Biometric Data Collection at Work in North Carolina: Your Rights

The Biometric Information Privacy Act (BIPA), codified at 740 Ill. Comp. Stat. § 14/1 et seq., is the primary federal framework governing biometric data collection in the United States, including North Carolina. BIPA applies to any private employer that collects, uses, stores, or discloses biometric identifiers (fingerprints, iris scans, facial geometry, voice recognition, and other unique biological characteristics) for purposes of identification, payment, or any other purpose.

Under BIPA, covered employers must obtain written, informed consent before collecting biometric data; cannot disclose biometric data to third parties without consent; must establish a written retention schedule for deletion of biometric data; and must implement reasonable security measures to protect the data from unauthorized disclosure or theft. BIPA prohibits the purchase or sale of biometric data for profit.

BIPA covers all employers regardless of size. The law does not exempt small businesses or nonprofits. Employees and job applicants have a private right of action to sue employers for violations. Statutory damages range from $1,000 to $5,000 per violation, and employees may recover actual damages if greater. The EEOC does not directly enforce BIPA; instead, enforcement is through private litigation and state attorneys general.

North Carolina does not have its own comprehensive biometric data privacy statute. Therefore, employers in North Carolina are governed solely by the federal Biometric Information Privacy Act (BIPA) and general state law principles regarding data privacy and identity theft.

Because BIPA is a federal law with nationwide application, North Carolina employers are subject to the same written consent, data retention, and deletion requirements as employers in other states. However, North Carolina courts may apply state common law principles of privacy tort liability if an employer's collection or misuse of biometric data is unreasonable or violates an employee's reasonable expectation of privacy.

North Carolina General Statute § 14-458.1 addresses identity theft and fraud, which may provide a basis for liability if an employer uses or discloses biometric data unlawfully to facilitate identity theft. Additionally, North Carolina recognizes the tort of invasion of privacy, which could be asserted in cases where biometric data collection is conducted without consent or in a manner that violates a reasonable expectation of privacy.

Unlike California (California Consumer Privacy Act § 1798.100 et seq.) or Illinois (which enacted BIPA), North Carolina has not enacted a standalone biometric privacy law that creates additional rights beyond the federal BIPA framework. This means North Carolina employers have somewhat more latitude than employers in states with stricter biometric privacy regimes, provided they comply with BIPA's baseline requirements. However, employers should note that any contract, collective bargaining agreement, or company policy that restricts biometric data collection or requires additional consent creates binding obligations that supersede the minimum BIPA standard.

Remedies under North Carolina law are limited to BIPA private right of action (statutory and actual damages), common law privacy tort, and potential enforcement by the North Carolina Attorney General under consumer protection statutes.

BIPA contains several important exceptions where employers may collect biometric data with limited or no consent requirements. Law enforcement collection for criminal investigation, arrest, prosecution, or identification purposes is exempt from BIPA's consent and written policy requirements, though retained biometric data must still be handled securely.

Background check companies and third-party vendors conducting background checks under the Fair Credit Reporting Act (15 U.S.C. § 1681 et seq.) are exempt from BIPA requirements if they use biometric data solely to verify identity. Government benefits programs that use biometric identification for eligibility verification (such as unemployment insurance or SNAP) may operate under reduced BIPA restrictions, though some state-level oversight applies.

Healthcare providers collecting biometric data for legitimate medical purposes may have limited exemptions, though hospitals and clinics are generally required to obtain consent. Employees in positions requiring government security clearances or working at military installations may face different biometric collection standards due to federal security protocols.

North Carolina employers are NOT exempt from BIPA based on business size, industry, or nonprofit status. Common employer defenses include: (1) the employee provided valid written consent; (2) the employer promptly deleted the biometric data per the stated policy; (3) the biometric data was collected and used solely for the stated lawful purpose; and (4) the employer implemented reasonable security measures. However, the burden of proof is on the employer to demonstrate compliance.

Step 1: Document the biometric data collection practice. Keep records of when biometric data (fingerprints, facial scans, iris recognition, voice samples, hand geometry) was collected, what employee consent forms (if any) were used, what the stated purpose was (timekeeping, building access, payment authorization), how long data was retained, and whether it was deleted. Photograph or screenshot the employer's biometric collection device or portal. Retain any written policies regarding biometric data. Save copies of emails discussing the collection.

Step 2: Request internal remediation and documentation. File a written request with your employer's human resources or legal department asking: (1) why your biometric data was collected; (2) what written consent (if any) you provided; (3) how long the data will be retained; (4) who has access to the data; and (5) when it will be deleted. Request confirmation in writing. If the employer cannot provide evidence of written consent or a lawful purpose, document that refusal.

Step 3: File a complaint with the appropriate agency or attorney. Unlike EEOC complaints, BIPA violations are typically pursued through private litigation in federal court, not through an administrative agency. You may file suit directly in federal district court (e.g., U.S. District Court for the Eastern District of North Carolina or Middle District of North Carolina) without exhausting administrative remedies. You may also contact the North Carolina Attorney General's Consumer Protection Division (919-716-6000; www.ncdoj.gov) to report the violation, though criminal prosecution is rare. The deadline to file a federal civil action is 3 years from the date of the violation.

Step 4: Expect discovery and investigation. Once a BIPA lawsuit is filed, the employer will produce records regarding consent, data retention policies, security measures, and the scope of disclosure. You will likely be deposed (questioned under oath). The court may grant summary judgment if the facts clearly show consent was never obtained or if the employer admits violation. Many BIPA cases settle before trial because statutory damages create predictable liability.

Step 5: Consult an attorney experienced in privacy law or employment litigation. BIPA cases often involve complex issues regarding what constitutes 'biometric data,' what 'written consent' requires, and what constitutes a 'violation.' A civil rights attorney or privacy lawyer can evaluate whether the employer's conduct violated BIPA and estimate damages. Many attorneys work on contingency in BIPA cases because statutory damages are available.