Fingerprint scans, facial recognition, and retinal scans only a few years ago sounded like farfetched futuristic technology, but given the quickly advancing technology, these items are being used more and more in the workplace. Today’s Friday’s Five discussed five items California employers should know about their legal obligations regarding the employee’s biometric information obtained during employment:
1. California Labor Code section 1051 – prohibition on employers from sharing biometric information with third parties.
This little known Labor Code section prohibits California employers of obtaining fingerprints or photographs from employees and then sharing this information to a third party. Violation of the section is a misdemeanor. Therefore, employers are not prohibited from collecting fingerprint information from employees, but are restricted from sharing this information with an outside third party.
2. Biometrics in timekeeping systems.
While there is no prohibition in using biometrics such as finger prints or hand prints in time keeping systems to verify an employees’ identity, employers must use caution in implementing these types of systems. As discussed above, Labor Code section 1051 prohibits employers from sharing this information with a third party. Therefore employers must take steps to ensure the vendor providing the technology does not have access to the biometric information. Moreover, employers that obtain this information must be careful to protect the information from inadvertent disclosures to third parties. Disclosures from being hacked or unintentional inadvertent disclosure by the employer would likely be actionable under Labor Code section 1051 and California’s constitutional right to privacy.
3. Cost of photographs for employment must be paid for by employer.
Labor Code section 401 prohibits employers from requiring employees to submit a photograph from an applicant or an employee without paying for the cost of the photograph. Obviously employers cannot discriminate against applicants based on race, gender, age, or other protected categories, but just as this information could be learned from a photograph, it would likewise be learned by the employer during a face-to-face interview. Therefore, other than having to pay for the costs of the photograph, employers may ask for or take photographs during the hiring process as long as all prohibitions against discrimination are likewise followed.
4. Use of photographs of employees.
California Civil Code Section 3344, prohibits the use of a person’s “name, voice, signature, photograph, or likeness” in advertising or selling a product without the person’s prior consent. Penalties under this section are the greater of $750 or actual damages suffered by the person as a result of each unauthorized use, any profits that are attributable to each unauthorized use, and attorneys’ fees and costs. Punitive damages are also available to the prevailing party. Therefore, employers who use the employee’s likeness in any advertising materials should consider obtaining written consent from employees to use their likeness in any marketing or advertising literature.
5. Employers must be careful to comply with other states’ biometric laws.
Facebook, Google and other technology companies are quickly learning about the intricacies of Illinois’ Biometric Information Privacy Act (BIPA). The companies have been subject to litigation for alleged violation of the Illinois’ law on the grounds that Facebook and other tech companies’ using facial recognition in pictures stored to its software do not comply with the notice and consent requirements of the BIPA. The law, passed in 2008, requires anyone gathering biometric information to provide certain notifications to the person whose data is being collected, and written permission to collect the information. Facebook, for example, has asked for the case to be dismissed since its terms of service establishes that California law applies to any dispute. Therefore, Facebook is arguing that because California does not have a similar law to Illinois’ BIPA, the case should be dismissed. So far, that argument has not been successful and the case is proceeding against Facebook. Employers operating in multiple states should pay careful attention to state statutes to ensure they are compliant with any applicable laws. It is also likely that more and more states will enact similar laws to Illinois’ BIPA in the near future given the quickly advancing technology.