MPEX's Blog



    25 May 2015

    Is Biometric Illegal In Time & Attendance?


    At dawn, the second day shift at an Indiana semiconductor chips maker is beginning. Employees press their index finger on a scanner to identify them through their fingerprints as they walk into the facility to begin their workday.


    At the same exact hour at an auto plant in New Jersey, the changing of the guard is taking place too, but here employees only get to punch a card, as they’ve been doing over the past fifty years. And this time, something fishy is going on: one of the workers doesn’t punch one card but… two.


    This is called by management and HR people ‘buddy punching’, the act of an employee registering a co-worker presence in his absence. It is fraud. Time theft. So why is the best solution on the market to prevent that from happening, biometric in time and attendance, considered by some as illegal?


    “ A 2009 study conducted by Harris Interactive Inc. showed that 21 percent of hourly employees admit to stealing company time. While only 5 percent participated in ‘buddy punching’, 69 percent said they punch in and out earlier or later than scheduled, 22 percent put additional time on their time sheet, and 14 percent didn't punch out for unpaid lunches or breaks. 

     Workforce Magazine, March 2013


    At its core, biometric time and attendance technology brings efficiency to the workplace by keeping better tabs on the employees in a given workforce. With biometric time and attendance solutions, employers cut down on time fraud and dutiful employees have hard evidence they deserve all that over time they’ve been putting in.


    Although these technologies advance security and create new efficiencies, they also raise privacy concerns in some quarters. Some biometric collection methods are believed to be invasive or inaccurate, like those used in airports or immigration offices, leading to false identification of an individual that could have serious repercussions, such as the misidentification of a citizen as an illegal alien. Another fear is encapsulated in the risk of multiple entities - corporate or governmental - storing massive amounts of sensitive personal information.


    As it can be imagined, there has been significant backlash from workers of companies who have implemented biometric systems.  A few years ago in New York City, the Bloomberg administration implemented biometrics technology to keep track of city employees.  This was met with contentious reactions by employees.  Many workers expressed outrage that the system was intrusive and violated their privacy interests.  But overall the city was very pleased with the results of the system and proclaimed it to be the "wave of the future."


    In many occurrences around the country, employees who have feared the possible misuse of their private data, or who have objected to what they view as the ultimate invasion of privacy, have refused to allow their employer to scan, record, collect or otherwise obtain biometric data. 

    This raises the question of what the employer can and should do when such thing arise.

    No current US federal law limits a private entity’s ability to collect, use, or disclose biometric data. Instead, the regulation of the private use of biometric data has largely been left to the states. Both Illinois (the Illinois Biometric Information Privacy Act, 740 ILCS 14/1, et seq.) and Texas (Bus. & Com. Code Ann. § 503.001) regulate a private entity’s use, disclosure, and eventual destruction of biometric data. Illinois obligates private entities that collect biometric data to develop written policies describing their biometric data collection methods. Both Illinois and Texas restrict the sale or lease of, or profit from, biometric data except in limited circumstances.


    In addition to the comprehensive Illinois and Texas laws, several states (Iowa, Nebraska, North Carolina and Wisconsin) include various types of biometric data in their definition of “personal information” for purposes of data security breach notification laws, which require notice to data owners in the event of a data breach involving such information. New York prohibits private employers from fingerprinting their employees as a condition of securing or maintaining employment except in limited circumstances.


    As an interesting aside, not only employers today uses biometrics in their businesses, various hotels across the country have also implemented these technologies for their customers.  Instead of the guest using a room key, the hotel would scan a guest's eye or hand for access to the hotel room.



    If biometrics is an asset to manage staff, it’s also good to stress out the benefits to the employees since the technology reduces the amount of uncompensated hours that are worked. Furthermore, biometrics time clocks can be more convenient because there is no need to carry a key or card in a purse or a pocket.



    A. Announce to all employees, in official memos, of your company's intent to implement the technology. It is important in the writing to word reassurances underlining your reasons and the safeguards that will be provided to them.

    B. Check all applicable privacy and other potentially relevant laws in your State before implementing the system.

    C. Employee badges can be an alternative if employees were to raise issues based on disability, religious beliefs, or other areas protected by law. 

    D. Be sure to implement strict security policies and procedures that will ensure all biometric data will be securely stored and safeguarded.

    E. In the advent that your company is unionized, their representatives should be given sufficient notice of your plan to utilize the technology.


    In conclusion, biometrics is in no way illegal in any form in Time and Attendance. The Federal and States legislations will evolve in the coming years, that’s for sure, and we can assume that a fair balance respecting the privacy of employees and the management need to get proper readings of their staff coming and leaving will ensure that both party’s fear are assuaged.


    As for the auto plant in Jersey, employees and employer can agree on biometrics as the best solution to eliminate ‘buddy punching’ and secure rightfully worked hours payment.


    The alternative is the numeric data collection hardware operating all punching methods such as:

    • proximity employee badge,
    • employee personal identification number,
    • face or finger recognition biometrics.

    Therefore a single data collection hardware can be used for multiple punching procedure.  The market hardware providers allowing elective in and out punching clock system are Kronos, MPEX Business Solutions, Workforce Software, etc.