David J. Oberly |
By now, most Golden State employers are well versed in the California Consumer Privacy Act of 2018 (“CCPA”), as well as its soon-to-be successor, the California Privacy Rights Act of 2020 (“CPRA”), which goes into effect at the start of 2023.
At the same time, more and more employers operating in California (and in other parts of the nation) are integrating biometrics into their operations in a variety of ways, including for timekeeping and access control purposes, among others.
Many of these employers need not worry about satisfying the onerous requirements of the CCPA because they do not meet any of the law’s three applicability thresholds: (1) $25,000,000 in gross revenue; (2) buying, receiving, sharing, or selling the personal information of more than 50,000 consumers, households, or devices; or (3) deriving 50 percent or more of revenue from the sale of personal information.
And those employers that do fall under the scope of California’s consumer privacy law are largely exempted from compliance in connection with the personal information of employees (and job applicants) under the CCPA’s employee information exemption.
Combined, many California employers operate under the assumption that there are no applicable legal requirements that must be satisfied when using biometrics in their day-to-day operations. Organizations that take this approach do so at their peril, as California Labor Code § 1051 imposes clear, unambiguous requirements and limitations on employers that utilize certain biometric data in the workplace. More than that, this California law—which often flies under the radar of many employers and even their biometric privacy counsel—can result in criminal penalties for noncompliance.
California Labor Code § 1051
Specifically, Labor Code § 1051 bars employers that require employees or job applicants to furnish their fingerprints from disclosing that fingerprint biometric data to any third party. For example, employers are generally barred under Labor Code § 1051 from disclosing fingerprints to other employers to prevent subsequent employment, or to law enforcement agencies unless required pursuant to a court order or subpoena. Any employer that violates Labor Code § 1051 is guilty of a misdemeanor.
Practical Compliance Tips
Consequently, California employers must proceed with caution when using fingerprint biometric data in the workplace and ensure they are in strict compliance with Labor Code § 1051 when collecting, using, or storing employee fingerprint biometrics.
To do so, employers should first ensure that their biometrics service providers and vendors are completely precluded from accessing any fingerprint data collected by the employer through the service provider/vendor’s technology.
In addition, employers must maintain robust policies and protocols to prevent inadvertent disclosures of employee fingerprint data to any third parties, as a mishap of this nature—while not intentional—still nonetheless runs afoul of Labor Code § 1051.
Similarly, employers must maintain robust security measures to safeguard employee fingerprint data, as any unauthorized acquisition of such data by hackers or other malicious third parties also constitutes a violation of Labor Code § 1051.
To make matters worse, any inadvertent disclosure or other data compromise event also likely constitutes a violation of employees’ right to privacy under the California Constitution. And if that wasn’t enough, breach incidents involving the compromise of fingerprint data will also oftentimes form the basis for an actionable violation of the CCPA, opening the door for class action litigation. It should be noted, however, that Labor Code § 1051 does not apply to employers’ use of other types of biometric data (only fingerprint data) and is inapplicable outside of the employment context.
