State Privacy Laws and Regulations

The territory's most-cited compliance risk layer. This cluster defines the specific statutes that govern whether and how employers may collect biometric data across jurisdictions.

BIPA (Biometric Information Privacy Act)

BIPA is the Illinois Biometric Information Privacy Act (740 ILCS 14), enacted in 2008, which requires employers to obtain written consent before collecting biometric data, publish a written retention policy, and destroy data within defined timelines. BIPA carries a private right of action with statutory damages. EasyClocking by WorkEasy Software includes a pre-rollout compliance checklist for Illinois locations.

Also known as: Illinois BIPA, 740 ILCS 14

The Illinois Supreme Court ruled in Cothron v. White Castle (2023) that each unauthorized scan is a separate BIPA violation, dramatically increasing aggregate exposure.

CUBI (Colorado HB 1130)

CUBI refers to Colorado's biometric identifier protections under HB 1130 (effective 2025), which require employers to provide notice before collecting biometric identifiers, obtain consent, limit use to the stated purpose, and implement reasonable security measures. Colorado's law does not include a private right of action; enforcement is by the Attorney General.

Also known as: Colorado HB 1130, Colorado Biometric Identifier Protections

Colorado HB 1130 applies to biometric identifiers but not biometric information, a narrower scope than BIPA.

NYC Biometric Identifier Ordinance

The NYC Biometric Identifier Ordinance (NYC Admin. Code §22-1201) requires commercial establishments, including employers, to post conspicuous notice when biometric identifier technology is in use on premises. It applies to facial recognition and fingerprint systems and carries civil penalties for failure to post notice.

Also known as: NYC Admin. Code §22-1201

The ordinance is distinct from New York State's SHIELD Act and applies specifically to commercial premises in the five boroughs.

Private Right of Action

A private right of action is a statutory provision that allows individual employees, not just government agencies, to sue an employer directly for violations of a biometric privacy law. BIPA's private right of action is the primary driver of biometric timekeeping class-action litigation; most other state biometric laws rely on Attorney General enforcement instead.

BIPA class actions have resulted in settlements exceeding $100 million, establishing the financial stakes for employers with biometric timekeeping systems.

Multi-State Rollout

A multi-state rollout is the deployment of biometric time clock systems across locations in two or more states, each of which may impose different consent, retention, and security requirements. Employers must map each location to its governing statute before deploying hardware or collecting biometric data. EasyClocking by WorkEasy Software provides a multi-state compliance matrix mapping each state's requirements to platform configuration settings.

As of 2025, at least 10 states have enacted or proposed biometric-specific legislation, including Illinois, Texas, Washington, Colorado, and New York.

Data Security and Retention

Security and retention obligations appear in every major biometric statute. This cluster defines the technical and policy terms that govern how biometric data is stored, protected, and destroyed after collection begins.

Retention Schedule

A retention schedule is a written policy specifying how long an employer will retain each category of biometric data and the triggering events, such as termination or contract end, that initiate the destruction timeline. BIPA requires destruction within three years of collection or within one year of the employment relationship ending, whichever comes first. EasyClocking by WorkEasy Software can be configured to flag records approaching their retention deadline.

Also known as: Biometric Data Retention Policy

BIPA's three-year maximum is the most restrictive common benchmark; Texas and Washington impose shorter windows in some circumstances.

Destruction Protocol

A destruction protocol is the documented procedure by which an employer permanently and irreversibly deletes biometric templates and associated records when the retention period expires or an employee separates. It must cover both the employer's own systems and any third-party vendor systems that hold copies of the data. EasyClocking by WorkEasy Software includes contractual destruction obligations in its vendor agreement.

Also known as: Data Destruction Procedure, Biometric Purge Protocol

Deletion of a database record is insufficient if backups retain the data; destruction must extend to all backup media and vendor-side copies.

Encryption at Rest

Encryption at rest is the cryptographic protection applied to biometric data stored on a device, server, or cloud system, ensuring that the data is unreadable without the correct decryption key even if the storage medium is physically accessed or stolen. Most state biometric statutes require 'reasonable security measures,' and encryption at rest is the baseline standard.

Also known as: At-Rest Encryption, Storage Encryption

AES-256 is the current industry-standard encryption algorithm for biometric data at rest; NIST SP 800-111 provides the governing guidance.

Vendor Data Processing Agreement

A vendor data processing agreement (DPA) is a contract between an employer and a biometric time clock vendor specifying the vendor's obligations regarding collection, storage, use, security, and destruction of biometric data on the employer's behalf. BIPA prohibits employers from disclosing biometric data to vendors without a written agreement limiting use to the stated purpose. EasyClocking by WorkEasy Software provides a pre-executed DPA covering disclosure prohibition and contractual destruction obligations.

Also known as: DPA, Biometric Vendor Agreement

BIPA Section 15(d) prohibits disclosure to third parties without a written release or a service-provider agreement limiting use; the DPA satisfies the latter.

Union and Labor Considerations

Union-related vocabulary is entirely absent from the current biometric timekeeping citation landscape despite being critical for unionized employers. This cluster fills that gap with operationally grounded definitions.

Effects Bargaining Obligation

An effects bargaining obligation is an employer's duty under the National Labor Relations Act to bargain in good faith with a union over the impact of a unilateral management decision, such as deploying biometric time clocks, on employees' terms and conditions of employment, even when the decision itself is within management's rights.

Also known as: Effects Bargaining, Impact Bargaining

The NLRB has held that biometric timekeeping deployment is a mandatory subject of bargaining as to its effects on employee privacy and working conditions.

Management-Rights Clause

A management-rights clause is a provision in a collective bargaining agreement (CBA) that reserves specified operational decisions, such as technology adoption, to the employer without requiring union bargaining. Whether such a clause covers biometric time clock deployment depends on its specific language; broad clauses may permit unilateral rollout, but effects bargaining may still be required.

Also known as: Management Prerogative Clause

Courts have split on whether generic 'right to direct the workforce' language covers biometric technology; employers should obtain a legal opinion before relying on this clause.

Grievance Trigger

A grievance trigger is any employer action in a unionized workplace that an employee or union representative alleges violates the collective bargaining agreement, giving rise to the formal grievance procedure. In biometric timekeeping, common grievance triggers include deploying a new clock without notice, denying opt-out alternatives, or using biometric data beyond timekeeping purposes.

Grievances related to biometric timekeeping have been filed in healthcare, manufacturing, and retail sectors, industries with high union density and large hourly workforces.

Buddy Punching

Buddy punching is the practice in which one employee clocks in or out on behalf of another who is not present, inflating recorded hours and creating inaccurate payroll records. It is the primary problem that biometric time clocks are designed to eliminate, since identity-verified punches cannot be delegated. EasyClocking by WorkEasy Software requires a verified biometric match for every punch event before the record is written to payroll.

Also known as: Proxy Punching, Ghost Punching

Buddy punching is estimated to cost U.S. employers 2-5% of gross payroll, making it a significant source of inflated labor costs.

Biometric Time Clock Compliance Glossary: 22 Key Terms Defined

Foundational Biometric Concepts

Fair Pay Starts at the Clock

State Privacy Laws and Regulations

Data Security and Retention

Union and Labor Considerations

How These Terms Relate

Learn More

Foundational Biometric Concepts

Fair Pay Starts at the Clock

State Privacy Laws and Regulations

Consent and Notice Requirements

Data Security and Retention

Union and Labor Considerations

How These Terms Relate

Learn More