Biometric Data in the Workplace: Legal Duties, Alternatives and Template Security

Fingerprint time clocks and face recognition door readers turn an attendance problem into a special category data problem, and the employer carries the legal duty and the breach risk for every template the vendor's terminal captures. Employees cannot change their face or fingers after a leak, regulators doubt that consent given to an employer is free, and Illinois staff can sue without proving harm. This guide covers the employer case only: time and attendance, building and room access, and biometric unlock of shared work devices. It sets out the duties that bite hardest at work (Illinois BIPA Section 15, GDPR and UK GDPR Article 9, the UK DPA 2018 Schedule 1 employment condition and the ICO's worker monitoring guidance), then how to choose and secure the system so the template is the least valuable thing an attacker could steal. It is for privacy, HR systems, facilities and security teams; the full cross-jurisdiction picture is in the Biometric Privacy Laws Map and the technology in the Biometrics Guide.

Source note: legal requirements below are summarised from the Illinois General Assembly, legislation.gov.uk, ICO, CNIL, GDPR Article 9 and NIST texts listed in the references, as checked in November 2026. Confirm against the official text before relying on it.

Key takeaways

• Start from the alternative, not the scanner. The ICO expects employers to justify why a swipe card, fob or PIN would not do, and to offer that alternative without detriment to anyone who declines.
• Employee consent is fragile. GDPR Article 9(2)(a) needs explicit consent, and the ICO says the employer and worker power imbalance makes free consent unlikely unless refusal genuinely costs nothing.
• Illinois runs on paperwork before the first scan. BIPA Section 15 requires a public retention policy, written notice of purpose and term, and a written release before collection, plus a three year outer limit on retention.
• A DPIA comes first in the UK. The ICO treats biometric identification of workers as high risk and expects a DPIA before processing starts, with workers or their representatives consulted.
• Design so there is nothing central to steal. Match on a card or the user's own device where possible, never keep raw images, encrypt templates with keys the vendor does not hold, and delete on exit.

Workplace use cases and why they differ

Not every workplace biometric carries the same risk. The legal and security weight depends on where the template lives, who compares it and whether the employee has a real choice. The ICO's worker monitoring guidance on biometric time and access control and its February 2024 enforcement against Serco Leisure show the regulator's view: Serco used facial recognition at 38 leisure sites, and fingerprints at two, to record attendance and calculate pay for more than 2,000 employees, without offering an alternative. The ICO issued nine enforcement notices ordering the processing to stop and data not legally required to be destroyed within three months.

The last row matters for scoping. When a laptop unlocks with Windows Hello or Touch ID, or a passkey is released after a local fingerprint check, the comparison happens on the device and the employer's systems receive a signed assertion, not a template. The ICO's lawful processing guidance tells employers relying on consent that they must be able to offer a genuine choice without detriment, giving the choice between a PIN or password and biometric recognition on a work device as an example. See the Passwordless and Passkeys Guide.

Legal duties that bite hardest for employers

This section covers the employment-specific duties. Damages, case law and other states are covered in the Illinois BIPA and Biometric Privacy Guide.

• UK DPIA expectation: the ICO's biometric time and access control page says a DPIA is required before processing begins when biometric data is used to uniquely identify workers, and that it should record why biometrics are necessary and proportionate, what less intrusive options were considered and why they were rejected. See the DPIA Guide.
• Appropriate policy document: where the UK employment condition is used, Schedule 1 paragraph 39 requires a document explaining how the Article 5 principles are met and setting out retention and erasure, kept, reviewed and available on request without charge to the regulator (the Information Commission, the name substituted in Schedule 1 with effect from 30 September 2026).
• France: the CNIL published a binding règlement type on biometric authentication for access to premises, applications and work tools in March 2019; French employers must follow it, and should read its text before deploying.
• Status check: as of November 2026 the ICO marks its employment guidance as under review following the Data (Use and Access) Act 2025, so confirm the current version before relying on its detail.
• Multi-country employers: design to the strictest regime that applies to any site, usually BIPA for documentation and timing and the ICO and CNIL position for necessity, then apply the same architecture everywhere.

