Biometric Data Collection at Work in Tennessee: Your Rights

The Fair Credit Reporting Act (FCRA), 15 U.S.C. § 1681 et seq., is the primary federal law governing biometric data use in employment contexts. The FCRA applies when an employer uses a third-party service provider (consumer reporting agency) to conduct background checks that include biometric screening or analysis. Under the FCRA, employers must provide clear and conspicuous disclosure that a consumer report will be obtained and must obtain the employee or applicant's written authorization before requesting such a report. The law does not prohibit biometric collection itself but requires transparency and authorization when a consumer reporting agency handles the data.

The Federal Trade Commission (FTC) enforces the FCRA and has issued guidance clarifying that biometric identifiers fall within the definition of consumer reports when used to screen job applicants or employees. Employers covered by Title I of the Americans with Disabilities Act (ADA), 42 U.S.C. § 12101 et seq., must also ensure biometric collection practices do not discriminate against employees with disabilities; for example, collecting facial recognition data could raise ADA concerns if it disadvantages deaf or blind employees.

No federal statute comprehensively regulates biometric data collection by private employers outside the background check context. This means employers in states without biometric privacy laws—including Tennessee—face minimal federal restrictions on collecting fingerprints, facial scans, voice prints, iris scans, or DNA samples for payroll, security, or workplace management purposes, provided they do not use consumer reporting agencies and do not violate ADA or Title VII of the Civil Rights Act of 1964.

Tennessee does not have a dedicated biometric privacy law comparable to Illinois's Biometric Information Privacy Act (740 ILCS 14/1) or California's Consumer Privacy Act (Cal. Civ. Code § 1798.100 et seq.). Tennessee Code Annotated § 47-18-2107 addresses general privacy and data protection but does not specifically regulate or restrict biometric data collection by employers.

Because Tennessee lacks state-level biometric protection, employers operating in Tennessee have broad discretion to collect biometric data without obtaining explicit consent, providing notice, establishing data retention limits, or implementing security safeguards beyond what common law and general privacy principles require. An employer may collect fingerprints for background checks, use facial recognition for time and attendance tracking, record voice patterns for authentication, or scan iris data for building access without violating any Tennessee statute.

However, Tennessee employers operating multi-state or international operations must comply with biometric laws in other jurisdictions. If a Tennessee employer collects biometric data from California residents or employees, the California Consumer Privacy Act (Cal. Civ. Code § 1798.100) applies, requiring opt-in consent for biometric data use and mandatory notice of collection. Similarly, if the employer processes data of European Union residents, the General Data Protection Regulation (GDPR) requires lawful basis, explicit consent, and extensive data subject rights, including the right to deletion.

Under Tennessee's common law and statutory privacy framework, employers retain a duty not to use biometric data in ways that violate other employment laws. For example, using facial recognition in a manner that discriminates based on race, disability, or other protected class violates Title VII of the Civil Rights Act of 1964, 42 U.S.C. § 2000e, as applied in Tennessee, even though Tennessee itself does not restrict the collection. Employers should document the business purpose for biometric collection and implement reasonable safeguards to prevent misuse or unauthorized access.

Tennessee law provides no explicit exceptions or carve-outs for biometric data collection in employment. However, several important exceptions and defenses arise from broader Tennessee and federal law.

First, the Americans with Disabilities Act (ADA), 42 U.S.C. § 12101 et seq., prohibits disability-based discrimination. If biometric collection methods—such as facial recognition systems—disproportionately exclude employees with disabilities without a legitimate business justification, the ADA applies even in Tennessee. For example, facial recognition systems with higher error rates for people with certain facial features or conditions violate the ADA if they are not adequately validated.

Second, Title VII of the Civil Rights Act of 1964, 42 U.S.C. § 2000e, prohibits racial and gender discrimination. If biometric screening tools (e.g., facial recognition) have documented disparate impact by race or gender—that is, they reject disproportionately more minority or female applicants—the employer must demonstrate job-relatedness and business necessity. Many facial recognition systems have been shown to have higher error rates for women and people of color; Tennessee employers using such systems face federal Title VII liability.

Third, if an employer uses a consumer reporting agency to conduct biometric-based background checks, the Fair Credit Reporting Act (FCRA), 15 U.S.C. § 1681, requires clear written authorization. Failure to obtain authorization before requesting a biometric background check report is an FCRA violation, enforceable by the FTC and by private right of action in federal court.

Fourth, Tennessee's common law tort of invasion of privacy may protect employees against egregious biometric collection practices—for example, recording an employee's voice or video in a private space without consent—though this tort is narrowly construed and difficult to prove in an employment context. Public policy arguments that an employee has a reasonable expectation of privacy in biometric data have had limited success in Tennessee courts.

