Biometric Data Collection at Work in New York: Your Rights

Federal law does not comprehensively regulate private employer collection of biometric data. The primary federal statute is the Americans with Disabilities Act (42 U.S.C. § 2000e et seq.), which prohibits discrimination based on disability but does not restrict biometric data collection itself. The Genetic Information Nondiscrimination Act (GINA), 42 U.S.C. § 2000ff, restricts employer collection of genetic information but does not cover most biometric identifiers like fingerprints or facial recognition.

At the federal level, some limited protections exist under the FTC Act section 5 (15 U.S.C. § 45), which prohibits unfair or deceptive practices in commerce, and the Children's Online Privacy Protection Act (COPPA) applies to online collection of children's biometric data. However, there is no comprehensive federal law requiring employer consent before collecting employee biometric information. The Equal Employment Opportunity Commission (EEOC) may become involved if biometric data collection is used as a pretext for discrimination, but collection itself is not federally prohibited. This creates a patchwork of state-by-state regulation.

Employers in states without biometric privacy laws can generally collect fingerprints, facial scans, and other biometric identifiers without explicit consent, provided they do not use the data in a discriminatory manner. The lack of federal regulation has led states like Illinois, Texas, Washington, and New York to enact their own protective statutes.

New York enacted one of the nation's most restrictive biometric privacy laws through General Business Law section 530, which became effective on February 27, 2020. This law establishes that employers cannot collect, store, use, or disclose biometric identifiers without first obtaining the employee's written informed consent. The statute defines biometric identifiers broadly to include fingerprints, voiceprints, eye or iris recognition, facial recognition, facial geometry, hand geometry, gait, and any other biological measurement or scan used to identify a person.

New York's law is significantly stronger than the federal baseline because it imposes affirmative consent requirements rather than merely prohibiting discriminatory use. The statute applies to all employers in New York—regardless of employee count—making it one of the broadest state protections. Employers must provide written notice to employees that describes: (1) what biometric data will be collected; (2) the purpose of collection; (3) how long the data will be retained; (4) how the data will be stored and protected; and (5) the employer's data destruction policy. Crucially, employers cannot require employees to waive their rights under the statute as a condition of employment, meaning consent must be truly voluntary.

Under New York Labor Law section 740, employees are protected from retaliation for asserting their privacy rights under the biometric statute. An employer cannot discharge, demote, suspend, threaten, harass, or otherwise discriminate against an employee who refuses to provide biometric data or who complains about illegal biometric collection. This anti-retaliation provision is critical because it ensures employees cannot be coerced into providing consent through fear of job loss. Additionally, New York permits employees and their representatives to inspect and copy records related to their biometric data.

New York courts have interpreted section 530 expansively. Unlike some other state biometric laws (such as Illinois's BIPA), New York's statute does not contain broad employer exemptions for law enforcement purposes, though government employers may operate under different rules. Private employers in New York face civil liability for violations. Unlike the private right of action available in Illinois under the Biometric Information Privacy Act, New York's enforcement relies primarily on the New York Attorney General and individual plaintiffs bringing civil actions. Penalties can reach $5,000 per violation, and violations are considered unfair or deceptive practices under state consumer protection law.

New York General Business Law section 530 contains limited exceptions. First, employers may collect biometric data without consent if required by law or by an authorized regulatory agency order—such as fingerprinting for background checks mandated by federal law or law enforcement agencies. However, this exception is narrowly construed and does not permit employers to avoid the statute simply because an industry standard exists.

Second, the statute does not apply to publicly available information derived from public records or government data—though this exception is also narrowly read. If an employer pulls facial recognition data from public mugshots or driver's license records that are themselves public, this exception may apply, but courts have cautioned against using this to circumvent the consent requirement.

Third, employers in certain heavily regulated industries may face conflicting legal obligations. For example, financial institutions subject to federal Bank Secrecy Act (31 U.S.C. § 5318) rules on customer identification may argue that Know Your Customer (KYC) regulations require biometric collection without employee consent. However, KYC rules typically apply to customers, not employees, so this exception has limited application to employment relationships.

Fourth, there is an open question about whether very limited, non-identifying biometric collection (such as measuring hand geometry purely for ergonomic adaptation in machinery, with no storage or identification purpose) falls outside the statute's scope, though employers should not rely on this. Additionally, collective bargaining agreements negotiated between unions and employers may include different biometric policies, though an agreement cannot waive statutory protections below the floor set by section 530. Finally, contractors and vendors who collect biometric data on behalf of employers for specific purposes may have narrower obligations than employers themselves, though this remains unsettled. An employer's reasonable belief that they have consent does not excuse compliance; the consent must actually exist and be documented in writing.