Necessity, consent and alternatives: decision guidance

Most failed workplace deployments fail here, before any security question arises. Work through these questions in order and record the answers in the DPIA.

1. What problem is being solved? Name it with evidence, such as measured "buddy punching" or a regulated area requiring strong entry control. Convenience and modernisation are weak justifications.
2. Would a non-biometric control solve it? Cards, fobs, PINs, mobile credentials and supervisor sign-off. The ICO expects you to be able to justify not using a reasonable alternative.
3. Can the biometric stay with the employee? Match-on-card or match-on-device removes the central template store and makes the decision far easier to defend.
4. Which Article 9 condition applies? Explicit consent only works with a genuine alternative and no detriment; the employment condition only where an employment law obligation or right truly requires it.
5. Is the alternative real? Same speed of access, same pay accuracy, no extra supervision, no note on file. Workers who withdraw consent switch to it without penalty.
6. Who else is involved? Consult workers and representatives; under BIPA, collect the written release before enrolment and name the vendor as a recipient.

Template security: storage and comparison models

ISO/IEC 24745:2022 frames biometric information protection around confidentiality, integrity and renewability or revocability during storage and transfer, and analyses how security changes with the storage and comparison model. NIST SP 800-63B-4 section 3.2.3 adds that biometric data must be treated and secured as sensitive personal information, that biometrics are used only with a physical authenticator, that a non-biometric option must always be offered, and that local comparison is preferred to central comparison. Neither standard can make a stolen face secret again, which is why the model you choose matters more than any later control.

Controls for any model that keeps templates

• No raw images: the ICO asks employers to decide whether they need the underlying image or only a template; keep templates only and confirm in writing that the vendor discards enrolment images.
• Encryption at rest and in transit: the ICO says to encrypt templates so they cannot be reverse engineered into the original image or identity, and not to store them alongside associated images or lists. Use TLS 1.2 or later between terminal and server and encrypted storage with keys in an HSM or cloud KMS that you control.
• Separation from identity data: store templates against a pseudonymous reference, with the mapping to employee records in a different system and role.
• Protected templates where available: ISO/IEC 24745 template protection schemes allow a reference to be revoked and reissued; NIST notes that such schemes exist but are of limited availability, so ask the vendor what it supports.
• Presentation attack detection: NIST 800-63B-4 requires PAD for facial recognition and recommends it for fingerprint and iris. See the Biometric Liveness and Presentation Attack Detection Guide.
• Accuracy and bias: NIST sets a false match rate of 1 in 10,000 or better across demographic groups for authentication use; the ICO requires employers to assess bias, provide manual review of automated access decisions and restore access quickly after errors.

Where identity fits: the terminals and integrations are non-human identities

A biometric system is a fleet of machines talking to each other. Each clock or reader authenticates to a controller or cloud tenant, the workforce management service pushes attendance to payroll through an API, and HR pushes joiners and leavers back. Those credentials can read or export every template, so they deserve the same governance as any other privileged non-human identity.

• Terminal credentials: unique per device, certificate based where the product supports it, never a shared site password or the installer's default. See the Device and IoT Identity Guide.
• Vendor admin and support access: named accounts with MFA, time-bound access for support sessions, and logs you can see.
• Integration API keys: scoped to attendance records only, never template export; held in a secrets manager and rotated. See the Secrets Management Guide.
• Joiner, mover, leaver: drive enrolment and template deletion from the HR system of record, so a leaver event deletes templates on every terminal and in the vendor cloud, with evidence.

