Biometric Data Collection at Work in Alabama: Your Rights

Federal law does not contain a comprehensive biometric privacy statute. Instead, biometric collection is regulated indirectly through existing frameworks. The Fair Credit Reporting Act (FCRA), 15 U.S.C. § 1681, applies when an employer uses a third party to collect, maintain, or use biometric data in connection with employment decisions such as hiring, promotion, or termination. Under FCRA, employers and service providers must obtain written authorization before collecting biometric information and must provide applicants and employees with disclosures about how the data will be used and retained.

The Electronic Communications Privacy Act (ECPA), 18 U.S.C. § 2511, restricts employer surveillance and recording of communications and electronic activities. While ECPA does not directly address biometric collection, it may constrain methods of biometric capture (such as recording of faces or video surveillance used to extract biometric identifiers) in certain contexts where employees have a reasonable expectation of privacy.

The Americans with Disabilities Act (ADA), 42 U.S.C. § 12101 et seq., may restrict collection of biometric data that reveals disability status. Some biometric systems can infer health or disability conditions; if an employer collects biometric data that reveals disability, it must treat such information as medical information subject to strict confidentiality requirements under the ADA.

Enforcement occurs through the EEOC (for disability-related biometric collection), the FTC (for FCRA violations), and DOJ (for ECPA violations). No single federal agency comprehensively regulates workplace biometric collection. Employers are not required to notify employees before collecting most biometric data unless the collection involves a third party, triggers FCRA obligations, or occurs in a context where state law applies.

Alabama has not enacted a biometric privacy statute comparable to laws in Illinois, Texas, California, or Washington. Alabama Code does not contain a specific statute regulating employer collection, use, retention, or destruction of biometric data. This means Alabama employers operate in a regulatory vacuum at the state level: they may collect fingerprints, facial recognition data, iris scans, voice recognition data, keystroke patterns, gait recognition, and other biometric identifiers without triggering statutory compliance obligations unique to Alabama.

However, Alabama common law recognizes a tort for intrusion upon seclusion under Alabama Code § 6-5-184 and general tort principles. An employee could theoretically sue an employer for collecting biometric data if the collection is: (1) an intentional intrusion into the employee's private affairs or seclusion, (2) so offensive or objectionable to a reasonable person as to constitute a serious affront to dignity or privacy, and (3) causing emotional harm or injury. This is a high bar; routine biometric collection for time-tracking or access control is unlikely to meet it, but covert biometric collection—such as facial recognition without notice or consent—might. No Alabama statute defines or caps damages for such claims.

Because Alabama has no state-level biometric law, employers are not subject to Alabama-specific disclosure requirements, consent rules, data retention limits, or destruction protocols. Employees have no state-level right to access, correct, or delete their biometric data in Alabama. Employers must instead comply with federal rules (FCRA, ECPA, ADA) and general common law duties of care and confidentiality. If an employer collects biometric data through a third-party service provider, FCRA obligations apply regardless of state law. If biometric collection involves electronic surveillance or recording, ECPA may apply. If biometric data reveals disability, ADA confidentiality rules apply. But Alabama itself imposes no additional restrictions, making it one of the most permissive states for employer biometric collection.

Alabama law provides broad exceptions to biometric privacy protection, primarily through absence of law. Employers are not required to obtain consent before collecting biometric data unless the collection involves a third party subject to FCRA, in which case written authorization is required. Employers need not provide notice of biometric collection unless the collection is covert or would otherwise constitute intentional intrusion under common law.

An important exception exists for law enforcement. Employers may collect and retain biometric data for criminal background checks conducted with law enforcement or through law enforcement channels without triggering most privacy restrictions, provided the data is used solely for employment eligibility or safety purposes.

Another exception applies to negligent or unintentional collection. If an employer collects biometric data inadvertently—such as through incidental video surveillance not designed to capture biometric identifiers—the employee cannot sue for intentional intrusion unless the employer then intentionally uses the biometric data for a separate purpose.

