Do you Need a Biometric Policy?
By Kelly A. Hayden, JD, Chief Legal Counsel
Published February 13, 2018
During the last half of 2017, 26 employers in Illinois faced class action lawsuits under the Illinois Biometric Information Privacy Act.
What is Biometric Information?
Employers are most likely to use biometric information to control access to the worksite, buildings, or specific work locations (in the form of hand, fingerprint, or retina scanners). In addition, systems utilizing biometrics may be used as time and attendance keepers, recording employees’ work hours, breaks, and lunch hours. Some employers may also use fingerprints when conducting background checks of applicants for employment.
What is the Illinois Biometric Information Privacy Act?
Should your organization collect biometric information using one of the systems described above, the law, passed in 2009, requires that you establish a policy concerning the use of such information and obtain an employee release. (Public sector employers, such as libraries and park districts, are exempt from the requirements of the Act.) The policy should address the key areas set forth in the law:
- Inform employees that you are collecting the information and that you will not sell, lease, or disclose their information absent their permission or other legally permissible reasons.
- Establish a retention policy for employee information. The law requires that the information be destroyed when the initial purpose for obtaining the information has been fulfilled or within three years of the employee’s last interaction with the organization, whichever occurs first.
- Obtain the employee’s written release. According to the Act, “release” means, “in the context of employment, a release executed by an employee as a condition of employment.”
What is the Penalty for Failing to Comply?
Employees have the right to sue for violations of the Act and collect the greater of $1,000 or actual damages for each violation negligently committed, and the greater of $5,000 or actual damages for each violation recklessly or intentionally committed. Plaintiffs can also collect attorneys’ fees and costs. Failure to comply could have astronomical monetary consequences for employers.
Management Association members can access a sample biometric consent and policy on our website, and are encouraged to contact the HR Hotline at email@example.com or 800-448-4584.