Biometric Data Collection at Work in Wisconsin: Your Rights

Federal law does not establish a comprehensive national biometric data privacy statute. The closest federal framework is the Gramm-Leach-Bliley Act (15 U.S.C. § 6801), which requires safeguards for financial information but is narrowly tailored to financial institutions. The Health Insurance Portability and Accountability Act (HIPAA, 42 U.S.C. § 1320d) protects health-related biometric data but applies only to covered entities. The Americans with Disabilities Act (42 U.S.C. § 12101) requires workplace accommodations and prohibits discrimination based on biometric-derived disability information. The Federal Trade Commission (FTC) enforces general unfair and deceptive practices standards under Section 5 of the FTC Act (15 U.S.C. § 45), which can address misuse of biometric data, but there is no standalone federal employee biometric privacy law.

Employers in non-biometric-specific states operate under state common law tort principles (invasion of privacy, negligence) and industry-specific regulations. The lack of federal baseline means that Wisconsin's statutory protections create more robust employee rights than most states provide.

Wisconsin Statute section 995.50 establishes one of the nation's strictest biometric data collection standards, requiring employers to obtain affirmative written consent before collecting, using, retaining, or disclosing any biometric identifier from an employee. A biometric identifier under Wisconsin law (section 995.51) includes a fingerprint, voiceprint, iris or retinal scan, facial recognition data, or any other unique biological or behavioral characteristic used for identification purposes.

Wisconsin's law is considerably stronger than the federal baseline because it creates an affirmative statutory right to refuse biometric collection and privacy protections. The statute applies to all Wisconsin employers with no minimum size threshold—even sole proprietorships must comply. This contrasts with Title VII and other federal employment laws that typically apply only to employers with 15 or more employees.

Under Wisconsin law, employers must provide written notice before collection that includes: (1) the specific biometric identifier(s) to be collected; (2) the business purpose for collection and use; (3) the length of time the biometric data will be retained; (4) how the biometric data will be permanently destroyed; and (5) a statement that the employee may refuse collection without penalty. Wisconsin Statute 995.52 provides that employees have a private right of action for any violation, allowing them to recover statutory damages of up to $1,000 per violation, plus attorney fees and costs.

Unlike many other states, Wisconsin does not allow employers to condition employment or advancement on biometric data collection without explicit employee consent. The statute also prohibits selling, leasing, or profiting from biometric data, and restricts disclosure to third parties only with written consent. Wisconsin employers cannot use biometric data collected for one purpose for any other purpose without separate written consent.

Wisconsin law contains limited exceptions. An exception exists for biometric data collected by law enforcement in a criminal investigation—employers are not liable if they provide data pursuant to a lawful court order or subpoena, provided they give employee notice (when legally permitted). The statute does not apply to background check companies or consumer reporting agencies acting on behalf of employers; however, the employer directing the collection remains liable if proper consent was not obtained.

Another limited exception involves necessary access control and security systems. If an employer uses biometric authentication solely as a security measure to access physical locations or computer systems, and does not retain or store the biometric data for identification purposes, some courts may interpret this as outside the scope of prohibited "collection." However, Wisconsin courts have not issued definitive guidance, and employers should obtain written consent even for access control systems to avoid litigation risk.

Collective bargaining agreements can modify biometric requirements, but only by explicit negotiation—silence in a union contract does not waive employee rights. Employers cannot unilaterally override the statute through policy or employment agreements. Federal employment contractors may face additional requirements under Office of Management and Budget (OMB) guidance on federal information security standards (FISMA), which impose stricter biometric data handling protocols.

The statute does not apply to collection by third parties that is incidental to a product or service the employee voluntarily uses (e.g., if an employee chooses to unlock a personal phone with facial recognition). However, once an employer directs collection or uses that data for employment purposes, the statute applies.

**Step 1: Document the Violation.** Collect evidence of biometric data collection without consent. Keep written communications (emails, policy memos, handbooks) showing the employer collected fingerprints, facial scans, iris data, or voiceprints. Document the date collection occurred, the purpose stated by the employer, and whether written notice was provided. Preserve any forms signed or unsigned, photographs of collection equipment, and communications with HR or management. Save any notices of data retention or use. If collection occurred during onboarding, retain the employee handbook or orientation materials.

**Step 2: File an Internal Complaint.** Provide written notice to your employer's HR department or compliance officer describing the biometric collection without consent. Use email (for documentation) and request written acknowledgment of receipt. State specifically which biometric identifier was collected, on what date, and that no written consent was obtained beforehand. Request that the employer: (1) confirm whether data was collected; (2) confirm the data will be destroyed; and (3) acknowledge the violation. Internal complaints are not mandatory under Wisconsin law, but they establish a clear record that the employer was put on notice and can support a damages claim for "willful" violations (higher damages may be available).

**Step 3: File with the Appropriate Agency or Court.** Wisconsin does not assign biometric violations to a specific government agency like the EEOC or Wisconsin Department of Safety and Professional Services. Instead, Wisconsin Statute 995.52 gives employees a private right of action—meaning you sue the employer directly in Wisconsin state court (district court in the county where you work or live). There is no administrative complaint process. File a civil lawsuit in the circuit court in your county. You will need to retain an attorney (discussed below). The deadline is two years from the date of the violation under Wisconsin's general civil statute of limitations. If ongoing collection occurs, each instance may be a separate violation with its own deadline.

**Step 4: The Litigation and Investigation Process.** After filing suit, the employer will receive the complaint and has 20 days to respond. Discovery begins—both parties exchange documents (emails, policies, system logs showing data collection) and provide written interrogatories and document requests. Depositions may be scheduled (sworn testimony recorded by a court reporter). The employer's defense will likely be that consent was obtained (or that collection was necessary for legitimate security reasons). You will need to produce evidence that no written consent complying with Wisconsin Statute 995.50 was given. The case may settle during mediation. If it proceeds to trial, the judge or jury determines whether the employer violated the statute and awards statutory damages up to $1,000 per violation, plus attorney fees and costs. No punitive damages are available under the statute, but the $1,000 per violation amount is significant if multiple employees were affected.

**Step 5: Consult an Attorney.** Contact a Wisconsin employment law attorney immediately. Because you are entitled to statutory damages and attorney fees, most Wisconsin employment lawyers will take biometric cases on contingency (no upfront cost). The attorney should review the evidence of non-consent, assess the strength of the employer's defenses, and estimate the number of violations (each collection instance may be a separate claim). An attorney can also advise whether state privacy law claims (Wisconsin Statute 895.50, invasion of privacy) should be added. Given the two-year statute of limitations, act within 24 months of the first collection. The Wisconsin State Bar (https://www.wisbar.org) and Wisconsin Employment Law section can provide referrals.