Biometric Data Collection at Work in Maryland: Your Rights

Federal law does not comprehensively regulate biometric data collection by private employers. While the federal Gramm-Leach-Bliley Act (GLBA) and Health Insurance Portability and Accountability Act (HIPAA) protect financial and health information respectively, no federal statute specifically restricts employer collection of biometric identifiers such as fingerprints or facial recognition data. The Federal Trade Commission (FTC) has authority over unfair or deceptive practices under the FTC Act (15 U.S.C. § 45), but this provides only indirect and limited protection for biometric privacy in employment contexts.

The Equal Employment Opportunity Commission (EEOC) oversees discrimination claims under Title VII of the Civil Rights Act of 1964 (42 U.S.C. § 2000e), but does not specifically regulate biometric collection. Some federal rules address biometric data in specific contexts: the Fair Credit Reporting Act (FCRA) (15 U.S.C. § 1681 et seq.) regulates background checks that may include biometric information, and the Americans with Disabilities Act (ADA) (42 U.S.C. § 12101 et seq.) may restrict disability-related biometric collection. However, these statutes do not create a general prohibition on employer biometric collection.

The absence of federal regulation means states like Maryland have filled the gap with their own biometric privacy laws. Employees in Maryland receive protections that workers in most other states do not have.

Maryland Code Commercial Law §§ 14-3504, 14-3505, and 14-3506 establish comprehensive restrictions on biometric data collection that exceed federal protections. Section 14-3504 is the core prohibition: an employer may not collect, capture, purchase, receive, or otherwise obtain a biometric identifier of an employee or job applicant without first obtaining the individual's prior written consent. This written consent must be separate from other consents and cannot be bundled into a general employment agreement or privacy policy.

Maryland defines "biometric identifier" broadly to include fingerprints, facial recognition technology, iris or retina scans, voice patterns, hand geometry, vein patterns, gait recognition, or any other unique biological or physical characteristic that can be digitized or stored. This definition is significantly broader than many state laws and captures modern surveillance technologies like facial recognition systems used in time-clock systems or workplace monitoring.

Section 14-3505 requires employers to provide written notice before or at the time of collection. The notice must disclose: (1) the specific biometric identifiers to be collected; (2) the purpose for collection and use; (3) how the data will be stored and protected; (4) the specific duration for which data will be retained; and (5) the employer's policy for destroying or deleting the biometric data. This transparency requirement is more rigorous than federal baseline privacy law and applies to all employers, regardless of size.

Maryland's law applies to all employers operating in the state, without a minimum employee threshold. Unlike federal laws that often apply only to employers with 15 or more employees, Maryland's biometric restrictions bind small employers equally. Section 14-3506 creates a private right of action: employees and job applicants can sue employers directly for violations. Each violation carries civil penalties of up to $1,000, and violations are also subject to investigation and enforcement by the Maryland Attorney General. Class actions are permitted, creating significant aggregate liability risk for employers with multiple violations.

This approach is substantially stronger than federal law in three ways: (1) it creates an explicit prohibition with prior written consent requirement rather than relying on general privacy or discrimination frameworks; (2) it imposes affirmative disclosure obligations with specific content requirements; and (3) it establishes a private right of action with statutory damages, bypassing the need for employees to prove individual harm. Maryland provides no exceptions for routine background checks, immigration verification, or time-tracking systems—these all require explicit consent if they involve biometric data.

Maryland's biometric law contains narrow exceptions, though Maryland courts have not yet broadly construed them. The statute does not explicitly exempt background check companies or third-party collectors, meaning even vendors conducting biometric checks must comply if they are acting on behalf of an employer—the employer likely bears responsibility for vendor compliance.

Federal law creates a potential exception: employers required to collect fingerprints or biometric data under federal law (such as for federal background checks, drug enforcement, or security clearances) may argue necessity overrides Maryland's prohibition. However, Maryland courts have not definitively ruled on whether federal law preempts Maryland's protection. Employers subject to federal fingerprinting mandates should document this requirement and obtain written consent even if federal law technically requires the collection; consent mitigates liability.

The statute contains no exception for time and attendance systems, even though many employers use fingerprint or facial recognition clocks. These systems absolutely require written consent under Maryland law. Similarly, no exception exists for ergonomic or workplace safety monitoring that involves biometric collection. Background checks that include biometric identifiers (such as fingerprint-based criminal records checks) are not automatically exempt; employers must obtain written consent and provide required notice, even though third-party background check companies may be the collectors.

