Some Client Companies of Insperity (“Client Company or Client Companies”), and their service providers, like Insperity, utilize biometric technology systems (“Systems”) to collect, store, and use biometric data for the purpose of identifying employees, for payroll timekeeping and attendance processes, including recording time entries, and/or for processing payroll when utilizing the Client Company’s biometric timeclocks or timeclock attachments. This policy replaces and supersedes all previous Insperity policies related to biometric data. Insperity reserves the right to amend this policy at any time.
Biometric timeclocks are computer-based systems that scan an employee’s finger or hand, or other physical characteristics for purposes of identification. The computer system extracts unique data points along the finger(s)/hand and creates a unique mathematical representation of the biometric data used to verify the employee’s identity, for example, when the employee arrives at or departs from the workplace.
Definitions: Biometric data means legally protected personal information about an individual’s physical characteristics that can be used to identify that person. The Illinois Biometric Information Privacy Act, 740 ILCS 14/1, et seq. (“BIPA”), regulates the collection, storage, use, and retention of “biometric identifiers” and “biometric information” in Illinois. As used in this policy, biometric data includes “biometric identifiers” and “biometric information” as defined in BIPA. “Biometric identifier” means a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry. “Biometric information” means any information, regardless of how it is captured, converted, stored, or shared, based on an individual’s biometric identifier used to identify an individual. Several other states have their own biometric laws also.
Voluntary Participation: Client Company will not collect an individual’s biometric data or otherwise obtain it without the employee’s prior written consent. Consent to the collection, storage and use of Client Company’s biometric timekeeping system is voluntary and an alternate method of collection of work time is available upon request. Employees can revoke their consent by notifying the Client Company in writing.
Security of Data: Client Company will use a reasonable standard of care to store, transmit, and protect from disclosure or dissemination any biometric data collected. Storage, transmission, and protection from disclosure shall be performed in a manner that is the same as or more protective than the manner in which the Client Company stores, transmits, and protects from disclosure other confidential and sensitive information that is used to uniquely identify an individual.
Incident Response and Breach Notification Protocol: If a potential security incident involving biometric data occurs, immediate steps are taken to investigate. The investigation determines whether there has been any destruction, loss, alteration, or unauthorized access to or sharing of biometric data.
If the investigation confirms that biometric data was not affected, the issue is documented, underlying weaknesses are addressed, corrective actions are taken, the incident is recorded, and appropriate internal parties are notified. If the investigation finds that biometric data may have been compromised, a formal risk assessment is conducted to evaluate the potential impact on individuals. If it is confirmed that biometric data was accessed or obtained without authorization, the incident is treated as a high-risk data breach.
In the event of a high-risk data breach, all affected employees are informed within 48 hours. Notifications may be provided in writing, electronically, or by telephone. When individual notice is not feasible such as when notification costs are prohibitively high, a large number of individuals are affected, or contact information is unavailable a substitute notice may be issued through public postings or media announcements, in accordance with applicable laws.
Retention and Destruction: Client Company collects, stores, and uses biometric data throughout active employment. Client Company shall retain employee biometric data only until the initial purpose for collecting or obtaining such identifiers or information has been satisfied within 24 months of the employee’s last interaction with the Client Company or within 45 days or the determination that storage of the biometric data is no longer necessary, adequate, or relevant to the purpose of collection, and shall request that its co-employers, Insperity, and its and their service providers, and/or the licensor of the Client Company’s time and attendance software vendors permanently destroy such data when, the first of the following occurs: (a) the initial purpose for collecting or obtaining such biometric data has been satisfied, (b) within 24 months of the employee’s last interaction with the Client Company or C) within 45 days or the determination that storage of the biometric data is no longer necessary, adequate, or relevant to the purpose of collection.
Disclosure and Limitation on Use: Client Company will not sell, lease, trade, or otherwise profit from any biometric identifier or biometric information collected. Client Company has carefully selected its co-employer, Insperity, service providers vendors/software providers/business partners who provide or use the Client Company’s biometric technology, including the licensor of the Client Company’s time and attendance software, and who share the Client Company’s commitment to protecting confidential and sensitive information. Biometric data from the Client Company’s systems may be shared with its co-employer, Insperity and its and their service providers, vendors/software providers/business partners/licensor for timekeeping and payroll or security purposes. However, any biometric data obtained through the Client Company’s biometric technology systems will otherwise not be disclosed or disseminated other than as outlined in this policy.
Neither the Client Company nor its co-employer, Insperity, and its and their service providers or licensor of the Client Company’s time and attendance software will disclose, redisclose, or otherwise disseminate an employee’s biometric identifier or biometric information unless:
- The employee or the employee’s legally authorized representative consents to the disclosure or redisclosure;
- The disclosure or redisclosure completes a financial transaction requested or authorized by the employee or the employee’s legally authorized representative;
- The disclosure or redisclosure is required by state or federal law or municipal ordinance; or
- The disclosure or redisclosure is required pursuant to a valid warrant or subpoena issued by a court of competent jurisdiction.
At the conclusion of the retention period, Client Company will permanently delete or destroy the employee’s stored biometric information using appropriate security methods unless the Client Company is required by law to retain the information for a longer period of time.
To the extent anything in this policy conflicts with any state or local law on this topic, the applicable law will govern.