Guide · Employment · Biometric Timekeeping

Biometric Timeclocks in Illinois Workplaces: The BIPA Compliance Trap

A fingerprint or face-geometry timeclock is not just an attendance device. In Illinois, deployment can create a biometric collection, disclosure, retention, security, vendor-management, and litigation record before the first employee clocks in.

By Lincoln Square Law · 12-minute read

The trigger is what the system captures and creates

Illinois BIPA defines “biometric identifier” to include a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry. It separately defines biometric information as information based on a covered biometric identifier that is used to identify an individual. A practice buying a timeclock should therefore obtain a technical answer about the enrollment process and the template used for later matching. Product descriptions such as “touchless,” “facial recognition,” “finger scan,” or “AI attendance” are not legal conclusions.

Do not stop at whether the vendor stores a photograph. A system may convert a fingerprint or face scan into a mathematical template and discard the original image. The legal question is what covered identifier or information is collected, captured, obtained, stored, or disclosed. Ask for the data-flow document, template format, hosting location, subprocessor list, and deletion mechanics before enrollment.

Have the public retention policy before collection

Section 15(a) requires a private entity in possession of biometric identifiers or biometric information to develop a written policy, made available to the public, establishing a retention schedule and destruction guidelines. The outside limit is when the initial purpose has been satisfied or within three years of the individual’s last interaction with the private entity, whichever occurs first, subject to the statute. A new practice should not copy a generic five-year HR retention period into a biometric policy without reconciling it to this requirement.

Operationally, the policy needs an owner and a deletion event. Offboarding should trigger a review of the employee’s biometric enrollment. The organization should know whether deletion in the application also removes templates from vendor production systems, replicas, and backups according to the documented schedule. “Vendor handles it” is not a retention program unless the contract and evidence show how.

Notice and release must precede enrollment

Before collecting or obtaining covered biometrics, section 15(b) requires written notice that a biometric identifier or biometric information is being collected or stored, written notice of the specific purpose and length of term for which it is being collected, stored, and used, and a written release. The 2024 amendment expressly recognizes an electronic signature in the definition of written release. That can make electronic onboarding workable, but only if the record is actually attributable to the employee and the disclosed purpose and term match the system.

Do not treat a handbook acknowledgment as automatically sufficient. If the acknowledgment does not identify the biometric collection, purpose, and term, it may not perform the statutory function. Keep the executed release in a retrievable record linked to the enrollment date and policy version.

Map disclosure, not just collection

Section 15(d) restricts disclosure or dissemination of biometric identifiers and information unless an exception applies, including consent or disclosure required by law. A cloud timeclock typically involves at least the employer and vendor, and may involve hosting, support, analytics, or identity subprocessors. Procurement should identify each recipient category and ensure the contract prevents secondary use that is inconsistent with the disclosed purpose.

The vendor should also be prohibited from selling, leasing, trading, or otherwise profiting from covered biometric identifiers or information in a manner forbidden by section 15(c). Security terms should reflect section 15(e), which requires a reasonable standard of care and protection at least as protective as that used for other confidential and sensitive information. Require encryption, access controls, incident notification, deletion support, and limits on model training or product improvement where those activities would exceed the disclosed purpose.

Understand what the 2024 damages amendment changed, and what it did not

Public Act 103-0769 amended section 20 so that repeated collection of the same person’s biometric data using the same method, in violation of section 15(b), is treated as a single violation for recovery. It similarly limits repeated disclosures of the same person’s biometric data to the same recipient using the same method for section 15(d) recovery. That change matters when evaluating exposure from repeated time punches.

It did not eliminate BIPA’s private right of action. Section 20 continues to provide remedies for an aggrieved person, including statutory damages depending on the nature of the violation, attorneys’ fees and costs, and other appropriate relief. A timeclock program should therefore be designed to comply at enrollment and throughout the data lifecycle rather than relying on the amendment as a substitute for compliance.