Rolling it out

1. Inventory: find every biometric already in use: clocks bought by site managers, door readers, shared device fingerprint unlock, visitor kiosks. Record vendor, model, template location, sites and headcount by jurisdiction.
2. Assess: run the DPIA and necessity questions above, consult workers, choose the Article 9 condition and, for Illinois staff, draft the public retention policy and written release.
3. Contract: processor terms under GDPR Article 28 that bar the vendor from reusing templates or training models on them, require deletion on instruction, fix the hosting region and give audit rights; for BIPA, name the vendor in the disclosure consent. See the GDPR Article 28 Processor Guide.
4. Pilot: one site, with the alternative live from day one. Measure false rejects by shift and by group, time to manual override and opt-out rates.
5. Harden: change default credentials, disable unused services and debug ports on terminals, place terminals on a segmented network, configure encryption and logging.
6. Enrol: notice and release first, then enrolment; record the timestamp of both so the order can be proven.
7. Operate and delete: automate deletion on leaver events and at the retention limit, including vendor cloud copies and backups, and keep deletion evidence.
8. Roll back: keep the alternative credential working throughout, so the biometric option can be switched off and templates destroyed quickly if the DPIA, a regulator or a security event requires it, as Serco was ordered to do.

Detection and measurement

Log enrolment, deletion, template export, administrative logins to terminals and the management console, configuration changes, vendor support sessions and API calls from integrations. Alert on bulk template exports, new admin accounts, terminals going offline and returning with changed firmware, and access to the template store outside the service account's normal pattern.

• Release before enrolment: percentage of enrolments with a signed notice and release timestamped earlier (target 100 percent).
• Leaver deletion time: median hours from HR leaver event to confirmed deletion on all terminals and the vendor cloud.
• Alternative uptake and parity: share of staff on the alternative and any difference in access time or pay corrections between groups.
• False reject rate: by site, shift and demographic segment where lawful to measure, with manual review response times.
• Template store reach: number of human and non-human identities able to read templates (should fall over time).
• Retention breaches: templates found older than the published schedule in audits, including backups.

Framework mapping

Common failure patterns

• Biometrics as the only way to get paid: the Serco case in one sentence. Without a no-detriment alternative, consent fails and necessity is hard to show.
• Scan first, sign later: new starters enrolled at the clock before the BIPA notice and release are signed, leaving the first collection non-compliant.
• Forgetting the vendor cloud: templates synchronised to a workforce management tenant that nobody listed as a recipient, with backups outside the deletion process.
• Templates outliving employment: leaver processes that disable the badge but leave templates on every terminal for years.
• Default terminal credentials: clocks installed with vendor default admin passwords and reachable management ports on the corporate network.
• Policy without evidence: a published retention schedule that no deletion job enforces and no audit tests.

Practitioner checklist

The checklist below sets out NHI Mgmt Group recommendations, drawn from the sources cited on this page.

• Inventory every workplace biometric system, its vendor, template location and the jurisdictions of enrolled staff.
• Complete a DPIA before any new deployment and record the alternatives considered and rejected.
• Offer a non-biometric alternative with no detriment, and make switching to it as easy as withdrawing consent.
• For Illinois staff, publish the retention schedule and collect the written notice and release before enrolment.
• Prefer match-on-device or match-on-card; never retain raw enrolment images.
• Encrypt templates with customer-controlled keys and separate them from identity records.
• Give terminals and integrations unique, scoped, rotated credentials and remove vendor defaults.
• Drive template deletion from HR leaver events and the retention limit, including vendor copies and backups.
• Bind the vendor contractually against reuse, model training and onward disclosure.
• Track the six metrics above and review them with the privacy owner each quarter.

Standards and references

• Illinois General Assembly: Biometric Information Privacy Act, 740 ILCS 14/15
• GDPR: Article 9, Processing of special categories of personal data
• legislation.gov.uk: Data Protection Act 2018, Schedule 1
• ICO: Can we use biometric data for time and access control and monitoring?
• ICO: How do we process biometric data lawfully?
• ICO: ICO orders Serco Leisure to stop using facial recognition technology
• CNIL: Biométrie sur les lieux de travail, publication d'un règlement type
• NIST: SP 800-63B-4 Authentication and Authenticator Management

This guide summarises employer obligations under biometric privacy and data protection law and is not legal advice. Related NHI Mgmt Group resources: Biometric Privacy Laws Map · Illinois BIPA and Biometric Privacy Guide · Employee Monitoring and Privacy Guide · Physical Access Control Systems Security Guide