Biometric Data Collection at Work in New Jersey: Your Rights

Federal law does not comprehensively regulate private-sector biometric data collection. The biometric privacy landscape is governed primarily by state laws, not federal statutes. However, some limited federal protections exist under the Americans with Disabilities Act (ADA), which may restrict collection of biometric data that reveals disability status, and the Fair Credit Reporting Act (FCRA), 15 U.S.C. § 1681 et seq., which applies to biometric information collected by third-party consumer reporting agencies for employment purposes.

The Equal Employment Opportunity Commission (EEOC) has issued guidance indicating that biometric collection may implicate Title VII of the Civil Rights Act of 1964, 42 U.S.C. § 2000e, if the collection disproportionately impacts a protected class or if biometric systems are used in a discriminatory manner. The National Institute of Standards and Technology (NIST) has published standards on biometric accuracy and demographic disparities, but these are voluntary guidance rather than enforceable law.

Federal law does not establish a private right of action for biometric privacy violations in the private employment sector at the national level. The Federal Trade Commission (FTC) has authority under the FTC Act to challenge unfair or deceptive practices related to biometric data handling, but FTC enforcement is reactive rather than predictive. For most private employers, state laws like New Jersey's are the primary source of biometric privacy obligations.

New Jersey's Biometric Information Privacy Act (BJPIA), codified at N.J.S.A. § 56:8-163 et seq., is significantly stronger than any federal private-sector baseline because it creates a comprehensive, proactive statutory scheme with a direct private right of action.

Under N.J.S.A. § 56:8-164, biometric identifiers are defined to include fingerprints, facial geometry, iris or retina scans, voice patterns recorded for identification purposes, handwriting samples, and any other unique physical or behavioral characteristic used to identify an individual. This definition is deliberately expansive and extends to employers collecting biometric data for time-and-attendance systems, access control, identity verification, or performance monitoring.

N.J.S.A. § 56:8-165 requires employers to comply with four core obligations: (1) obtain a written informed consent from the employee prior to any collection, (2) provide a clear, conspicuous notice disclosing the collection, use, storage, retention, security, and destruction protocols, (3) store biometric data securely and in a manner that is not publicly available, and (4) delete or destroy biometric data within three years of the date of collection or within three years of the employee's termination of employment, whichever occurs first.

Critically, N.J.S.A. § 56:8-165 also prohibits the use of biometric data for any purpose other than the specific purpose disclosed in the written notice. Employers cannot repurpose or secondary-use biometric data without obtaining a separate, new written consent. This is a major departure from federal law, which has no comparable limitation.

N.J.S.A. § 56:8-168 creates a private right of action available to any employee or job applicant. There is no requirement to file with a state agency first. Employees can sue directly in civil court for violations of the BJPIA. Remedies include statutory damages of $1,000 to $5,000 per violation, plus actual damages if greater, injunctive relief, and attorney fees and costs. A single collection without consent, or a single instance of improper retention or unauthorized use, constitutes one violation; systematic collection violations can accumulate damages rapidly.

N.J.S.A. § 56:8-167 establishes limited exceptions: biometric data collected by law enforcement for criminal investigation, biometric data used in compliance with federal law (such as background check vendors), and certain limited uses by financial institutions and insurance companies under narrow circumstances. However, these exceptions do not apply to routine employment biometric collection for timekeeping or access control.

New Jersey's law applies to any private employer operating in the state, regardless of size or revenue. There is no threshold exemption based on number of employees, unlike some federal statutes. Non-profit organizations and government employers may have limited exemptions under N.J.S.A. § 56:8-166, but private for-profit employers have no size exemption.

Written consent required before any biometric collection—no threshold exemption based on employer size.

Biometric data must be deleted within 3 years of collection or within 3 years of employee termination, whichever is sooner.

Statutory damages: $1,000 to $5,000 per violation; actual damages if greater, plus attorney fees and costs.

No filing deadline with state agency required; private right of action allows direct lawsuit in civil court.

Statute of limitations: 2 years from discovery of violation to file a civil action (standard New Jersey contract/tort statute of limitations).

Written notice of biometric collection must be provided before collection occurs—contemporaneous notice is not permitted.

N.J.S.A. § 56:8-166 establishes several exceptions, though they are narrow and do not cover routine employment biometric collection:

**Law Enforcement Exception**: Biometric data collected by law enforcement agencies in connection with criminal investigation or prosecution is exempt. However, this exception applies only to governmental law enforcement, not to private employer security or background check vendors.

**Federal Law Compliance**: Biometric data collected in compliance with a federal law, regulation, or court order may be exempt if the federal requirement explicitly mandates biometric collection and the employer is following that mandate. For example, if a federal contractor is required by federal security clearance regulations to collect fingerprints, that collection may fall outside the BJPIA's scope. However, the exception is strictly construed; mere federal authorization is insufficient; the federal law must affirmatively require collection.

**Financial Institution and Insurance Exception**: Certain limited uses by financial institutions and insurance companies are permitted under narrow circumstances tied to fraud prevention and regulatory compliance, but this exception does not apply to ordinary employers in non-financial sectors.

**Union/Collective Bargaining**: The statute does not explicitly carve out a union exception. However, if a union contract includes biometric data collection provisions and the employer has bargained with the union, the employer must still comply with the BJPIA's written consent requirement. The union cannot waive individual employee consent rights under New Jersey law.

