Biometric Data Collection at Work in Massachusetts: Your Rights

Federal law does not comprehensively regulate biometric data collection by private employers. The Americans with Disabilities Act (42 U.S.C. § 12101 et seq.) addresses accessibility concerns for employees with disabilities but does not prohibit biometric collection. The Fair Credit Reporting Act (15 U.S.C. § 1681 et seq.) may apply if biometric data is used for background checks or consumer reports, requiring specific disclosures and consent.

The Equal Employment Opportunity Commission (EEOC) has issued guidance that biometric screening tools used in hiring must not discriminate based on protected characteristics under Title VII of the Civil Rights Act of 1964 (42 U.S.C. § 2000e et seq.). However, this only addresses discrimination, not consent or disclosure requirements.

Some industries have sector-specific regulations: financial institutions under the Gramm-Leach-Bliley Act (15 U.S.C. § 6801 et seq.) and healthcare providers under HIPAA (45 C.F.R. Parts 160 and 164) must protect biometric data as sensitive personal information. Federally, there is no universal private-sector biometric privacy law comparable to those in states like Massachusetts, Illinois, or Washington. Enforcement of federal protections falls to the EEOC, FTC, and industry-specific regulators.

Massachusetts has enacted one of the nation's strictest biometric privacy laws, significantly exceeding federal protections. Massachusetts General Laws Chapter 149, Sections 150-152 establish comprehensive requirements for biometric data collection in the employment context.

Under Section 150, no employer in Massachusetts may collect, capture, purchase, or retain biometric information from an employee or job applicant without first obtaining the individual's written informed consent. The statute defines biometric information expansively to include fingerprints, palm prints, iris or retina scans, facial recognition geometry, voiceprints, keystroke dynamics, gait recognition, and any other biometric identifier that can uniquely identify an individual. This definition is broader than many state laws and captures emerging biometric technologies.

Massachusetts law applies to all employers regardless of size, with no threshold exemptions. This means even small employers with a single employee must comply. Section 151 requires employers to provide written disclosure before or at the time of collection, explaining: (1) what specific biometric information will be collected; (2) the purpose for collection and use; (3) how long the biometric data will be retained; (4) how the data will be stored and protected; (5) whether the data will be shared with third parties; and (6) the employee's right to access, inspect, and request deletion of the biometric data.

Crucially, Massachusetts law prohibits employers from using biometric data for purposes beyond those disclosed in writing. If an employer collects fingerprints for background check verification, that employer cannot later use facial recognition data for time-and-attendance tracking without obtaining a new, separate written consent.

Section 152 establishes enforcement mechanisms. Employees or job applicants have a private right of action and may sue for violations. The Massachusetts Attorney General also has enforcement authority. Civil penalties reach $5,000 per employee per violation, meaning a single violation affecting 100 employees could result in $500,000 in liability. Courts may also award injunctive relief, actual damages, and attorney fees.

Massachusetts law is significantly stronger than federal law, which contains no comparable private-sector consent requirement. Unlike the federal approach that focuses on discrimination, Massachusetts establishes affirmative consent, disclosure, and data protection duties. The law does not require a specific employee count threshold to trigger obligations, making it applicable even to very small employers.

Massachusetts biometric privacy law contains limited exceptions that employers should understand. First, biometric information collected for lawful background check purposes by a third-party screening company acting as a service provider may be exempt from certain disclosure requirements if the third party complies with the statute and the employer discloses that a third party is conducting the background check.

Second, the law may not apply to biometric information collected by an employer for compliance with federal, state, or local law, such as fingerprinting required by law enforcement agencies or regulatory bodies. However, even in these circumstances, the employer should obtain written consent where practical and must still disclose the use.

Third, an employer's collection of biometric data from customers or clients in the ordinary course of business (e.g., a bank collecting fingerprints from depositors for loan verification) may not constitute employee biometric data collection subject to the statute, though this distinction can be fact-specific if an employee is simultaneously subject to the same collection.

