across-the-board popularity of biometrics in the workplace, I immediately wondered about the privacy and security issues surrounding such use. Granted, a few states include biometrics as protected personal information in the event of a data breach, but should companies be allowed to obtain such unique data at all absent explicit consent? If they collect it, how do they store it and protect it? Are they allowed to sell it to or share it with third-parties, including the government, without consent? Clearly, this is just one of many examples of where technology has outpaced the law.

Legal requirements

At present, there are only a small number of U.S. states that have laws specifically addressing the collection, use, protection, and sharing of biometric data – cue Illinois, Texas, and Washington. While other states (less than half) do protect biometric data in some fashion, their laws currently aren’t as comprehensive as those in the aforementioned three states (although the new California Consumer Protection Act comes close). And, naturally, U.S. law has not kept pace with the EU, which generally prohibits (under the GDPR) the use of biometric data as a unique identifier of an individual, although an exception for employment purposes is recognized (albeit with prior approval from the EU or Member State or if collectively bargained) – cue France, whose Data Protection Authority just issued a proposed regulation on “work biometrics.”

To be clear, I am not advocating for or against the use of biometrics – there are pros and cons on both sides of the equation. But I do find such academic discussions quite interesting, privacy nerd that I am. In the meantime, I will continue to wait (with not-so-bated-breath) to see if our U.S. government steps in with an all-encompassing (and, hopefully, preemptive) federal law to put all discussions to bed, once and for all (rumor has it that federal consumer privacy “standards” are in the works).

What you should do

Until that happens, however, if you are a company collecting the biometrics of your employees (or any individual, for that matter), make sure you keep abreast of relevant state (or, as applicable, international) law and update your policies and procedures accordingly. Otherwise, that ticking you hear from your biometric time clock could turn out to be a biometric time bomb.

Privacy Ref provides consulting and assessment services to build and improve organizational privacy programs. For more information call Privacy Ref at (888) 470-1528 or email us at

Posted on September 21, 2018 by Kelly Cheary

« »

No Responses

Comments are closed.

« »

Subscribe to our mailing list

Please fill out the form below.


Want to find out more?

Simply go to the contact page, fill out the form, and someone from Privacy Ref will be in touch with you. You can also send an email to or call (888) 470-1528.


May 31, 2019

We are now offering Privacy Professional Training from the IAPP at our Houston and Nashua offices in addition our Delray Beach location.

Latest Blog Posts

June 13, 2019

Fifty States, Fifty Laws

The big news lately is that individual states are proposing their own privacy laws. California has the California Consumer Protection Act and now New York and Maine have also proposed laws. There has been discussion of a federal law, however it seems unlikely that any kind of landmark legislation on privacy passes through to be signed. How is a business to be ready for up to 50 different laws?

Continue reading this post...

June 12, 2019

Privacy Comes at a Price
At Apple’s World Wide Developers Conference last week, the message was all about Privacy. Apple has been more privacy-minded than other tech companies – that’s not news and it’s why I have an iPhone. They’ve introduced some interesting privacy features, such as showing location tracking, which I think is pretty cool. I don’t leave my location setting on, rather turn it on when I need directions and then back off. It’s tedious, but I’m not confident that when I’ve turned off location services, apps aren’t tracking me even though I said “no”. Sadly, I don’t think no means no on the Internet. So, I’ll be able to see if I’m right or wrong. Continue reading this post...

Other Recent Posts