Biometric Data Collection at Work in Illinois: Your Rights

Federal law does not comprehensively regulate biometric data collection by private employers. The federal Americans with Disabilities Act (ADA), 42 U.S.C. § 12101 et seq., addresses accessibility for employees with disabilities but does not address biometric collection generally. The Fair Credit Reporting Act (FCRA), 15 U.S.C. § 1681 et seq., applies only to background check companies, not direct employer collection. Federal workplace privacy protections focus on other contexts, such as video surveillance in certain circumstances under the Electronic Communications Privacy Act, 18 U.S.C. § 2511, but do not establish a national biometric consent standard.

The Federal Trade Commission (FTC) has issued guidance on biometric data privacy under Section 5 of the FTC Act, 15 U.S.C. § 45, focusing on companies that collect and sell biometric data to third parties. However, the FTC's authority is limited and does not establish affirmative employer obligations. Employers in states without specific biometric laws may collect fingerprints, iris scans, and facial geometry with minimal legal restriction, provided they do not violate state-specific privacy laws or general discrimination statutes. No federal statute gives private employees a statutory right to sue employers for unauthorized biometric collection. The burden of regulation falls to states; Illinois is among the strictest jurisdictions nationally.

Illinois's Biometric Information Privacy Act (BIPA), 740 ILCS 14/1 et seq., is one of the most stringent biometric data protection laws in the United States and far exceeds federal protections. Illinois law applies to all employers collecting, storing, or using biometric data, regardless of employer size or employee count. There is no threshold employee count; a single employee's biometric data triggers BIPA compliance obligations.

Under 740 ILCS 14/15, employers must obtain written consent before collecting any biometric identifier, defined in 740 ILCS 14/10 to include fingerprints, iris scans, face geometry, voiceprints, hand geometry, keystroke dynamics, gait analysis, and any other measurable biological or behavioral characteristic. The law is substantially stronger than federal law because it establishes a private right of action with statutory damages. An employer cannot sidestep BIPA by relying on federal law; Illinois law provides independent protection.

Illinois law requires employers to: (1) inform employees in writing of the specific purpose for collecting biometric data, (2) explain how the data will be stored, used, retained, and ultimately destroyed, and (3) maintain reasonable security measures to protect biometric data from unauthorized disclosure. Employers must not disclose biometric data to third parties without explicit consent, except to comply with state or federal law, or to a third party that agrees to implement equivalent security standards and comply with retention and destruction rules.

Crucially, 740 ILCS 14/20 imposes strict data retention limits. Employers must destroy biometric data when: (1) the purpose for collection is satisfied, (2) the employment relationship ends (whichever is sooner), or (3) 3 years have elapsed since the employee's last interaction with the system. Failure to destroy triggers liability. Unlike many federal statutes, BIPA does not exempt employers of any size and does not provide a good-faith defense. Remedies under Illinois law are robust: employees can bring a private civil action for negligent violations ($1,000 per violation) or intentional violations ($5,000 per violation), recover actual damages, and recover attorney fees and costs. 740 ILCS 14/25 allows class actions. The Illinois Attorney General also has enforcement authority.

Illinois BIPA does permit biometric collection in narrow circumstances. First, an employer may collect biometric data if required by state or federal law (e.g., federal fingerprinting requirements for certain licenses). Second, biometric data may be disclosed to law enforcement or state/federal agencies in response to a valid legal demand without separate employee consent. Third, an employer does not violate BIPA if it collects a deceased employee's biometric data when required by law or for estate administration, provided the employer complies with security and retention rules.

However, no general business justification exempts an employer from BIPA. An employer cannot claim that collecting fingerprints for security access, time and attendance tracking, or performance monitoring is exempt—all such collection requires written consent. The law also does not provide a good-faith defense; an employer's belief that it had consent, or that it was following industry practice, does not protect against liability.

One frequently misunderstood exception involves law enforcement. If a third-party contractor (such as a background check company or security vendor) collects biometric data from an employee on behalf of the employer, the employer is liable under BIPA if the contractor violates the requirements. The employer must ensure the contractor complies with BIPA's written consent, notice, and retention rules. Retention of an independent contractor does not shield an employer from BIPA liability.

