Biometric Data Collection at Work in Missouri: Your Rights

Federal law does not comprehensively prohibit biometric data collection by private employers. However, several federal statutes create limited protections:

The Fair Credit Reporting Act (FCRA), 15 U.S.C. § 1681 et seq., applies when biometric information is collected by or on behalf of an employer and used to make employment decisions. Under FCRA, employers must disclose in writing that a biometric consumer report will be obtained and obtain the employee's written consent before collecting the data. The EEOC enforces FCRA in the employment context. If an employer violates FCRA requirements, employees may sue for actual damages, statutory damages up to $1,000 per violation, and attorney's fees.

Title VII of the Civil Rights Act of 1964, 42 U.S.C. § 2000e, prohibits discrimination based on race, color, religion, sex, or national origin. Facial recognition systems or other biometric tools that have a disparate impact on protected classes may violate Title VII. The EEOC investigates such claims. However, Title VII does not require consent before collection; it addresses discriminatory use.

For government employers, the Constitution (Fourth and Fifth Amendments) and 42 U.S.C. § 1983 provide protections against unreasonable searches and seizures of biometric data without consent or legal process. Private employers are not bound by constitutional restrictions unless they perform state action.

There is no federal private right of action for biometric privacy violations per se, except under FCRA, state biometric privacy laws, or common law tort theories (invasion of privacy, breach of contract).

Missouri has no comprehensive state statute regulating employer collection, use, retention, or disclosure of biometric data. Unlike Illinois (740 ILCS 14/1 et seq., the Biometric Information Privacy Act or BIPA), which imposes strict consent and notice requirements on all private entities collecting biometric data, Missouri does not prohibit or restrict biometric collection.

This means Missouri employers retain broad discretion to collect biometric information (fingerprints, facial recognition, iris scans, voice prints, hand geometry, etc.) without specific state-law consent requirements. However, Missouri law does impose general limits on employee record retention and access under Mo. Rev. Stat. § 407.153, which requires employers to maintain certain personnel records and grants employees rights to inspect records. Biometric data collected and retained for employment purposes may fall within this framework, meaning employees may have the right to request and inspect biometric records held by the employer.

Missouri does recognize common law privacy torts, including invasion of privacy, which could theoretically apply if an employer collects and uses biometric data in a manner that violates a reasonable expectation of privacy. However, this is a narrow and fact-specific claim. Additionally, Missouri does recognize contract law; an employment contract or handbook that promises privacy or limits biometric collection could be enforceable as a breach of contract claim.

Because Missouri has no state biometric privacy law, federal law (FCRA and Title VII) provides the primary legal framework. Missouri employers collecting biometric data for employment decisions must comply with federal FCRA consent and disclosure requirements. Employers using biometric tools (e.g., facial recognition for time and attendance) in a manner that disparately impacts protected classes may face EEOC investigation under Title VII.

Missouri's lack of comprehensive biometric privacy law creates broad exceptions and limited protections:

No Consent Exception: Unlike Illinois BIPA, Missouri employers do not need written consent before collecting biometric data from employees or applicants. Employers may collect fingerprints, facial scans, and other biometrics without explicit notice or permission, subject only to federal law requirements.

FCRA Exception: If biometric data is collected by a third-party vendor and used to make an employment decision (hiring, firing, promotion, discipline), FCRA consent and disclosure apply. However, if an employer collects biometric data in-house solely for access control, time and attendance, or facility security (not for consumer reporting purposes), FCRA may not apply. The distinction between biometric collection for administrative vs. decision-making purposes is critical.

Title VII Exception: Even if biometric data is collected with consent, use of the data in a manner that discriminates based on protected class (race, color, religion, sex, national origin) violates Title VII. Facial recognition systems that have higher error rates for people of color create legal exposure. However, if the biometric system is non-discriminatory and applied uniformly, no Title VII violation occurs.

Government Employer Exception: Public sector employers (government agencies) face constitutional restrictions under the Fourth Amendment (unreasonable search) and Fifth Amendment (due process). Collection of biometric data from public employees without a warrant, court order, or reasonable expectation of consent may violate constitutional rights enforceable under 42 U.S.C. § 1983.

Privacy and Contract Exception: Employers operating under union contracts or collective bargaining agreements may be restricted by those agreements. Additionally, an employer's written policy or handbook promising privacy or limiting biometric collection could create a contractual obligation, breach of which might support a claim for breach of implied contract of good faith and fair dealing.

Third-Party Liability: Employers who share or sell employee biometric data to third parties without consent or legal basis may face invasion of privacy claims or violations of emerging state laws in other jurisdictions where employees reside.

Step 1 — Document the Biometric Collection: Immediately document all instances of biometric data collection by your employer. Note the date, time, method (e.g., fingerprint scanner, facial recognition camera, iris scan), who required it, what purpose was stated, whether written consent was requested, and whether you were provided a copy of any consent form. Take screenshots of any systems, software, or hardware involved. Request a copy of any biometric data collected from you and the policies governing its use, retention, and deletion. Keep all communications with HR or management regarding the collection.

Step 2 — Internal Complaint Process: Review your employer's employee handbook or HR policies for a procedure to raise privacy or data security concerns. If such a procedure exists, file a written complaint with HR or the designated manager explaining your concerns about biometric collection: why you believe it is unlawful, invasive, or contrary to company policy. Request written confirmation of receipt. If your employer has a privacy officer or data protection officer, escalate the complaint there. Document the date, recipient, and substance of your complaint and any response. Internal complaints create a record and may trigger company investigation or policy changes.

Step 3 — File a Federal Complaint if FCRA Applies: If biometric data was collected by a third-party vendor or used to make an employment decision (hiring, firing, promotion, discipline) and you were not provided written notice and did not give written consent, file a complaint with the Federal Trade Commission (FTC) at reportidentitytheft.ftc.gov or call 1-877-438-4338. Alternatively, consult a private attorney to file a lawsuit under FCRA (15 U.S.C. § 1681 et seq.) in federal court within 2 years of discovering the violation. FCRA allows recovery of actual damages, statutory damages up to $1,000, and attorney's fees.

Step 4 — File an EEOC Charge if Discrimination Occurred: If you believe biometric data collection or use discriminated against you based on race, color, religion, sex, national origin, age (40+), disability, or veteran status, file a charge with the Equal Employment Opportunity Commission (EEOC). Missouri is a deferral state, so contact the Missouri Commission on Human Rights (MOCHR) first. You may file online at www.eeoc.gov or by mail to the EEOC at 200 Federal Plaza, Suite 400, St. Louis, MO 63102. Phone: 1-800-669-4000. You must file within 300 days of the alleged discrimination (extended from 180 days due to state deferral). Provide detailed facts, dates, and names. The EEOC will investigate and may attempt conciliation or issue a right-to-sue letter allowing you to file a private lawsuit.

Step 5 — Consult an Employment Attorney: If your employer is collecting biometric data without consent, using it discriminatorily, or retaliating against you for objecting, consult an employment law attorney licensed in Missouri. An attorney can assess whether federal FCRA claims, Title VII discrimination claims, state common law tort claims (invasion of privacy, breach of contract), or retaliation claims apply. Attorneys can demand that your employer cease collection, delete collected data, and provide compensation. If necessary, they can file a civil lawsuit in Missouri state court or federal court seeking damages, injunctive relief, and attorney's fees.