I recently read an article published on the Society for Human Resource Management’s website on the prevalence of biometrics in the employment context. Specifically, the author referenced a Spiceworks’ survey of IT professionals from February 2018 that provided, in my mind, surprising results.
And the survey says…
The survey showed that 62% of the respondent companies presently use biometrics for security and business purposes (for example, fingerprint scanning, facial recognition, or retinal scan), with an additional 24% planning to use such within the next 2 years. A quick Google search showed that, at a minimum, biometric time clocks (which are used by a multitude of employers for time and attendance tracking) are alive and well and quickly becoming the norm in many industries – and not just for defense contractors or companies into super-secret, competitive research.
Given this growing, across-the-board popularity of biometrics in the workplace, I immediately wondered about the privacy and security issues surrounding such use. Granted, a few states include biometrics as protected personal information in the event of a data breach, but should companies be allowed to obtain such unique data at all absent explicit consent? If they collect it, how do they store it and protect it? Are they allowed to sell it to or share it with third-parties, including the government, without consent? Clearly, this is just one of many examples of where technology has outpaced the law.
At present, there are only a small number of U.S. states that have laws specifically addressing the collection, use, protection, and sharing of biometric data – cue Illinois, Texas, and Washington. While other states (less than half) do protect biometric data in some fashion, their laws currently aren’t as comprehensive as those in the aforementioned three states (although the new California Consumer Protection Act comes close). And, naturally, U.S. law has not kept pace with the EU, which generally prohibits (under the GDPR) the use of biometric data as a unique identifier of an individual, although an exception for employment purposes is recognized (albeit with prior approval from the EU or Member State or if collectively bargained) – cue France, whose Data Protection Authority just issued a proposed regulation on “work biometrics.”
To be clear, I am not advocating for or against the use of biometrics – there are pros and cons on both sides of the equation. But I do find such academic discussions quite interesting, privacy nerd that I am. In the meantime, I will continue to wait (with not-so-bated-breath) to see if our U.S. government steps in with an all-encompassing (and, hopefully, preemptive) federal law to put all discussions to bed, once and for all (rumor has it that federal consumer privacy “standards” are in the works).
What you should do
Until that happens, however, if you are a company collecting the biometrics of your employees (or any individual, for that matter), make sure you keep abreast of relevant state (or, as applicable, international) law and update your policies and procedures accordingly. Otherwise, that ticking you hear from your biometric time clock could turn out to be a biometric time bomb.