Fourth, some argue that voluntary participation in voluntary wellness programs or voluntary background checks might create an exception, but Massachusetts courts have not definitively carved out a "voluntary" exception. Employers should not rely on voluntary participation to avoid the written consent requirement—the law is clear that written informed consent is mandatory before collection regardless of whether participation is otherwise voluntary.

Fifth, biometric data collected before the effective date of the statute (January 1, 2009 for Sections 150-151, and later amendments) may be grandfathered in under a narrow interpretation, but employers should assume all current collection practices are governed by the statute.

Unions or collective bargaining agreements may modify some requirements through negotiation, but such agreements cannot waive the employee's fundamental right to written informed consent before collection. At-will employment status does not create an exception; employers cannot make biometric data collection a condition of employment without written consent.

Follow these steps if you believe your employer has unlawfully collected your biometric data in violation of Massachusetts law:

**Step 1: Document and Preserve Evidence.** Collect and retain all communications related to your employer's biometric data collection, including emails, consent forms, policies, or written disclosures. Take screenshots of any systems or devices used for biometric collection (time clocks, access scanners, or hiring platforms). Note the specific date, time, and context of each collection instance. Keep records of any verbal requests to provide biometric data, including the name of the person who requested it and any statements about how the data would be used. Retain copies of your employment agreement, employee handbook, and any training materials related to biometric systems.

**Step 2: Request Written Disclosure and Initiate Internal Complaint.** Before filing an external complaint, send a written request (email or certified letter) to your employer's Human Resources or management requesting: (1) a copy of any written informed consent you allegedly signed; (2) a written explanation of what biometric data was collected and when; (3) a copy of the required written disclosure explaining the purpose, storage, retention, and use of your biometric data; and (4) clarification of whether your consent was actually obtained. This request creates a paper trail and gives your employer an opportunity to cure the violation, which can strengthen your legal position later. State clearly that you are requesting compliance with Massachusetts General Laws Chapter 149, Section 150. Keep a copy of your request.

**Step 3: File a Complaint with the Massachusetts Attorney General or Pursue Private Action.** If your employer fails to provide the disclosure or if the disclosure reveals a violation, you have two concurrent options: (A) File a complaint with the Massachusetts Attorney General's Office, Consumer Protection Division. Submit your complaint online at www.mass.gov/files/documents/2017/01/consumer-protection-complaint-form.pdf or mail it to 1 Ashburton Place, Boston, MA 02108. Include copies of your documentation from Steps 1 and 2, a clear explanation of what biometric data was collected without written informed consent, the dates of collection, and the names of any witnesses. The AG's office will investigate at no cost to you. (B) Consult with an employment attorney licensed in Massachusetts to pursue a private civil action directly in court, as Massachusetts General Laws Chapter 149, Section 150 grants employees a private right of action. You do not need to exhaust the AG complaint process before suing.

**Step 4: Understand the Investigation and Legal Process.** If you file with the Massachusetts Attorney General, expect an investigation timeline of 3-6 months, though complex cases may take longer. The AG's office will contact your employer for a response and may request additional documentation from you. If a violation is substantiated, the AG may negotiate a settlement, issue a demand for restitution, or refer the matter for civil or criminal prosecution. If you file a private lawsuit, your case will proceed through civil court, which involves discovery (exchange of evidence), possible settlement negotiation, and potentially trial. Your attorney will handle the discovery process and filing of motions.

**Step 5: Consult an Employment Attorney.** Hire an employment law attorney in Massachusetts who specializes in employee rights or privacy law. This is especially important if: your biometric data was collected without any consent or disclosure whatsoever; your employer threatens retaliation for complaining; multiple employees are affected, which may support a class action; or your damages are significant (e.g., you suffered identity theft or discrimination as a result of the biometric collection). Attorneys can advise whether your case is strong enough to pursue, negotiate with your employer, file suit, or represent you before the AG. Many employment attorneys in Massachusetts work on contingency for biometric violations, meaning you pay no upfront fee.