Biometric Data Collection at Work in Michigan: Your Rights

Federal law does not comprehensively regulate private-sector biometric data collection. The Americans with Disabilities Act (42 U.S.C. § 12101 et seq.) addresses disability-related information but does not directly regulate biometric collection. The Fair Credit Reporting Act (15 U.S.C. § 1681 et seq.) applies when employers use third-party consumer reporting agencies that may collect biometric data for background checks, requiring accuracy and dispute procedures.

The Equal Employment Opportunity Commission (EEOC) enforces Title VII of the Civil Rights Act of 1964 (42 U.S.C. § 2000e) and considers discriminatory use of biometric data an unlawful employment practice if it results in disparate impact or treatment based on race, color, religion, sex, or national origin. However, no federal statute broadly prohibits employers from collecting biometric data with consent.

The Federal Trade Commission (FTC) enforces the Health Breach Notification Rule (45 C.F.R. parts 160 and 164) for health-related biometric data in limited contexts. State laws, particularly Illinois's Biometric Information Privacy Act (740 ILCS 14/1 et seq.), have become the primary source of private-sector biometric regulation. Michigan follows this trend with its own specific statutory protections.

Michigan Compiled Law section 445.1204 establishes strict requirements for employer collection of biometric data, creating stronger protections than federal law. The statute defines biometric data as information based on measurements or technical analysis of the physical characteristics used to authenticate or identify an individual, including fingerprints, voiceprints, eye or iris patterns, facial geometry, and similar data.

Under Michigan law, an employer must obtain written, informed consent from an employee or applicant before collecting, storing, or using biometric information for any purpose. Employers must separately inform the individual of the specific purpose for which the biometric data will be collected and how it will be used, stored, and protected. The consent must be in writing and specific to the stated purpose; blanket or general consent language is insufficient.

Michigan's law applies to all employers with employees in the state, regardless of size or industry. Unlike federal law, which focuses on discrimination, Michigan's statute directly restricts the collection and use mechanism itself. Employers cannot refuse employment based solely on an individual's refusal to provide biometric data unless the data is genuinely necessary for employment (a narrow exception).

Michigan law also requires employers to implement reasonable safeguards to protect stored biometric information and establishes that employees retain rights to their biometric data. Employers must disclose any sharing of biometric data with third parties and obtain separate consent if the purpose changes. The statute creates a private right of action, distinguishing it from federal enforcement mechanisms that rely on government agencies.

Michigan law provides narrow exceptions. An employer may collect biometric data without written consent if the data is necessary for a legitimate business purpose and the collection method is reasonable. However, courts interpret this narrowly, and the burden falls on the employer to demonstrate necessity.

Law enforcement exceptions exist: employers may be compelled to provide biometric data through valid court orders, subpoenas, or lawful criminal investigation warrants. Government employers may have different requirements under federal law, particularly for positions requiring federal security clearances or background investigations.

The statute does not apply to collection of biometric data in limited contexts: (1) data collected for lawful law enforcement purposes under proper legal process, (2) data collected for security or identity verification by a financial institution regulated by federal banking law, and (3) data collected for purposes of verifying an individual's identity as required by law or government agency.

Employers are not liable for unauthorized collection by employees acting outside the scope of their authority or by third parties without the employer's knowledge, though employers who fail to implement reasonable safeguards may still face liability. Contractors and temporary staffing agencies are subject to the same requirements when placing workers in Michigan.

At-will employment doctrine does not override biometric consent requirements; employees cannot be deemed to have consented to biometric collection simply by accepting employment. Collective bargaining agreements do not override the statute, though union representation may strengthen negotiating positions on biometric policies.

Step 1: Document the biometric collection request or activity. Keep records of when your employer asked for biometric data (fingerprints, facial scan, iris scan, voiceprint), in what format, and for what stated purpose. Preserve any consent forms your employer provided or requested you to sign, or document if no consent form was given. Save emails, policies, or notices related to biometric collection. Take screenshots if the request occurred digitally. Note the date, time, and witnesses present when the collection occurred or was requested.

Step 2: Understand your internal complaint process and consider raising the issue internally first. Review your employee handbook for a biometric data or privacy complaint procedure. If one exists, file a written complaint with your HR department or compliance officer, clearly stating that no valid written consent was obtained before biometric collection or that the purpose of collection was not clearly disclosed. Request a written response within 14 days. Keep copies of all internal communications. This step creates documentation of the violation and may prompt corrective action, though it is not legally required before filing an external complaint.

Step 3: File a complaint with the Michigan Department of Attorney General or directly pursue a civil action. Michigan Compiled Law section 445.1205 establishes a private right of action, meaning you can file a lawsuit in circuit court without exhausting administrative remedies. You do not need to file with a government agency first. Contact the Michigan Department of Attorney General's Consumer Protection Division at 517-335-7660 or visit michigan.gov/ag to file a consumer complaint, though this is informational rather than a prerequisite for a lawsuit. To file a civil lawsuit, contact a Michigan employment attorney to prepare a complaint alleging violation of MCL 445.1204. The suit must be filed in the Michigan circuit court in the county where you work or where the violation occurred. Provide your attorney with documentation of the biometric collection request and any consent forms or lack thereof.

Step 4: Understand the investigation and litigation process. If you file with the Attorney General's office, staff will investigate your complaint and may initiate enforcement action against the employer, though this does not substitute for private litigation. In civil court, the employer will have 21 days to respond to your complaint. Discovery follows, during which both sides exchange documents and take depositions. The employer may argue that consent was obtained, that collection was necessary for a legitimate business purpose, or that the collection was reasonable. The burden is on the employer to prove these defenses; you must prove that collection occurred without valid written consent. Litigation typically takes 6-18 months to resolution, though settlement may occur earlier.

Step 5: Consult an employment attorney experienced in Michigan privacy law. Contact a Michigan-licensed attorney who specializes in employment law or privacy violations. Many offer free initial consultations. An attorney can evaluate whether your case meets the elements of an MCL 445.1204 violation, calculate potential damages (statutory damages of $100-$1,000 per violation, plus attorney fees and costs), and negotiate settlement or prepare for litigation. Organizations such as the Michigan Employment Lawyers Association (melabar.org) can provide referrals. Act quickly; although Michigan does not have a specific statute of limitations for biometric violations, general tort and contract claims in Michigan typically have a 6-year window.