One potential ambiguity concerns biometric data collected incidentally through security cameras or video surveillance not designed specifically to capture biometric identifiers. Maryland law targets intentional collection of biometric identifiers for identification or verification purposes. A security camera installed for general safety that happens to record faces may present a gray area, though best practice is to treat any system capable of biometric extraction as requiring consent.

Employee handbooks and general privacy policies do not constitute valid written consent under Maryland law. Consent must be specific, separate, and clearly describe the biometric data being collected. Additionally, the law does not provide an exception based on employee agreement or union negotiation—even if employees consent, employers must still comply with the notice and retention requirements. Violations by smaller employers face the same penalties as large employers; size does not create an exemption.

Step 1 — Document and Preserve Evidence: If you believe your employer collected biometric data without consent, immediately document what happened. Record the date you discovered the biometric collection system, the specific type of biometric data collected (fingerprint scanner, facial recognition, iris scanner, voice pattern recognition, etc.), and whether you received written notice beforehand. Request and keep copies of any biometric-related policies, consent forms you were asked to sign, consent forms you were not asked to sign but the employer claims you gave consent for, time-clock systems or access control systems using biometric data, any written policies about biometric data retention and destruction, and emails or communications from HR or managers about biometric collection. Take screenshots of any biometric systems you encounter. If other employees are affected, try to identify how many coworkers were subject to the same collection—this information is important for class action potential and demonstrates pattern and practice.

Step 2 — Internal Complaint Process: Before filing an external complaint, submit a formal written complaint to your employer's Human Resources department or management. Send the complaint via email to create a documented record. State clearly: "I am complaining that the company collected my biometric data (specify type: fingerprints, facial recognition, etc.) on [date] without my prior written consent and without providing written notice of how the data will be used, stored, and retained as required by Maryland Code Commercial Law § 14-3504 and § 14-3505." Request a written response explaining the legal basis for collection and provide copies of any purported consent forms. Set a deadline of 10 business days for response. This creates evidence of your internal complaint and gives the employer a final opportunity to cure the violation. Some employers may offer retroactive consent or remediation, though Maryland law does not clearly require them to do so. Preserve all responses in writing.

Step 3 — File a Complaint with the Maryland Attorney General: Maryland Code Commercial Law § 14-3506 grants enforcement authority to the Attorney General's Office. File a complaint with the Maryland Attorney General, Consumer Protection Division. Provide your name, contact information, employer name and address, dates of the biometric collection, description of the specific biometric data collected, and copies of any written notices (or lack thereof) provided by the employer. Include your internal complaint email if applicable. The Attorney General's office can investigate and pursue civil enforcement against the employer, which may result in injunctive relief stopping the collection, civil penalties, and disgorgement of damages. There is no specific filing deadline; however, for statute of limitations purposes, file within three years of discovery of the violation. The Maryland Attorney General's Consumer Protection Division can be reached at 410-576-6550 or through the website https://mda.maryland.gov/Pages/index.aspx.

Step 4 — File a Private Civil Action: Under Maryland Code Commercial Law § 14-3506, you have a private right of action to sue your employer directly in Maryland state court. You do not need to exhaust administrative remedies first, though filing with the Attorney General does not preclude a private suit. File a complaint in the District Court of Maryland for your county or in the Circuit Court if damages exceed the District Court jurisdictional limit ($30,000). State your claims for violation of §§ 14-3504 and 14-3505. Demand statutory damages of up to $1,000 per violation. If multiple employees are affected, you can file a class action seeking to represent all similarly situated employees. The class action option is significant because it multiplies the statutory damages and creates economic pressure on employers to settle. Serve the lawsuit on the employer as required by Maryland Rules. Expect the discovery phase to last 6-12 months, during which the employer will produce documents about their biometric policies, consent procedures, and any prior complaints. Your attorney will conduct depositions of HR personnel and managers involved in the biometric collection decision.

Step 5 — Consult an Employment Attorney: Given the private right of action and statutory damages under Maryland law, consult an employment attorney licensed in Maryland before filing suit. Retain an attorney who specializes in privacy law or consumer protection litigation, as this area overlaps both. Your attorney can assess whether the biometric collection was truly without consent or whether the employer has a viable defense (such as federal law requirement). If multiple employees are affected, your attorney can evaluate the class action potential—this is where biometric cases generate the most leverage, as the total exposure grows substantially. Maryland allows prevailing parties to recover attorney's fees and costs in certain consumer protection cases, though the statute is not explicit on this point. Your attorney can also file the complaint with the Maryland Attorney General simultaneously and coordinate with that office's investigation. Many employment attorneys in Maryland work on contingency for privacy violations with clear statutory damages, meaning you pay nothing upfront. Look for firms with experience in data privacy litigation or Maryland consumer protection cases.