Biometric Data Collection at Work in Texas: Your Rights

Federal law does not provide comprehensive biometric privacy protection across all employers. However, several federal statutes restrict biometric data collection and use. The Americans with Disabilities Act (42 U.S.C. § 12112) prohibits employers from collecting genetic information, medical information, or protected health information through biometric means without a legitimate business reason related to the job. The Fair Credit Reporting Act (15 U.S.C. § 1681) applies when biometric data is used for employment decisions through third parties; employers must comply with disclosure, consent, and adverse action notice requirements.

The Gramm-Leach-Bliley Act (15 U.S.C. § 6801) applies to financial institutions and requires safeguards for sensitive personal information, including biometric identifiers. The Health Insurance Portability and Accountability Act (HIPAA) restricts healthcare employers from using biometric data for genetic information purposes. The Federal Trade Commission enforces standards requiring biometric data collection to be reasonable, proportional, and secure. Enforcement occurs through the EEOC (for discrimination claims), the FTC (for unfair or deceptive practices), and the Department of Labor (for specific regulated industries). Employees can bring private lawsuits under some federal statutes for violations, though remedies vary by statute.

Texas does not have a dedicated biometric privacy statute comparable to the Illinois Biometric Information Privacy Act (740 ILCS 14/1) or the California Consumer Privacy Act (CCPA). This creates a significant gap in state-level protection for Texas employees. However, Texas law does restrict biometric collection in specific contexts and requires data security compliance.

Under Texas Labor Code § 52.006, employers are prohibited from requiring employees to submit to polygraph tests (a form of biometric collection) except in limited circumstances. This statute reflects early Texas policy against involuntary biometric screening. Additionally, Texas Business & Commerce Code § 521.053 requires any person or business, including employers, that collects personal information to implement and maintain reasonable security measures. Biometric identifiers—defined as fingerprints, voiceprints, iris recognition, or other unique biological or behavioral characteristics—are explicitly mentioned as personal information triggering breach notification duties.

Texas law does not explicitly require written consent before employers collect biometric data, unlike Illinois's Biometric Information Privacy Act, which mandates written notice and affirmative consent. However, employers are bound by federal privacy laws, particularly the ADA's restrictions on genetic and medical information collection. Texas employers must also comply with the Fair Credit Reporting Act when using third parties to collect biometric data for employment decisions; this requires pre-collection disclosure and consent. Breach notification is mandatory within 30 days, and employers must inform affected employees of the scope of the breach, the types of information affected, and recommended protective steps. Failure to notify breaches can result in civil liability and regulatory enforcement by the Texas Attorney General.

Texas law does not provide a blanket exception for employers to collect biometric data without restriction, but several important limitations and defenses apply. The Texas Labor Code § 52.006 exception to polygraph prohibition includes limited situations: employers may require testing in narrow contexts such as investigations into economic loss, where the employee had access to the item or information involved, and the employer has reasonable suspicion. This reflects the state's historical resistance to biometric screening.

Federal ADA defenses apply in Texas: employers may collect biometric data if it is job-related and consistent with business necessity. Routine security clearance biometrics for building access or time-clock fingerprints may qualify if applied uniformly. However, this defense is not unlimited; employers cannot use biometric data as a proxy for disability screening or genetic information gathering.

The Fair Credit Reporting Act creates an exception for employers using third-party biometric vendors, provided the employer complies with pre-collection disclosure and dispute procedures. If biometric data is collected by a third party on behalf of the employer, the employer is entitled to rely on the vendor's representations that they obtained proper consent, though the employer remains liable for violations.

Industry-specific exemptions exist for federally regulated employers in financial services (GLBA) and healthcare (HIPAA), where biometric collection is more tightly controlled. At-will employment status does not create an exception to biometric data security laws; even at-will employees retain privacy and data security rights. Union-represented employees may have additional protections through collective bargaining agreements that impose consent requirements beyond state law.

Step 1: Document the biometric data collection and use. Keep records of: (1) what biometric data was collected (fingerprints, iris scan, voice recognition, facial recognition), (2) when it was collected and by whom, (3) how it was stored and who had access, (4) whether the employer provided notice of collection, (5) any written consent forms or policies, and (6) the stated business purpose. Photograph or screenshot screens showing how the data is stored, accessed, or shared. Retain copies of employee handbooks, privacy policies, or consent documents provided (or not provided). Save emails or communications from HR about the collection purpose.

Step 2: Request an internal review and file a formal written complaint. Send a written complaint to your employer's Human Resources or Compliance department documenting: (1) the date(s) biometric data was collected, (2) your lack of prior written notice or consent (if applicable), (3) how the collection violated company policy or your understanding, and (4) any concerns about data security or unauthorized access. Request a written response within 14 days. If there has been a breach, ask the employer to confirm whether your biometric data was affected and demand written proof of notification compliance. Do not agree to informal resolution yet; preserve all written responses.

Step 3: Determine which agency to file with based on the violation type. If the issue is a data breach or security failure, file a complaint with the Texas Attorney General's Consumer Protection Division (website: texasattorneygeneral.gov; phone: 1-800-621-0508). If the employer violated ADA protections by collecting genetic or medical information through biometrics, file an EEOC charge within 180 days (federal filing deadline in Texas, which is a non-deferral state). Visit www.eeoc.gov, call 1-800-669-4000, or file in-person at the EEOC Houston District Office. If a third-party vendor collected the data and the employer failed to comply with Fair Credit Reporting Act requirements (pre-collection disclosure, dispute procedures), file a complaint with the Federal Trade Commission at reportidentitytheft.ftc.gov or call 1-877-438-4338.

Step 4: Understand the investigation process and timeline. For Texas Attorney General breach complaints, investigators will contact the employer to request documentation of their security practices, breach notification timeline, and data retention policies. This investigation typically takes 60–90 days. The AG may negotiate a settlement or refer the matter to civil enforcement. EEOC investigations take 6–18 months; investigators will interview you and the employer, request documents about collection practices, and determine whether a violation of the ADA or other federal law occurred. FTC investigations of FCRA violations are conducted by the agency's attorneys; resolution may result in civil settlement or referral to the Department of Justice. Do not expect a quick resolution; federal investigations move slowly but are thorough.

Step 5: Consult an employment attorney immediately if: (1) the employer has not responded to your internal complaint within 30 days, (2) you discover your biometric data was shared with third parties without consent, (3) a breach occurred and the employer did not notify you within 30 days, (4) the employer retaliated against you for raising biometric privacy concerns, or (5) you want to pursue a private lawsuit for damages. Contact an attorney licensed in Texas who specializes in employment law and privacy disputes. Many employment attorneys offer free initial consultations. If you cannot afford one, contact the State Bar of Texas Lawyer Referral Service (1-800-252-9690) or the Texas RioGrande Legal Aid office (1-888-529-5277) for low-cost representation. An attorney can help you evaluate whether you have claims under federal law (ADA, FCRA) or state law (breach notification statute), estimate potential damages, and negotiate a settlement.