Biometric Data Collection at Work in Indiana: Your Rights

Federal law contains no comprehensive private-sector biometric privacy statute. The Americans with Disabilities Act (ADA), 42 U.S.C. § 12101 et seq., prohibits employers from collecting medical information, including certain biometric data that reveals a disability, without job-related justification and business necessity. Title VII of the Civil Rights Act of 1964, 42 U.S.C. § 2000e, bars discrimination based on protected characteristics, but does not restrict the collection of biometric identifiers themselves.

The Fair Credit Reporting Act (FCRA), 15 U.S.C. § 1681, governs background checks and consumer reports but does not specifically address biometric data collection. ERISA, 29 U.S.C. § 1002, permits employers to collect biometric data in wellness programs under specified conditions. The Health Insurance Portability and Accountability Act (HIPAA) applies only to covered health plans and providers, not general employer biometric collection.

The Equal Employment Opportunity Commission (EEOC) enforces federal discrimination laws and may investigate biometric collection practices that correlate with protected class status. However, no federal agency has broad authority to regulate private employer biometric collection absent a specific violation of discrimination, privacy, or health law. Several states, notably Illinois under BIPA, have enacted strict biometric privacy laws, but Indiana is not among them.

Indiana has not enacted a state biometric privacy law equivalent to the Illinois Biometric Information Privacy Act (815 ILCS 530/1 et seq.) or other strict state-level biometric data protection statutes. Indiana Code Title 24 (Employment) contains no provision restricting, regulating, or requiring consent for biometric data collection by private employers.

Because Indiana lacks a dedicated biometric statute, employers operating in Indiana face fewer legal constraints on biometric collection than those in BIPA-compliant jurisdictions. An Indiana employer may collect fingerprints, facial recognition data, iris scans, voiceprints, or hand geometry without explicit written employee consent, provided the collection does not violate other state or federal employment laws.

However, Indiana employers must comply with the Indiana Consumer Data Protection Act (Ind. Code § 24-4.9-2), which requires reasonable security measures for personal information, including biometric data. If an employer collects biometric data and a data breach occurs, the employer may face liability under this statute if it failed to implement adequate safeguards. Additionally, Indiana employers subject to federal banking regulations (such as banks and credit unions) must follow federal standards for identity verification, which may restrict or mandate biometric collection methods.

Unlike Illinois employers under BIPA, Indiana employers do not face civil liability for failing to obtain written informed consent before collecting biometric data, nor do employees have a private right of action for biometric privacy violations. Indiana employers are not required to disclose collection practices, retention periods, or data-sharing arrangements. Nonetheless, any biometric data collected must be used only for lawful purposes and cannot be used to discriminate against protected classes or to violate other employment statutes, such as the ADA or Title VII.

Indiana employers are exempt from biometric privacy law as applied in states like Illinois, meaning no written consent requirement, no public disclosure obligation, and no per-incident statutory damages apply. However, several important exceptions and defenses exist:

ADA Exception: Employers may not collect biometric data that reveals disability status without job-related justification. Facial recognition that identifies a disability, or gait analysis that reveals a mobility impairment, is restricted under the ADA unless there is a genuine business necessity.

Title VII Exception: Biometric data collection cannot be used to screen out or discriminate against employees based on race, color, religion, sex, or national origin. For example, facial recognition systems trained on biased datasets that disproportionately fail to identify employees of certain racial backgrounds may constitute discrimination.

At-Will Employment: Indiana is an at-will employment state under Ind. Code § 22-5-1-1. An employer can terminate an employee for refusing to provide biometric data, absent a contractual agreement, union contract, or public policy exception. However, refusal based on religious or medical grounds may create liability if the employer fails to attempt reasonable accommodation.

Union and Collective Bargaining: Employers with unionized workforces may be required to bargain over biometric data collection practices, even though no statute mandates it. Failure to bargain may constitute an unfair labor practice under the National Labor Relations Act.

Banking and Financial Institution Exception: Employers in the banking sector must comply with federal identity verification standards (Know Your Customer rules under 31 U.S.C. § 5318(h)) and may be permitted or required to collect certain biometric data for fraud prevention. This exception is governed by federal banking regulators, not Indiana law.

Wellness Program Exception: If biometric data is collected as part of a wellness program, the employer must comply with federal HIPAA and ADA rules. HIPAA permits collection only if de-identified or with explicit consent; the ADA permits collection only if the program is voluntary and does not penalize non-participation.

Step 1 — Document the Collection Practice: Gather evidence of what biometric data your employer collected, when, and for what purpose. Request a copy of any consent form, job posting, employee handbook, or company policy that mentions biometric collection or explains the use of fingerprint scanners, facial recognition, timekeeping systems, or ID badge technology. Save screenshots or obtain written confirmation of the collection method and the stated purpose. Keep records of any communications from the employer regarding biometric data, retention, or use.

Step 2 — Attempt Internal Resolution: Report your concern to your direct supervisor, HR department, or employee ombudsman, if one exists. Provide a written complaint (email is acceptable) describing the biometric collection, your objection, and the basis for your concern (e.g., disability accommodation, religious conviction, or belief that the data is being used discriminatorily). Request written clarification of the employer's policy, including how the data is stored, who has access, and how long it is retained. Document the employer's response and any indication of retaliation. This step is not required by Indiana law but creates a record that may be valuable in litigation.

Step 3 — File a Charge with the EEOC (if Discrimination is Involved): If the biometric collection or the employer's refusal to accommodate your objection constitutes discrimination based on race, color, religion, sex, national origin, age (40+), disability, genetic information, or retaliation, file a charge with the U.S. Equal Employment Opportunity Commission (EEOC). The EEOC accepts charges from Indiana employees at the Indianapolis District Office (101 W. Ohio Street, Suite 1900, Indianapolis, IN 46204; telephone 317-226-7100; website eeoc.gov). You have 180 days from the date of discrimination to file a charge in Indiana (a non-deferral state). Provide detailed facts, dates, names of decision-makers, and any evidence of discriminatory intent. The EEOC will investigate at no cost and attempt to resolve the charge through conciliation.

Step 4 — Expect Investigation and Resolution: The EEOC investigation typically takes 60–180 days. An investigator will request information from the employer, interview relevant witnesses, and review policies and data. If the EEOC finds reasonable cause to believe discrimination occurred, it will attempt to resolve the charge through voluntary conciliation. If conciliation fails, the EEOC may file suit on your behalf (rare) or issue a right-to-sue letter, which permits you to file a private lawsuit in federal court. If the EEOC closes the charge without finding reasonable cause, you may still file a private lawsuit if you obtain a right-to-sue letter and file within 90 days of receiving it.

Step 5 — Consult an Employment Attorney: Contact an employment attorney licensed in Indiana if the employer retaliates, if the EEOC investigation stalls, or if you wish to pursue a private lawsuit for discrimination. An employment law attorney can advise whether the biometric collection violates the ADA (disability discrimination), Title VII (discrimination on a protected basis), or the Indiana Consumer Data Protection Act (if a data breach occurs). Attorneys may work on a contingency basis in discrimination cases, meaning no upfront fee is required. An attorney can also send a demand letter to the employer, negotiate a settlement, or file suit in federal court (Title VII, ADA claims) or state court (state contract or tort claims).