Fifth, union employees covered by a collective bargaining agreement may have contractual protections restricting biometric data collection. The agreement's terms override state law, and the employer cannot unilaterally collect biometric data that conflicts with the contract without union consent.

Sixth, Tennessee employers cannot use biometric data collection as a pretext for other discrimination. If the stated purpose is payroll time-tracking but the actual intent is to identify and discriminate against an employee based on protected class status, the discrimination claim survives even though biometric collection itself is legal.

Step 1: Document the Employer's Biometric Collection Practice. Gather all written policies, software agreements, employee notices, and authorization forms related to biometric data collection. Take screenshots or printouts of any biometric systems in use (facial recognition time clocks, fingerprint scanners, voice authentication tools). Retain any communications from your employer about the system's purpose, how data is used, and how long it is retained. If your employer offered no notice before starting biometric collection, document the date biometric collection began and what method (fingerprint, facial scan, voice print, iris scan, or other) was used. If the employer required you to provide biometric data without explaining why or how it would be used, note the exact circumstances and any resistance you expressed.

Step 2: Understand the Internal Complaint Process and Consider Its Value. Review your employer's employee handbook, privacy policy, or data handling guidelines to identify any internal complaint procedure for data privacy or biometric concerns. Some larger Tennessee employers maintain privacy officers or compliance departments. Submitting a written complaint internally—addressing it to HR, the compliance officer, or management—creates a contemporaneous record and gives your employer an opportunity to correct the violation before litigation. In practice, many biometric collection complaints are not resolved internally because Tennessee has no state law protecting employees, so the employer may refuse to address the concern. However, if the biometric collection violates the ADA or Title VII (because the system has disparate impact or discriminates based on disability), internal complaint first may establish an administrative record for a future federal claim.

Step 3: File with the Appropriate Federal Agency if Biometric Use Violates Federal Law. If you believe the employer's biometric collection discriminates based on race, color, religion, sex, or national origin, file a Charge of Discrimination with the U.S. Equal Employment Opportunity Commission (EEOC). You have 180 days from the discriminatory act to file (extended to 300 days in some circumstances). The EEOC website is www.eeoc.gov; use the "File a Charge of Discrimination" tool or locate your regional EEOC office and file by mail or in person. You must include the employer's name, your name and contact information, the basis of discrimination (e.g., "The facial recognition system rejects me at a disproportionate rate compared to white employees"), and the date(s) of the alleged violation. If you believe the ADA is violated (e.g., the biometric system excludes you based on disability), file a Charge of Disability Discrimination with the EEOC using the same process.

If the biometric background check was conducted through a consumer reporting agency and you were not provided required written notice and authorization, file a complaint with the Federal Trade Commission (FTC) at www.reportfraud.ftc.gov. The FTC enforces the Fair Credit Reporting Act and does not have a strict filing deadline; complaints should be filed as soon as practicable after discovering the violation. You should also file a dispute with the consumer reporting agency directly, requesting they verify the accuracy of the biometric-based background check data within 30 days, as required by the FCRA.

Step 4: Understand the Investigation Process and Timeline. If you file an EEOC Charge, the EEOC will conduct an intake interview by phone or mail, confirming details of your claim. You will receive a Charge number. The EEOC investigates by requesting documents from your employer, conducting interviews, and reviewing evidence. EEOC investigations typically take 60 to 180 days, though complex cases involving technical biometric evidence may take longer. You will receive periodic updates from your EEOC investigator. The EEOC may attempt conciliation (settlement negotiation) before issuing a determination. If the EEOC finds reasonable cause to believe discrimination occurred, it will issue a Right to Sue letter authorizing you to file a lawsuit in federal court. If the EEOC finds no reasonable cause, it will also issue a Right to Sue letter, but you may still pursue a lawsuit at your own expense.

For FTC complaints regarding FCRA violations, the FTC does not conduct individual case investigations but aggregates complaints to identify systemic violations. However, you retain a private right of action under the FCRA to sue the employer or consumer reporting agency directly in federal court without waiting for FTC action.

Step 5: Consult an Attorney and Determine the Type of Claim. If your employer's biometric collection appears to violate the ADA, Title VII, or the FCRA, or if you have documented evidence that biometric collection is being used as a pretext for discrimination, consult an employment attorney licensed in Tennessee with federal civil rights experience. Many employment attorneys offer free initial consultations and work on contingency (taking a percentage of any settlement or judgment) if the claim is strong. An attorney can evaluate whether your claim is viable, estimate potential damages, and represent you before the EEOC, in settlement negotiations, or in federal court. If the case involves a facial recognition system with documented racial or gender bias, an attorney may retain an expert to analyze the system's error rates and demonstrate disparate impact. For FCRA violations, the damages are statutory: up to $100 to $1,000 per violation, plus attorney's fees, so even a single unauthorized biometric background check report may support a claim worth pursuing.