Biometric Data Collection at Work in Virginia: Your Rights

The Fair Credit Reporting Act (FCRA), 15 U.S.C. § 1681 et seq., is the primary federal law governing biometric data collection by employers. The FCRA applies to employers of all sizes that collect biometric information for employment decisions, background checks, or employee monitoring. The law requires employers to provide written notice to employees or job applicants before collecting biometric data, obtain written consent, and ensure the data is accurate and secure.

Under 15 U.S.C. § 1681e, employers must disclose what biometric information will be collected, how it will be used, who will have access to it, how long it will be retained, and the employee's rights regarding the data. The FCRA prohibits employers from obtaining biometric data through deception or misrepresentation. Violations can result in civil liability, including actual damages, statutory damages up to $1,000 per violation, and attorney's fees. The Federal Trade Commission (FTC) enforces the FCRA and can impose penalties on employers that violate the law.

Additionally, the Gramm-Leach-Bliley Act (GLBA), 15 U.S.C. § 6801, may apply if employers collect biometric data as part of financial services or maintain personal financial information. State laws, including Virginia's Consumer Protection Act, may provide additional protections beyond the federal baseline.

Virginia does not have a comprehensive state biometric privacy law equivalent to California's California Consumer Privacy Act (CCPA) or Illinois's Biometric Information Privacy Act (BIPA). This means Virginia employees rely entirely on federal law under the Fair Credit Reporting Act (FCRA), 15 U.S.C. § 1681 et seq., for biometric data protections.

However, Virginia's Consumer Protection Act (VCPA), Virginia Code § 59.1-500 et seq., provides a potential remedy if an employer engages in deceptive or unfair practices when collecting biometric data. The VCPA defines unfair or deceptive conduct broadly and can encompass collecting biometric information without proper consent, misrepresenting the purpose of collection, or failing to disclose how the data will be used. Unlike the FCRA, which has specific statutory damages of up to $1,000 per violation, the VCPA allows recovery of actual damages, reasonable attorney's fees, and court costs for violations.

Virginia employers are not required to obtain written consent for biometric collection under a separate state statute, but they must do so under the FCRA. Virginia has no state-mandated retention limits, deletion requirements, or destruction timelines for biometric data. Employers in Virginia can collect fingerprints, facial recognition data, iris scans, voice recognition, and other biometric identifiers if they comply with federal FCRA requirements. The state does not require employers to notify employees about data breaches involving biometric information beyond what federal law may require. Virginia also has no state law banning the use of specific biometric technologies in employment, such as facial recognition, unlike some other states.

Virginia law contains no explicit exceptions to biometric data protection because no dedicated state biometric privacy statute exists. However, the FCRA contains several exceptions that apply in Virginia: (1) Employers may collect biometric data without consent in very limited national security or law enforcement contexts, though this rarely applies in private employment. (2) The FCRA has a narrow exception for data collected before its amendments took effect, though this has limited modern application.

Under Virginia common law and the Consumer Protection Act, employers may argue that collection was reasonable if the employee provided informed consent and the purpose was disclosed. However, Virginia courts have not developed extensive case law on biometric data privacy, so the contours of defenses remain uncertain. The FCRA's "business record" exception does not eliminate the consent requirement for biometric data specifically.

Virginia's at-will employment doctrine does not provide employers an exception to biometric consent requirements. Even at-will employees retain privacy and statutory rights under the FCRA. Union employees in Virginia may have additional protections negotiated in collective bargaining agreements that exceed statutory minimums. Federal employees in Virginia are subject to separate federal privacy laws, not the FCRA alone.

Employers may face challenges defending collection if they claim the data was necessary for security or time-tracking without demonstrating that less invasive methods were unavailable. Virginia has not recognized a blanket "employer need" exception that overrides consent requirements.

Step 1: Document the biometric collection. Keep written communications from your employer about biometric collection, including emails, policies, consent forms, and notices. Document what biometric data was collected (fingerprints, facial scan, iris scan, voice, etc.), when it was collected, and for what stated purpose. Take screenshots of any system or device that collects the data. Record the dates, names of people who collected the data, and any representations made about how it would be used or stored. Save copies of any consent forms you were asked to sign or any disclosure documents provided. Create a timeline of events.

Step 2: Exhaust internal complaint procedures if available. Review your employee handbook or HR policies to see if there is a procedure for raising privacy concerns or complaints. Submit a written complaint to your HR department explaining that biometric data was collected without proper written consent under the FCRA or was collected through deceptive means under the Virginia Consumer Protection Act. Keep a copy of any response. Request in writing that the biometric data be deleted or destroyed and ask for confirmation. Even if your employer is unlikely to help, documented internal complaints may be relevant later.

Step 3: File a complaint with the appropriate agency. For federal FCRA violations, file a complaint with the Federal Trade Commission (FTC) at reportidentitytheft.ftc.gov or by calling 1-877-438-4338. The FTC does not have a private right of action under the FCRA, so filing with the FTC initiates an investigation but does not give you a direct lawsuit against your employer through the FTC. However, you have a private right of action directly against your employer under 15 U.S.C. § 1681p. For Virginia Consumer Protection Act violations, file a complaint with the Virginia Attorney General's Office of Consumer Protection at 202-692-0558 or online at www.oag.state.va.us. Include all documentation of how the biometric data was collected, what consent was or was not obtained, and how the collection caused you harm.

Step 4: Understand the investigation and litigation timeline. The FTC typically investigates FCRA complaints over 30 to 90 days, though investigations can take longer. The FTC may send a demand letter to your employer requesting information. Your employer is not required to respond to the FTC complaint directly. A Virginia Attorney General investigation into Consumer Protection Act violations may take 60 to 180 days. You do not need to wait for agency action to file a lawsuit; you can file a private lawsuit under the FCRA directly in federal court or state court in Virginia at any time within the applicable statute of limitations (typically four years for FCRA claims under state law principles). Expect discovery to take 6 to 12 months, during which both sides exchange documents and evidence.

Step 5: Consult an employment attorney experienced in privacy law or consumer protection. Contact a lawyer who specializes in FCRA violations or Virginia Consumer Protection Act claims. A consultation typically costs $200 to $500 and is often free. Many attorneys work on contingency for FCRA cases because statutory damages are available. Your attorney can review the facts, estimate your damages, and determine whether a demand letter, negotiation, or lawsuit is appropriate. If you decide to sue, your attorney will file in the federal district court in Virginia or a state circuit court, depending on the circumstances. Attorney's fees are recoverable under both the FCRA and the Virginia Consumer Protection Act if you prevail.