Biometric Data Collection at Work in Arizona: Your Rights

Federal law does not comprehensively regulate employer biometric data collection, but several federal statutes apply. The Electronic Communications Privacy Act (ECPA), 18 U.S.C. § 2511, prohibits unauthorized interception of electronic communications, which may include digital biometric data transmitted without consent. The Americans with Disabilities Act (ADA), 42 U.S.C. § 12101, restricts collection of medical information through biometric screening, such as iris scans or DNA analysis, if they reveal disability-related information. The Fair Credit Reporting Act (FCRA), 15 U.S.C. § 1681, governs background checks that may include biometric screening; employers must provide notice and obtain authorization before obtaining background reports and must certify compliance with FCRA requirements.

The Gramm-Leach-Bliley Act (GLBA), 15 U.S.C. § 6801, applies to financial institutions and requires safeguarding of customer information, including biometric identifiers. The Health Insurance Portability and Accountability Act (HIPAA), 45 C.F.R. § 160-164, restricts health plans' use of biometric data if it reveals health status. The Federal Trade Commission (FTC) enforces these statutes and has authority under the FTC Act, 15 U.S.C. § 45, to challenge unfair or deceptive practices related to biometric data collection and use. However, federal law does not require employer consent or notice specifically for biometric collection; states have filled this gap with their own laws.

Arizona currently lacks a comprehensive biometric privacy statute comparable to the Illinois Biometric Information Privacy Act (BIPA) or Washington's My Health My Data Act. Instead, Arizona employers must comply with general privacy protections under Arizona Revised Statutes section 34-101, which recognizes employee privacy rights in the workplace, and Arizona Revised Statutes section 13-2316, which provides tort remedies for intentional interference with privacy. Under these provisions, an employer may face liability if biometric data collection violates a reasonable expectation of privacy.

Unlike Illinois, Arizona does not impose statutory penalties per biometric scan or require standing based solely on unauthorized collection. However, Arizona courts recognize intrusion upon seclusion and similar tort claims when employers collect sensitive personal information without appropriate consent or disclosure. Arizona employers may collect fingerprints, facial recognition data, iris scans, and other biometric identifiers for employment screening, background checks, and workplace security without violating a specific state biometric statute, but best practice requires written informed consent and clear disclosure of the purpose, retention period, and security measures.

Arizona Revised Statutes section 34-226.01 does require employers to notify employees of workplace monitoring, including video surveillance and electronic communications monitoring. Biometric collection, if it constitutes workplace monitoring, may trigger this notice requirement. Employers should treat biometric data collection as sensitive personal information and implement safeguards consistent with Arizona's Privacy Act principles. Additionally, Arizona employers subject to federal FCRA requirements for background checks must comply with authorization and notice requirements when biometric data is part of the screening process.

Arizona law recognizes several exceptions to general biometric privacy expectations. Law enforcement and court-ordered biometric collection, such as fingerprinting for criminal background checks under FBI or state crime record systems, is not subject to the same privacy constraints as private employer collection; however, employers must still comply with state authorization requirements under the Fair Credit Reporting Act.

Employers may collect biometric data without explicit consent if collection is incidental to lawful security or facility access systems, provided the data is not retained beyond its immediate security purpose. For example, a facial recognition system used at a building entrance to grant access may not require individual consent if the system does not retain images after access verification and the employer provides notice of the security measure.

Biometric data collected under union collective bargaining agreements may have different requirements if the agreement addresses data privacy and security. Employers should review applicable union contracts for specific biometric collection or use restrictions that may supersede general Arizona law. Federal contractors and employers in regulated industries such as healthcare, finance, or law enforcement may have additional federal requirements for biometric data that preempt or supplement Arizona law.

The ADA exception applies: if biometric collection (such as iris or retinal scanning) would require an employer to screen for disability-related information, the collection is restricted unless it serves a legitimate non-discriminatory purpose. Small employers with fewer than 15 employees are not covered by the ADA, but remain subject to Arizona state law privacy protections. Public sector employers are subject to additional constitutional privacy protections under the Arizona Constitution Article 2, Section 8, which may impose stricter requirements than private employer law.

Step 1: Document the unauthorized biometric collection. Record the date, time, location, and method of collection (fingerprinting, facial scan, iris scan, voice recognition, hand geometry, etc.). Save all communications from the employer about biometric data use, retention, and security. Take screenshots of any biometric enrollment systems or consent forms (or lack thereof). Keep copies of your employee handbook, onboarding materials, and any policy documents mentioning security or background checks. Document any specific instruction to provide biometric data and your response (consent or refusal).

Step 2: Request internal complaint resolution if the employer has an HR department or privacy officer. Send a written email or letter to HR requesting clarification of the biometric data collection policy, asking why consent was not obtained, and requesting confirmation that the data will be deleted or that future collection will obtain consent first. Request written documentation of the employer's biometric data retention and security practices. Keep a copy of this request and any response. If the employer acknowledges the violation or agrees to halt collection, request written confirmation.

Step 3: File a complaint with the Arizona Attorney General's Consumer Fraud Division or, if the biometric data is part of a background check covered by FCRA, file with the Federal Trade Commission (FTC) at www.reportfraud.ftc.gov or report.identitytheft.gov. You may also file a complaint with the EEOC if the biometric collection relates to disability discrimination (asking for iris scans or other medical biometric data). The FTC does not have a specific deadline but accepts complaints year-round. There is no statutory filing deadline in Arizona for general privacy tort claims, but you should file within three years of discovery of the unauthorized collection under Arizona's statute of limitations for tort claims.

Step 4: Expect a preliminary investigation. If you filed with the Arizona Attorney General, the office will determine whether the employer's practice violates consumer protection laws or privacy statutes. If you filed with the FTC regarding FCRA violations, the FTC will investigate whether the background check process complied with authorization and notice requirements. This process typically takes 30-60 days for initial assessment. If the FTC finds FCRA violations, the employer may be ordered to notify you and provide you with the background report. If the Arizona Attorney General determines consumer fraud occurred, they may pursue enforcement against the employer or facilitate settlement negotiations.

Step 5: Consult an employment attorney if the employer retaliated for complaining about biometric collection, if the unauthorized collection caused identity theft or other harm, or if the investigation does not resolve your complaint. An Arizona employment attorney can advise you on tort claims for intrusion upon seclusion or invasion of privacy under Arizona common law and state statute. If disability discrimination is involved, consult an attorney experienced in ADA claims. If the violation occurred in the context of a background check, an FCRA specialist attorney can pursue statutory damages under 15 U.S.C. § 1681n (willful FCRA violation carries damages of $100-$1,000 per violation). Expect that a civil lawsuit may be necessary if the employer does not voluntarily remediate; Arizona courts recognize damages for emotional distress and violations of privacy rights.