Additionally, BIPA does not preempt stricter interpretations or remedies under Illinois common law (e.g., invasion of privacy tort claims). An employee might pursue both a BIPA statutory claim and a tort claim, potentially multiplying damages. Courts have rejected arguments that BIPA claims are duplicative of state privacy torts; both remedies may apply simultaneously.

Step 1: Document the Collection.

If your employer collects biometric data, document the date, method, and frequency of collection. Take screenshots or retain copies of any consent forms you were asked to sign, noting whether the form specifically stated the purpose for collection and explained how data would be stored and destroyed. Photograph or describe any biometric systems you interact with (fingerprint scanners, facial recognition kiosks, iris readers, voiceprint systems). Retain emails or notices your employer issued about biometric collection. If you were not given written notice of the purpose before collection, document this omission. Note the specific biometric identifiers collected (fingerprints, face scan, iris, voiceprint, etc.).

Step 2: Submit an Internal Complaint.

Before filing externally, send a written complaint to your employer's human resources department and, if you know it, the data privacy officer or legal department. Document the violation clearly: state that you were not given written consent form before collection, or that the consent form failed to explain the purpose, retention period, or storage methods. Request a written response within 10 business days explaining the legal basis for collection and the employer's retention and destruction timeline. Keep a copy of your complaint and any response. This step is not legally required to file a BIPA claim, but it creates evidence and may resolve the issue. If the employer fails to respond or continues to collect biometric data without proper consent, proceed to Step 3.

Step 3: File a Complaint with the Illinois Attorney General or File a Private Lawsuit.

Unlike many employment statutes, BIPA does not require filing with a government agency before suing. You have two options:

Option A (Recommended First Step): File a complaint with the Illinois Attorney General's Public Protection Division at the address listed below or through its online complaint form at ag.illinois.gov. Include your name, the employer's name and address, specific dates biometric data was collected, which biometric identifiers were collected, and what notice or consent was (or was not) provided. The Attorney General's office will investigate and may pursue enforcement, which can pressure the employer to comply without you bearing legal costs.

Option B (Direct Private Lawsuit): Consult an employment attorney and file a private civil action in Illinois state court (typically in the county where you worked or the employer is located). You may file individually or join a class action. Your attorney will file a complaint alleging negligent or intentional violation of 740 ILCS 14/15 and 14/20. You are not required to exhaust internal remedies or file with the Attorney General first. You may seek statutory damages ($1,000 per negligent violation, $5,000 per intentional violation), actual damages (including emotional distress), injunctive relief (ordering destruction of biometric data), and attorney fees and costs. If the employer collected biometric data from dozens or hundreds of employees, your attorney may recommend a class action, which multiplies damages and increases settlement pressure.

Step 4: Understand the Investigation and Legal Process.

If you filed with the Attorney General, the investigation typically takes 2–6 months. The Attorney General may request records from your employer, including consent forms, retention schedules, and security protocols. You will likely be contacted to provide additional details. The Attorney General may issue a findings letter concluding whether a violation occurred, and if so, may negotiate a settlement, pursue civil penalties, or refer the case back to you for private litigation.

If you filed a private lawsuit, the case will move through discovery (typically 6–12 months), where your attorney will obtain the employer's consent forms, biometric collection logs, data retention policies, and security practices. Depositions may occur. If the employer's violation is clear (e.g., no written consent given, or data not destroyed on schedule), you may negotiate a settlement without trial. BIPA settlements typically include compensatory damages, injunctive relief requiring data destruction, and a covenant not to repeat the violation. If the case proceeds to trial, the judge or jury will award statutory and actual damages.

Step 5: Consult an Attorney Early.

Contact an employment attorney licensed in Illinois as soon as you discover the violation. Do not wait for retaliation; BIPA violations are often settled confidentially, and early consultation strengthens your position. Many Illinois employment attorneys take BIPA cases on a contingency basis (no upfront fee). At your consultation, bring the biometric consent form (if any), emails or notices about collection, and documentation of dates. An experienced BIPA attorney will assess whether the violation is negligent or intentional, estimate damages, and advise whether to file with the Attorney General or proceed directly to litigation. Attorney consultation is particularly valuable if your employer is a large organization; class action potential significantly increases settlement value.