**At-Will Employment**: The BJPIA does not affect at-will employment status. An employer cannot require biometric data collection as a condition of employment and then fire an employee for refusing to consent. However, the employer could technically condition employment on biometric data collection if the employee agrees in writing. Practically, refusal to consent followed by termination may expose the employer to retaliation claims.

**Business Records Exception**: The BJPIA does not exempt biometric data that is incidentally collected as part of a video surveillance system, if the system is designed to capture facial geometry for identification purposes. However, if a video surveillance system is deployed solely for security and does not extract or store facial biometric data for individual identification, it may not trigger the BJPIA's requirements, depending on how the system is configured and used.

**Third-Party Collection**: Employers who hire third-party background check vendors or security firms to collect biometric data remain liable under the BJPIA. The use of a vendor does not exempt the employer from obtaining written consent or providing notice. The employer remains a "collector" under the statute.

**Step 1: Document the Biometric Collection and Retention**

Immediately begin documenting evidence of biometric data collection. Preserve any written consent forms (or lack thereof) provided by your employer. Take screenshots of any system prompts, authentication screens, or policies mentioning fingerprint scanning, facial recognition, iris scanning, voice authentication, or hand geometry scanning. Document the date collection occurred, the stated purpose, and whether you were provided a written notice before collection. Keep records of any communications regarding the biometric system—emails, memos, policy handbooks, or employee notices. If possible, take photos of the biometric collection device with date and time stamps. Maintain a timeline of when you first became aware the system was being used. Save any internal policies describing how your biometric data will be stored, used, and deleted.

**Step 2: Submit a Written Internal Complaint and Request Clarification**

Send a formal email or letter to your Human Resources department requesting clarification on the biometric data collection. Ask in writing: (1) What biometric data is being collected? (2) When was your written consent obtained? (3) For what specific purpose is the data being used? (4) How is the data being stored and secured? (5) When will the data be deleted? (6) Has your biometric data been used for any purpose other than the stated purpose? Request a detailed written response within 10 business days. Keep a copy of your request. This step creates a clear record that you raised the issue internally and gives the employer an opportunity to cure the violation. If the employer cannot produce a written consent form or cannot articulate compliance with N.J.S.A. § 56:8-165, this strengthens your legal position. Do not assume informal verbal consent is sufficient; New Jersey law requires written informed consent.

**Step 3: File a Complaint with the New Jersey Attorney General or Consult an Attorney About a Private Lawsuit**

Unlike federal employment law, the BJPIA does not require you to file with a state agency before pursuing a private civil action. You have two options: (1) File a complaint with the New Jersey Attorney General's Consumer Protection Bureau at (201) 504-6200 or online at nj.gov/oag. Provide documentation of the biometric collection, your request for consent that was not provided, and any responsive communications from HR. The Attorney General's office can investigate patterns of violations across multiple employees. (2) Consult an employment attorney licensed in New Jersey who has experience with privacy violations. An attorney can evaluate your individual damages, file a civil lawsuit in New Jersey Superior Court (or in federal court if there is diversity jurisdiction and the damages exceed $75,000), and seek statutory damages of $1,000–$5,000 per violation, actual damages, injunctive relief, and attorney fees. Provide your attorney with all documentation from Step 1. Many New Jersey employment attorneys offer free initial consultations. There is no filing fee required by the state before pursuing a private claim; only court filing fees apply if you sue.

**Step 4: Understand the Investigation and Litigation Process**

If you file a complaint with the Attorney General, investigation typically takes 30–90 days. The Attorney General will contact the employer for a response. If the investigation finds probable cause of a pattern violation affecting multiple employees, the Attorney General may initiate enforcement. If you file a private civil lawsuit, the timeline is significantly longer. Discovery (exchange of documents and depositions) typically takes 6–12 months. The employer will be required to produce all biometric data collection policies, consent forms (or evidence of their absence), system documentation, and retention/deletion protocols. Your employer will be deposed and may attempt to argue that biometric data was collected for a legitimate business purpose (e.g., time-and-attendance) or that informal consent was given. The employer may also argue that the data was properly deleted within three years. However, if written consent was not obtained in advance, or if data was retained beyond three years, these are strong evidence of violation. Settlement discussions often occur 6–12 months into litigation. Most private biometric cases in New Jersey settle before trial, with settlements ranging from $5,000 to $100,000+ depending on the number of affected employees, the duration of the violation, and the egregious nature of the employer's conduct.

**Step 5: Consult an Employment Attorney and Determine Your Damages and Next Steps**

Contact a New Jersey employment law attorney who specializes in privacy violations, data protection, or workers' rights. Request a free consultation and bring all documentation from Step 1. The attorney will evaluate: (1) Whether written consent was genuinely obtained before collection, (2) Whether the employer provided a clear, conspicuous written notice of collection, use, and retention protocols, (3) Whether the biometric data was used only for the stated purpose or was repurposed, (4) Whether the data was retained beyond three years, (5) Whether the employer's actions harmed you beyond the statutory damages (e.g., data was breached, causing identity theft or other damages). Your attorney will advise on whether to file a private lawsuit, join a class action if one exists, or pursue settlement. Because statutory damages are $1,000–$5,000 per violation and attorney fees are recoverable, many employers are incentivized to settle. If you file a lawsuit and prevail, the court will award you statutory damages, actual damages if higher, injunctive relief (e.g., immediate deletion of your biometric data and cessation of collection), and the employer will pay your attorney fees and court costs. An attorney can also advise whether your case qualifies for class-action certification, which would increase pressure on the employer to settle.