Biometric Data Collection at Work in Georgia: Your Rights

Federal law does not comprehensively regulate employer collection of biometric data. The primary federal framework is the Gramm-Leach-Bliley Act (GLBA), 15 U.S.C. § 6801, which requires financial institutions to safeguard nonpublic personal information, including biometrics. The Fair Credit Reporting Act (FCRA), 15 U.S.C. § 1681 et seq., applies when employers use biometric data as part of background checks; employers must obtain written consent and provide disclosures before using consumer reports that include biometric analysis.

The Health Insurance Portability and Accountability Act (HIPAA), 45 U.S.C. § 1301 et seq., protects biometric health data in healthcare settings. The Americans with Disabilities Act (ADA), 42 U.S.C. § 12101 et seq., prohibits using biometric collection to discriminate against employees with disabilities, though it does not prohibit collection itself. The Equal Employment Opportunity Commission (EEOC) enforces ADA biometric protections, while the Federal Trade Commission (FTC) enforces FCRA and data security standards under Section 5 of the FTC Act, 15 U.S.C. § 45.

Federal courts have not established a constitutional right to biometric privacy, though some states have enacted their own biometric privacy laws. Employers in non-biometric-privacy states like Georgia face fewer restrictions at the federal level, provided they comply with FCRA disclosure requirements and maintain reasonable data security.

Georgia does not have a dedicated biometric privacy statute comparable to the Illinois Biometric Information Privacy Act (BIPA) or California Consumer Privacy Act (CCPA). This means Georgia employers enjoy broad discretion to collect, store, and use employee biometric data without explicit statutory consent requirements specific to biometrics.

However, Georgia law does impose obligations on employers handling any sensitive employee data. The Georgia Data Breach Notification Law (O.C.G.A. § 10-1-670 et seq.) requires employers to notify employees if a breach of security compromises "personal information," which includes biometric identifiers. Notification must occur "without unreasonable delay," generally interpreted as within 30 days. This law applies to all employers operating in Georgia, regardless of size, and creates a private right of action if an employer fails to notify.

Under the Georgia Payment of Wages Law (O.C.G.A. § 34-6-2), employers must maintain accurate employee records, which could include biometric time and attendance systems. Employers using biometric timekeeping must ensure accuracy and must comply with wage payment requirements. Georgia also recognizes common law privacy torts, including intrusion upon seclusion under Georgia common law, though this provides limited protection because employers generally have legitimate business reasons for biometric collection.

Georgia employers are not required to provide notice or obtain written consent before collecting biometric data, unlike states with biometric privacy laws. However, employers must comply with the FCRA if biometric data influences hiring decisions, and they must adhere to general data security standards. The absence of Georgia-specific biometric privacy law means remedies are limited to federal FCRA violations, data breach notification failures, or common law tort claims—a significantly weaker framework than exists in California, Illinois, or Texas.

Georgia law contains no biometric-specific exceptions to employer collection rights. However, several general exceptions and defenses apply:

Lawful Business Purpose: Employers may collect biometric data for legitimate business reasons, including time and attendance tracking, physical security access control, payroll administration, identity verification, and fraud prevention. Courts are unlikely to impose liability if the collection serves a demonstrable business need.

FCRA Exemption for Non-Employment Reports: If biometric data is collected for purposes other than hiring, promotion, or firing decisions (e.g., facility access), the FCRA consent requirement may not apply. Employers using biometrics solely for physical security are not subject to FCRA disclosure requirements.

ADA Intersection: While the ADA does not prevent biometric collection, employers cannot use biometric data to discriminate based on disability. For example, using facial recognition to identify employees with visible disabilities and excluding them from certain roles violates the ADA, but the collection itself is not prohibited.

Consent Defense: Although Georgia does not require advance biometric consent, employers who obtain employee consent are protected from intrusion upon seclusion claims under Georgia common law. This is a practical, not statutory, defense.

Data Security Harbor: Georgia does not provide a safe harbor for data breaches, but employers that implement reasonable security measures may have stronger defenses in breach notification litigation and are less likely to trigger notification obligations if the data was reasonably protected.

Union Exceptions: If employees are unionized, the collective bargaining agreement may restrict biometric collection or require notice and negotiation. This is a contractual exception, not a statutory one.

Step 1: Document Everything. If you believe your employer unlawfully collected or misused your biometric data, document the dates, types of biometric data collected (fingerprints, facial scan, iris scan, voice), how it was collected, who had access, and any written policies or consent forms provided. Retain emails, handbooks, consent agreements, and any evidence of data breach or misuse. Keep records of when you first learned biometric data was collected and how you discovered it. This documentation is essential for proving the employer's conduct and for any future legal action.

Step 2: Review Employer Policy and Raise Internal Concerns. Check your employee handbook, onboarding documents, and any signed agreements for biometric data language. If your employer has a compliance or human resources department, submit a written complaint requesting information about what biometric data is being collected, how it is stored, how long it is retained, who has access, and whether consent was required. Request a copy of the company's data security policy. In Georgia, there is no legal requirement for employers to respond, but internal documentation of your complaint is useful for establishing awareness and intent if litigation becomes necessary.

Step 3: Determine Which Agency to File With. If biometric data was collected as part of a background check for hiring or promotion, file a complaint with the Federal Trade Commission (FTC) for FCRA violations at reportidentitytheft.ftc.gov or by calling 1-877-IDTHEFT (1-877-438-4338). If a data breach occurred involving biometric information, file a complaint with the Georgia Attorney General's Consumer Protection Division at oag.state.ga.us or call (404) 656-3300. If the employer is a federal contractor, file with the Office of Federal Contract Compliance Programs (OFCCP) at www.dol.gov/agencies/ofccp if ADA or other discrimination is involved. There is no state-specific biometric privacy agency in Georgia; federal remedies are your primary avenue.

Step 4: Understand the Investigation Process. The FTC investigates FCRA complaints by contacting the employer and requesting documentation of consent, disclosures, and data handling procedures. The investigation typically takes 30-60 days. The Georgia Attorney General's office investigates data breach notification failures by determining whether the employer provided timely notice and whether reasonable security was in place; this process may take 60-90 days. If the investigation finds a violation, the FTC can pursue enforcement, but no private right of action exists for FCRA violations. The Georgia Data Breach Notification Law creates a private right of action if notice was not provided; injured employees may sue for damages in state court.

Step 5: Consult an Attorney. Because Georgia has no dedicated biometric privacy statute, consult a lawyer specializing in data privacy or employment law to evaluate your specific situation. An attorney can assess whether a federal FCRA violation occurred, whether a state data breach notification violation applies, whether the HIPAA or ADA provides protection, or whether a common law intrusion upon seclusion claim is viable. Expect to provide the attorney with copies of all consent forms, company policies, breach notification letters (if any), and documentation of the type and use of biometric data collected. If you have been discriminated against based on biometric data, consult an employment discrimination attorney who can evaluate ADA or Title VII claims.