Step 1: Document Everything Immediately If you believe your employer has collected or is attempting to collect your biometric data without consent, document all evidence. Keep copies of any job postings, employment applications, or on-site notices that reference fingerprinting, facial scans, iris recognition, voice recording, or other biometric collection. Save any emails, memos, or written policies describing biometric data practices. If you were asked to provide biometric data verbally or under pressure, write down the date, time, who asked you, and what was requested. Take screenshots of any biometric collection systems or kiosks at your workplace. Preserve any consent forms you were asked to sign (or any forms you refused to sign), and note whether the employer explained the retention and destruction policy in writing. Request a copy of the employer's biometric data policy in writing and keep records of that request and any response.

Step 2: Initiate an Internal Complaint Before filing externally, inform your employer in writing that you are asserting your rights under New York General Business Law section 530. Send a formal letter (via email or certified mail) to your HR department and direct supervisor stating: (1) that you have not provided written informed consent for biometric data collection; (2) that you are requesting written notice of the employer's biometric data practices, including retention and destruction policies; and (3) that you are requesting deletion of any biometric data already collected without your consent. Request a written response within 10 business days. This internal step is critical because it creates a documented record of your objection and allows the employer an opportunity to cure the violation. Do not attempt to physically interfere with biometric collection systems; instead, clearly refuse verbally and in writing.

Step 3: File with the New York Attorney General If the employer does not respond adequately or continues collecting biometric data without consent, file a complaint with the New York Attorney General's Consumer Frauds Bureau. Visit www.ag.ny.gov and navigate to the Consumer Complaints section. You can file online, by mail, or by phone at 1-800-771-7755. Provide detailed information including: your name, contact information, employment dates, employer name and address, specific dates and times biometric data was requested or collected, the names of individuals who made the requests, copies of any written policies or notices (or lack thereof), and documentation of your refusal and the employer's response. Include any evidence that the employer retaliated against you for refusing to provide biometric data (such as denial of promotion, schedule changes, or hostile treatment). The AG's office will assign your complaint a case number and conduct an investigation. You should receive written acknowledgment within 30 days.

Step 4: Understand the Investigation and Enforcement Process Once the Attorney General opens an investigation, they will contact the employer for a written response and may conduct interviews with company representatives. The investigation typically takes 60–180 days, though complex cases may take longer. The AG will review the employer's biometric data retention policy, consent procedures, and data destruction protocols. They may examine the biometric collection system itself to understand what data is being captured and how long it is stored. During this time, you should expect the AG's office to contact you for additional information or to schedule an interview. You have no obligation to participate in interviews if you believe it will jeopardize your employment, but cooperation strengthens the case. The AG may issue a subpoena for the employer's records, including biometric databases, consent forms, and any IT logs showing collection activities. If the AG finds a violation, they may issue a warning letter, seek voluntary compliance through a settlement agreement, or pursue civil penalties of up to $5,000 per violation. The Attorney General does not award monetary damages to employees directly; instead, any settlement money typically goes to a restitution fund or the state.

Step 5: Consult an Employment Attorney and Consider Private Action If the Attorney General's investigation does not resolve your concerns or if you have suffered damages (such as lost wages from retaliation), consult an employment law attorney licensed in New York. Unlike Illinois, which has a private right of action for biometric privacy violations, New York's statute does not explicitly provide a private cause of action, meaning you cannot sue your employer directly in civil court for biometric data collection alone. However, you may have related claims, including breach of contract (if your employee handbook promised privacy protections), invasion of privacy under common law, or retaliation claims under New York Labor Law section 740 if you were punished for refusing biometric collection.

An attorney can advise whether you have a viable retaliation claim, which is your strongest private legal option. If you were demoted, terminated, or disciplined after refusing biometric data collection or complaining about the practice, you have grounds for a Labor Law section 740 claim against your employer in state court or before the New York Division of Human Rights. Attorneys typically charge on a contingency basis (no upfront cost; they take a percentage of any settlement or judgment) for employment cases. Many offer free initial consultations. Search for employment lawyers through the New York State Bar Association's lawyer referral service at www.nysbar.org/findlegalhelp.