Employers also have a strong defense if the employee consents, even implicitly, to biometric collection. For example, if an employee voluntarily uses a fingerprint time-clock or facial recognition door access system, consent is typically inferred. However, consent must be informed; an employer cannot bury biometric collection in vague HR policies or employment agreements without clear disclosure.

A third exception involves data aggregation and anonymization. If an employer collects biometric data and then strips identifying information so that the data cannot be linked back to the individual, privacy tort claims are unlikely to succeed because the intrusion's harm is reduced.

Union agreements may impose additional restrictions on biometric collection. If an employer is subject to a collective bargaining agreement that restricts biometric collection, the agreement may override an employer's common law right to collect such data unilaterally. However, Alabama is a right-to-work state, and most employers are non-unionized.

Step 1: Document the biometric collection. Keep records of when, how, and what biometric data the employer collected. Note the stated purpose (time-tracking, access control, security, background check). Save any policies, consent forms, or communications about biometric collection. If collection occurred without notice, document that fact—date, method, whether you were informed, and whether you objected. Take screenshots of any biometric system interfaces or vendor contracts the employer uses. Keep all emails requesting biometric data or confirming your enrollment in a biometric system.

Step 2: Attempt an internal complaint. Contact your HR department in writing (email is best) and state your objection to biometric collection. Ask for written clarification of why the employer collects your biometric data, how long it is retained, who has access, and whether it will be shared with third parties. Ask whether the biometric data is being used for purposes you did not authorize. Request that your biometric data be deleted and request a written response within 10 days. Document any oral responses or delays. If the employer refuses to delete your data or provide clarity, the refusal strengthens a later legal claim by showing bad faith.

Step 3: Determine which agency or forum to file with. Because Alabama has no state biometric privacy law, you cannot file a complaint with an Alabama state agency. However, if the biometric collection involved a third-party vendor and you were not properly informed or consented to (required under FCRA), you may file a complaint with the Federal Trade Commission (FTC) at https://reportfraud.ftc.gov or call 1-877-IDTHEFT (1-877-438-4338). If biometric collection involved covert electronic surveillance or recording, you may file a complaint with the FBI or local law enforcement under the Electronic Communications Privacy Act. If the biometric data revealed your disability status and the employer breached confidentiality, you may file a charge with the EEOC at https://www.eeoc.gov/filing-charge-discrimination or call 1-800-669-4000. Most importantly, because Alabama recognizes only a common law tort claim for intrusion upon seclusion, you must consult an employment attorney to file a civil lawsuit in Alabama state court.

Step 4: Understand the investigation and litigation process. If you file an FCRA complaint with the FTC, the FTC will investigate and may seek a settlement or take action against the vendor; however, you will not be a direct party. If you file an EEOC charge, the EEOC will investigate (typically within 180 days) and may attempt conciliation or refer you to mediation. You must file the EEOC charge before filing a Title VII lawsuit if disability discrimination is involved. For a common law intrusion claim, you will work with your attorney to file a civil lawsuit in Alabama district court. Discovery will include depositions, document requests, and subpoenas to the employer and biometric vendor. The case may settle or go to trial. Litigation typically takes 1-3 years. Damages may include compensatory damages for emotional distress and punitive damages if the employer's conduct was malicious.

Step 5: Consult an employment attorney. Given Alabama's lack of state biometric law, legal claims are uncertain and require expert analysis. Contact an employment attorney licensed in Alabama who has experience with privacy torts or workplace intrusion claims. Most offer free initial consultations. Bring all documentation from Steps 1 and 2. An attorney can assess whether your case meets the elements of intrusion upon seclusion (intent, intrusion, offense to reasonable person, damages), whether federal law (FCRA, ECPA, ADA) applies, and whether settlement or litigation is advisable. Attorneys typically work on contingency for strong intrusion cases, meaning you pay no upfront fee and the attorney takes a percentage of any recovery.