Biometric Data Collection at Work in Florida: Your Rights

Federal law does not directly regulate private employer collection of biometric data. The Americans with Disabilities Act (ADA), 42 U.S.C. § 12101 et seq., may apply if biometric collection methods discriminate against employees with disabilities, but there is no comprehensive federal biometric privacy statute for private employers.

The Equal Employment Opportunity Commission (EEOC) enforces anti-discrimination laws that may be implicated if biometric data collection is used in a discriminatory manner. Federal law does require employers covered by the Driver's Privacy Protection Act and the Gramm-Leach-Bliley Act to protect certain personal information, but these do not specifically address employer-collected biometric data.

The Federal Trade Commission (FTC) has authority under the Health Breach Notification Rule (45 C.F.R. Parts 160 and 164) if biometric data is linked to health information, but this applies primarily to covered entities and business associates in the health care industry. Most private employers operating nationwide are not subject to a federal biometric privacy mandate, leaving regulation primarily to state law.

Florida Statutes section 501.171 is the primary state law governing biometric data collection by employers and other private entities. This law is significantly stronger than federal protections because it creates an affirmative legal requirement to obtain written consent before collecting biometric data.

Under Florida law, "biometric data" is defined as information derived from measurements or analysis of human physical and behavioral characteristics, including fingerprints, face geometry, iris or retina patterns, voice recordings, keystroke patterns, and gait. The statute applies to all employers doing business in Florida, regardless of size.

The key requirement is written consent. Employers must inform employees in writing what biometric data will be collected, how it will be used, how long it will be retained, and how it will be destroyed or deleted. Simply obtaining verbal consent or burying consent in an employment agreement is insufficient—the consent must be specific to biometric data collection and clearly communicable.

Florida law also mandates that employers securely store biometric data and delete or destroy it within three years, unless the employer is required by law to retain it for law enforcement purposes or other legal obligations. The statute prohibits employers from selling, leasing, trading, or otherwise profiting from an employee's biometric data without explicit additional consent.

Violations trigger liability under Florida's unfair and deceptive trade practices statute and general tort law. An employee or third party can recover $1,000 per violation, plus reasonable attorney fees and court costs. This makes Florida's regime substantially more employee-protective than the federal baseline of general discrimination law.

The primary exception to Florida's biometric consent requirement is collection required by law. If a federal, state, or local law specifically mandates biometric data collection (such as fingerprinting for a professional license or background check), an employer may collect that data without separate written consent from the employee, provided the employer complies with the statutory retention and security requirements.

Law enforcement exceptions also apply. If an employer is required by law enforcement to disclose or retain biometric data as part of a criminal investigation or legal proceeding, the three-year deletion requirement may not apply. Employers are required to notify employees of any law enforcement demands for their biometric data unless a court order prohibits notification.

Another important limitation is that the statute does not prohibit collection of data for certain legitimate employment purposes if consent is properly obtained. For example, an employer may collect biometric data for time and attendance tracking, access control to secure facilities, or identity verification if the employee provides written consent. The exemption is not for the purpose itself, but rather for the requirement to obtain consent.

The statute also does not prevent an employer from using biometric data that the employee volunteers or provides independently, such as a photograph on a driver's license that the employer reviews during the hiring process. However, active collection by the employer requires consent.

Continuing consent is required. An employer cannot assume one written consent covers all future uses of biometric data. If an employer intends to use biometric data for a new purpose (beyond the original stated purpose in the consent), a new written consent must be obtained.

Step 1: Document the Collection. Keep records of when and how your employer collected biometric data. This may include written requests for fingerprints, emails asking you to use facial recognition systems, sign-in sheets for iris scanning, or voice recording prompts. Save copies of any consent forms (or the absence of consent forms) that the employer provided or failed to provide. Take screenshots of any biometric collection systems you were required to use. Document the date, time, and specific biometric data collected. Note whether your employer explained how the data would be used, stored, or deleted.

Step 2: Internal Complaint Process. First, submit a written complaint to your employer's human resources department or compliance officer. Clearly state that biometric data was collected without proper written consent under Florida Statutes section 501.171. Request in writing that your biometric data be deleted and that the company cease further collection without explicit consent. Keep a copy of your complaint and any response. This creates a record of your objection and gives the employer an opportunity to cure the violation. Document the employer's response or failure to respond within 14 days.

Step 3: File a Complaint with the Florida Attorney General. The Florida Attorney General's Office, Division of Consumer Protection, enforces section 501.171. You can file a complaint online at myfloridalegal.com or call 1-800-435-7352. You will need to provide your name, contact information, the employer's name and address, a description of the biometric data collected, the date(s) of collection, and copies of any written consent forms (or documentation that none were provided). The complaint filing fee is typically waived for consumers. The Attorney General investigates complaints and may initiate enforcement action against the employer.

Step 4: Understand the Investigation Process. The Florida Attorney General's investigation typically takes 30–90 days, depending on case complexity and backlog. The investigator will contact your employer for their response to your complaint. The employer may claim consent was obtained or argue the collection was lawful. The investigator will review any consent forms, employment agreements, and system records. You may be asked to provide additional documentation or clarify the timeline. The investigator does not make a determination of guilt but rather forwards findings to the Attorney General's office, which decides whether to pursue enforcement.

Step 5: Consult an Attorney. If the Attorney General declines to pursue your complaint or you prefer to pursue a private claim, consult a Florida employment attorney or a consumer protection attorney. You have the right to file a private lawsuit under Florida Statutes section 501.171 or under the common law tort of invasion of privacy. An attorney can advise on whether to settle, file suit in civil court, or pursue alternative dispute resolution. Many attorneys work on contingency for biometric privacy claims because of the $1,000 statutory damages available. An attorney can also advise on whether your claim may implicate ADA or employment discrimination statutes if the biometric collection targeted a protected class.