Biometric Data Collection at Work in Minnesota: Your Rights

Federal law provides minimal protection for biometric data collection by employers. The Gramm-Leach-Bliley Act (15 U.S.C. § 6801) and the Health Insurance Portability and Accountability Act (HIPAA, 42 U.S.C. § 1320d) address financial and health information but not general biometric data in employment contexts. The Americans with Disabilities Act (ADA, 42 U.S.C. § 12101 et seq.) restricts medical examination and genetic information but does not specifically govern biometric collection for non-medical purposes.

The Federal Trade Commission (FTC) has authority under the FTC Act (15 U.S.C. § 45) to regulate unfair or deceptive practices related to biometric data but does not have a comprehensive biometric privacy standard for employment. Courts have recognized a common-law tort of invasion of privacy, but recovery is difficult and inconsistent. The result is that federal employment law leaves most biometric collection decisions to employers and state law. Employees injured by federal biometric violations have limited remedies and must prove harm.

Minnesota law is substantially stronger than federal law in protecting employee biometric privacy. Minnesota Statutes sections 181.9701–181.9703 create a comprehensive framework for biometric data that federal law lacks.

Section 181.9701 requires employers to obtain written consent before collecting, using, storing, or transferring any biometric identifier from an employee or job applicant. A biometric identifier is defined in section 181.9702 to mean a physical or digital record of biological, physiological, or behavioral characteristics (including fingerprints, iris scans, voiceprints, hand or palm geometry, keystroke patterns, gait recognition, facial geometry, DNA, retina scans, and any other unique biological or physiological characteristic). The written consent must be informed and specific to the use or purpose.

Section 181.9703 explicitly prohibits employers from selling, leasing, trading, or otherwise profiting from biometric data. Employers may not retain biometric data longer than necessary to complete the transaction or business purpose for which it was collected. Employees have a private right of action for violations and may recover statutory damages of up to $5,000 per violation per employee. Attorneys' fees and costs are recoverable. This private cause of action applies to all employers in Minnesota, regardless of size.

Minnesota law is employer-size neutral, meaning it applies equally to small businesses and large corporations. The law does not carve out exceptions for small employers. Unlike some state biometric laws that apply only to private employers, Minnesota's law applies to both public and private employers in the state. No federal law provides comparable remedies or specificity.

Minnesota law contains narrow exceptions to the written consent requirement. Employers may collect biometric data without written consent in the following situations: (1) the data is collected as part of a background check conducted by a third party, provided the employer has a written agreement with the third party requiring compliance with the statute; (2) the collection is required by state or federal law, regulation, or court order; (3) the collection is incidental to collection of other data not constituting a biometric identifier under the statute; (4) the collection is from a publicly available source unless the employer is using it to identify or track the individual employee.

Additionally, biometric data collected solely to detect fraud, security risk, or criminal activity may be excluded from the written consent requirement if the employer documents the specific fraud or security threat. However, this exception does not permit the employer to retain the data beyond the period necessary to address the fraud or security concern.

Employers are not prohibited from using biometric data for access control, time and attendance systems, or security authentication, provided written consent has been obtained and the employer does not sell or profit from the data. Handwritten signatures and commonly used passwords are not biometric identifiers under Minnesota law. Collective bargaining agreements may modify these requirements but cannot reduce employee protections below the statutory minimum.

Step 1 — Document the violation. Preserve all evidence of biometric data collection: (a) write down the date and time your employer collected biometric data; (b) note what type of biometric data was collected (fingerprints, facial scan, iris scan, voice, etc.); (c) preserve any forms or notices you received, or note if you received none; (d) document whether you were asked for written consent and whether you provided it; (e) take screenshots or photos of any biometric collection devices or systems your employer uses; (f) keep a record of any emails, messages, or verbal communications about the collection; (g) note the names and contact information of coworkers who experienced the same practice.

Step 2 — Attempt internal resolution if appropriate. Contact your employer's human resources or compliance department in writing (email or certified mail) and request an explanation of the biometric data collection, the purpose, and documentation of your written consent. Request a written response within 10 business days. Save all correspondence. Note that this step is not legally required but may help establish good faith and can strengthen a future claim if the employer fails to respond or refuses to comply.

Step 3 — File a civil complaint. Minnesota does not require administrative filing with a government agency before bringing a private lawsuit for biometric data violations. You may file directly in Minnesota state district court. Consult an employment attorney licensed in Minnesota to file a complaint in the appropriate district court (typically the district where you work or where the employer is located). The complaint should allege violations of Minnesota Statutes sections 181.9701–181.9703. Include: (a) your name and the employer's name and address; (b) the date(s) biometric data was collected; (c) the type of biometric data collected; (d) whether written consent was or was not obtained; (e) how the violation harmed you; (f) a demand for statutory damages of up to $5,000 per violation, plus attorneys' fees and costs.

Step 4 — Expect the civil litigation process. Once filed, the employer has 20–30 days to respond. Discovery (exchange of documents and information) typically lasts 4–6 months. The case may be settled at mediation or proceed to trial. Minnesota courts have not yet issued final published decisions on section 181.9703 claims, but the statute is clear and creates strict liability (the employer's intent or negligence is irrelevant; only the fact of collection without consent matters). Trial, if necessary, typically occurs 1–2 years after filing. Remedies are statutory damages up to $5,000 per violation per employee, plus actual damages if provable, plus attorneys' fees and costs.

Step 5 — Consult an employment attorney. Contact an employment law attorney in Minnesota at the earliest stage, especially if the employer collected biometric data from multiple employees (class action potential). A Minnesota employment attorney can evaluate whether your claim is strong, estimate potential recovery, advise on state-specific procedures, and determine whether class action treatment is possible under Minnesota Rule of Civil Procedure 23. No administrative filing is required before suit, but attorney guidance on pleading and proof is important. Many employment attorneys work on contingency (no upfront fee; paid from settlement or judgment).