Biometric security and privacy laws are sweeping the nation. Illinois was the first state to enact biometric regulations when the Illinois Biometric Information Privacy Act (BIPA) of 2008 became law. Since then, six other states, namely Arkansas, California, New York, Texas, Vermont, and Washington, have passed biometric statutes or expanded existing laws to include biometric identifiers. More and more states introduce legislation each year.

The following are common requirements of these laws:

• Provide Notice. Written notice must inform that: (i) a biometric identifier is being collected, (ii) the purpose of the collection, and (iii) the length of time for which it will be used and stored.

• Obtain Consent. Obtain written consent from individuals before collecting biometric identifiers.

• Securely Store the Data. Store, transmit, and protect biometric identifiers using industry-standard security mechanisms and in a manner that is the same or more protective than how the company manages other confidential and sensitive information.

• Establish Retention Schedules. Retention schedule and guidelines for permanent destruction of biometric identifiers when the initial purpose for collection has been satisfied or within 3 years of the individual’s last interaction with the company, whichever comes first.

• Timely Destroy. Securely destroy biometric identifiers once the initial purpose of obtaining the information has been satisfied or within 3 years of the individual’s last interaction, whichever is sooner.

TimeStar, in conjunction with our clock manufacturer, is committed to ensuring compliance with the ever-changing state laws governing biometric identifiers that may be in use with our time clocks, e.g., fingerprint and facial recognition.

By mid-2024, TimeStar, GT Connect, and your GT4, GT8, or IT51 time clock will simplify your biometric compliance by automating the process:

• GT4, GT8, and IT51 clocks will provide notice to the employee and obtain consent at the clock. Consent will be reobtained monthly as a best practice.

• GT Connect (replaces Custom Exchange) will securely store biometric data in the cloud and propagate the biometric template to other clocks, as appropriate.

• GT Connect will use termination data from your connected HR system to facilitate the timely destruction of biometric data per your retention policy.