Biometric Data Collection at Work in Colorado: Your Rights

Federal law does not prohibit private employers from collecting biometric data. However, the Fair Credit Reporting Act (FCRA), 15 U.S.C. § 1681 et seq., applies when biometric information is used as part of a background check or consumer report. Under the FCRA, employers must disclose that biometric data will be collected, obtain written authorization from the employee, and provide notice if adverse action is taken based on the report. The Equal Employment Opportunity Commission (EEOC) enforces FCRA compliance.

The Americans with Disabilities Act (ADA) may restrict collection of biometric data in limited circumstances if collection reveals disability status or genetic information. The Health Insurance Portability and Accountability Act (HIPAA) applies only to covered healthcare entities and business associates, not general employers. Biometric Information Privacy Act (BIPA) protections exist only in Illinois and a few municipalities—not federally or in most states including Colorado. The Federal Trade Commission (FTC) has authority over unfair or deceptive data practices but does not specifically prohibit biometric collection by private employers absent other violations.

Employers covered by state or local biometric laws must comply with those standards. For employers nationwide, data security and breach notification laws apply: if biometric data is breached, the employer must notify affected individuals and may face liability under state data security statutes.

Colorado has no state statute specifically prohibiting private employers from collecting biometric data. C.R.S. § 6-1-701 et seq. governs data security and breach notification but does not restrict the collection itself. This means Colorado's rule is significantly weaker than states with dedicated biometric privacy laws like Illinois (Biometric Information Privacy Act), Washington, and New York.

Under Colorado law, employers are covered by the same data security obligations as any business collecting personal information. If an employer collects biometric data (fingerprints, facial scans, iris recognition, voice patterns, or hand geometry), it must implement reasonable security measures and notify individuals without unreasonable delay if the data is breached (C.R.S. § 6-1-704). Notification must include the nature of the breach and steps individuals should take to protect themselves.

Colorado's common law recognizes privacy tort claims for "intrusion upon seclusion." An employee could potentially bring a tort claim if biometric collection is highly offensive and unreasonable in method or scope—for example, if collection occurs without consent or in a genuinely invasive manner. However, this is a narrow remedy and requires proving the collection was truly egregious, not merely unwanted.

When biometric data is used for background checks, the Fair Credit Reporting Act's disclosure and authorization requirements apply regardless of state law. Employers must also comply with any collective bargaining agreements that address biometric data. Colorado does not grant employees statutory privacy rights over biometric collection as states like California (CCPA/CPRA) do for broader personal information.

Colorado employers have broad discretion to collect biometric data absent a specific statute prohibiting it. The primary exception is the Fair Credit Reporting Act's procedural requirements: employers cannot use biometric data for background checks without written authorization and proper disclosure. If a background report is used to deny employment, the employer must provide notice and allow the employee to dispute inaccuracies.

Union and collective bargaining agreements may restrict or prohibit biometric collection. If a shop is unionized, the employer must negotiate over data collection practices and cannot unilaterally impose biometric collection that violates a contract. Public employers face additional restrictions under state personnel laws and the Colorado Open Records Act (C.R.S. § 24-72-202), which may apply to biometric data stored by government agencies.

Biometric data collected for lawful purposes—such as timekeeping systems, access control to secure facilities, or voluntary wellness programs—is generally not restricted, but employers must still secure the data and notify employees of breaches. The ADA creates an exception: employers cannot collect biometric data if it reveals disability status or genetic information, and cannot require medical examinations that reveal disability. An employer cannot refuse to hire or promote based on biometric data that incidentally reveals a disability.

Colorado law does not prohibit de-identified or anonymized biometric data collection. If data is truly de-identified such that individuals cannot be identified, breach notification may not apply. However, if re-identification is reasonably possible, the data is not truly de-identified.

Small employers are not exempt from data security or breach notification obligations. No de minimis exception exists in Colorado. Employers collecting minimal biometric data must still comply.

Step 1: Document the biometric collection practice and your objection. Keep records of all instances when biometric data was collected—the date, method (fingerprint scan, facial recognition, voice sample), whether you were informed in advance, whether you consented, and any communications requesting collection. Save all emails, consent forms, or notices about biometric data. If data was collected without notice or authorization, document the circumstances. Keep copies of company policies on data collection and security.

Step 2: File an internal complaint or request for clarification. Contact your employer's HR department or compliance officer in writing (email is acceptable and creates a record). State clearly that you object to biometric data collection, request an explanation of what data is being collected and why, ask whether your consent is being sought, and request information about data security and retention. Keep a copy of your written request and any response. Some employers will clarify their practices or cease collection if you object. This step is not legally required but creates evidence of your concern and may lead to a voluntary resolution.

Step 3: Determine which legal avenue applies. If the employer is using your biometric data for a background check without authorization, you have a potential Fair Credit Reporting Act (FCRA) claim under 15 U.S.C. § 1681. File a complaint with the Federal Trade Commission (FTC) at reportidentitytheft.ftc.gov or call 1-877-438-4338. The FTC can investigate FCRA violations and take enforcement action. If the employer breached biometric data and failed to notify you as required by C.R.S. § 6-1-704, file a complaint with the Colorado Attorney General's Consumer Protection Section at attorney.general.state.co.us or call 720-508-6000. If the data collection is particularly invasive (e.g., secret facial recognition scanning), consult a private attorney about a common law privacy tort claim.

Step 4: Understand the investigation timeline. FTC investigations of FCRA violations may take several months. The Colorado Attorney General typically responds to breach notification complaints within 30-60 days. If you file a privacy tort claim in court, discovery and litigation can take 1-2 years. During an FTC or AG investigation, the agency will contact the employer, request records of data collection, security practices, and notification protocols, and determine whether violations occurred. You will typically be contacted for a statement if you filed the complaint.

Step 5: Consult an attorney if the violation is significant. If your biometric data was used against you (denied a job, promotion, or loan), or if a substantial data breach occurred affecting many individuals, hire an employment law attorney or privacy law attorney licensed in Colorado. An FCRA violation can result in statutory damages of $100-$1,000 per person, and failure to notify of a breach can result in damages for identity theft, credit monitoring, and emotional distress. Colorado allows class actions for data breaches, so if many employees were affected, a class action may be available. Initial consultations are often free or low-cost.