Biometric Data Collection at Work in Washington: Your Rights

Federal law does not comprehensively regulate employer collection of biometric data. The Americans with Disabilities Act (42 U.S.C. § 12101 et seq.) prohibits discrimination based on disability but does not restrict biometric collection itself. Some federal statutes address specific contexts: the FCRA (15 U.S.C. § 1681 et seq.) governs background checks that may include fingerprinting for certain positions, particularly law enforcement and financial services.

The FTC Act (15 U.S.C. § 45) authorizes the Federal Trade Commission to prevent unfair or deceptive practices involving biometric data but does not create a private right of action for employees. Federal courts have recognized privacy torts under common law (intrusion upon seclusion) in some jurisdictions, but these require proving emotional distress and are difficult to win. There is no federal statute specifically requiring employer consent for biometric collection in non-regulated industries. Employers in states without specific biometric laws face minimal federal restrictions on collecting fingerprints, facial scans, or other biometric identifiers from employees, making state law the primary protection.

Washington has one of the nation's strongest biometric privacy laws. RCW 19.255.010 (the Biometric Identifier Privacy Act, effective January 1, 2024) requires employers to obtain written informed consent before collecting, capturing, purchasing, receiving through trade, or otherwise obtaining any biometric identifier from an employee or job applicant.

Washington's law is significantly stronger than federal law because it creates a private right of action with statutory damages. Unlike federal law, which requires proving actual harm, Washington allows employees to recover up to $5,000 per violation simply by showing the employer collected biometric data without consent. This applies regardless of employer size—there is no employee threshold.

The statute defines biometric identifiers broadly to include fingerprints, voiceprints, iris scans, retina scans, hand geometry, facial recognition technology, and any other identifier that is based on physical or biological characteristics. RCW 19.255.020 specifies that employers must provide clear, conspicuous notice at or before collection explaining how the biometric data will be used, stored, and destroyed. Employees retain ownership of their biometric data and can revoke consent in writing at any time.

Washington's law differs from federal baseline by creating enforceable privacy rights that employers cannot contract away. Unlike some states with biometric laws that include narrow exceptions for security or identification purposes, Washington requires consent in nearly all contexts. Employers must also establish retention and destruction protocols. The law applies to all employers operating in Washington, making it broader in coverage than federal regulations tied to specific industries.

Washington RCW 19.255 contains narrow exceptions. Collection is permitted without written consent in specific situations: when required by federal, state, or local law or court order (e.g., background check laws for certain positions); when biometric data is voluntarily disclosed by the employee in the course of lawful employment with no intent to identify the employee; and when collection is necessary for payment processing or security purposes explicitly authorized by law.

However, these exceptions are interpreted narrowly in Washington. A background check exception exists, but only when genuinely required by applicable law—not when merely convenient or preferred by the employer. For example, fingerprinting required for FBI background checks in regulated industries (securities, childcare, healthcare) may qualify, but voluntary employer background checks do not.

The law applies despite any at-will employment status. Employers cannot require biometric collection as a condition of employment without violating the statute. There is no exception for union workers or collective bargaining agreements—consent is always required. Washington courts have not established whether an employee's prior consent in a previous employment relationship carries over to a new employer; consent is job-and-employer-specific.

Employers also cannot require employees to waive their rights under RCW 19.255 as a condition of employment. Attempts to circumvent the law (e.g., collecting biometric data as part of a "voluntary" wellness program) still require consent. Limited-use exceptions exist when biometric data is collected for de-identification research approved by an institutional review board, but this exception is rarely available in employment contexts.

Step 1: Document the violation. Keep all communications from your employer requesting biometric data, including email, text, or written forms asking for fingerprints, facial scans, voice recordings, or iris scans. Save screenshots of any systems requiring biometric authentication (facial recognition login, fingerprint time clocks) without your written consent. Note the specific date, method of collection, and whether you received written notice explaining use, storage, and destruction of the data.

Step 2: Attempt internal resolution if you feel safe doing so. Notify your employer in writing (email with read receipt is ideal) that you do not consent to biometric data collection and request that any data already collected be destroyed. Request a copy of your biometric data if stored. Keep copies of your demand letter and any response. This step is optional but creates a paper trail. Do not delay filing an external complaint to attempt internal resolution—Washington law does not require exhaustion of internal remedies.

Step 3: File a civil action in Washington state court. RCW 19.255 does not require filing with an administrative agency first; you can sue directly in superior court in the county where you work or where the employer is headquartered. File in District Court (for claims under $100,000) or Superior Court (for larger claims or additional remedies). You do not need to file with the Washington Attorney General's office first, though the AG can bring enforcement actions separately. Include in your complaint: (1) employer name and address; (2) specific date(s) of biometric collection or attempted collection; (3) type of biometric data (fingerprints, facial scan, voiceprint, etc.); (4) whether you provided written informed consent; (5) claim for statutory damages up to $5,000 per violation; (6) request for injunctive relief if collection is ongoing. There is no statutory filing deadline stated in RCW 19.255, so the standard 3-year civil statute of limitations applies (RCW 4.16.080).

Step 4: Understand the litigation process. Discovery will require the employer to produce all documents related to biometric data collection, including consent forms (or lack thereof), retention protocols, and data destruction records. The employer will likely argue one of the narrow exceptions (federal law requirement, lawful exemption) or claim consent was obtained. You will need to prove that consent was not given or was obtained improperly (e.g., not in writing, or writing was not clear and conspicuous). Most cases settle because statutory damages are substantial and employers want to avoid publicity. Litigation typically takes 12–24 months from filing to settlement or trial.

Step 5: Consult an employment attorney in Washington. Contact an attorney experienced in privacy law and biometric rights before filing to assess damages and strengthen your claim. An attorney can send a cease-and-desist letter that may prompt swift settlement. You can also contact the Washington Attorney General's Consumer Protection Division (360-753-6200) to report the violation; while the AG does not represent individual employees, complaints may trigger an enforcement investigation that provides leverage. Some attorneys work on contingency for RCW 19.255 cases because statutory damages are recoverable without proving harm, making cases economically viable. Legal aid organizations may also assist low-income workers.