Do not confuse BIPA with ordinary attendance law

The business purpose may be mundane, recording time worked, but the data type changes the legal analysis. Wage-and-hour rules determine whether time is recorded and paid correctly, and BIPA governs the covered biometric collection and handling. The systems intersect when a practice changes vendors, migrates historical punch records, or keeps biometric templates after payroll data is no longer needed. Separate the attendance record from the biometric template in the retention map.

Also consider whether a non-biometric alternative is reasonably available. Badge, PIN, mobile, or other methods may present different security and labor issues, but offering an alternative can reduce operational friction when an employee cannot or should not use the biometric device. The decision should be documented rather than improvised at the front desk.

Use a pre-enrollment implementation file

Before anyone enrolls, assemble one file containing the vendor technical description, data-flow diagram, public retention policy, employee notice and release, contract and subprocessor terms, security review, deletion test, incident-response contact, accommodation or alternative process, and evidence of internal approval. Record the exact product version and configuration. If a later update adds facial analysis, voice features, or cloud analytics, reopen the review.

For a new practice, this is easier before launch than after dozens of employees have already enrolled. The key control is timing: identify the biometric feature during purchasing, complete the legal and technical review, obtain the required written records, and only then allow collection.

Test deletion and offboarding before launch

A policy is not operational until the organization can execute it. Before launch, enroll a test user, create several time punches, terminate the test account, and follow the deletion path. Record what disappears immediately, what remains in payroll or attendance records, what remains as a biometric template, what persists in backups, and what confirmation the vendor can provide. The purpose is to distinguish records the practice may legitimately retain from the biometric identifier or information subject to the BIPA schedule.

Build the same steps into employee offboarding. HR should notify the biometric-system owner when an employee leaves, the system owner should trigger deletion under the approved schedule, and the completion record should be retained without preserving the biometric data itself. If the practice changes timeclock vendors, migration planning should expressly address whether biometric templates will be transferred, recreated with new notice and release, or destroyed.

Control local administrators and emergency workarounds

Small practices often give front-desk or office managers broad administrative rights because someone needs to enroll a new employee or reset a device. Limit those rights. Administrators should not be able to export biometric templates, enable new facial or voice features, or extend retention without approval. Keep an access log and train administrators on the difference between correcting a punch and managing biometric data.

Plan for outages without bypassing the program. If the device fails, use a documented non-biometric fallback for timekeeping rather than enrolling employees into a second unreviewed app. If a vendor support technician needs production access, require logged, time-limited access and confirm whether that access creates a disclosure that must be addressed under the contract and privacy analysis. These operational details are where otherwise sound BIPA policies commonly break down.

Separate the timekeeping problem from the biometric design choice

A business may need an accurate record of hours worked without needing biometric data. That distinction matters because BIPA regulates the data type and the collection process, not the ordinary business purpose of recording attendance. Before selecting a fingerprint, hand-geometry, voice, or face-based device, document why the biometric feature is being considered, what non-biometric alternatives are available, and whether the operational benefit justifies the additional privacy program. A PIN, badge, mobile credential, supervisor attestation, or other method may create different risks, but it can avoid putting the workforce into a biometric lifecycle that must be administered for years.

The procurement record should identify exactly which feature performs authentication. Some vendors use photographs only for display, while another component derives a face template. Others call a template a “hash” or “mathematical representation” and assume that terminology removes it from BIPA. The legal review should use the statutory definitions in 740 ILCS 14/10 and the actual technical flow, not the vendor’s marketing label. Require a written architecture description before contract signature and preserve it with the implementation file.

Build the employee enrollment sequence so consent is provable

Enrollment should operate as a controlled transaction. The employee receives the public retention policy or a link to it, receives the written collection notice stating the specific purpose and term, signs the release, and only then enrolls a finger, hand, face, or voice credential. The employer should keep a record connecting the signed release to the date and method of enrollment. If a manager can enroll someone first and collect paperwork later, the process defeats the statutory order of operations in section 15(b).

Use version control for the notice and release. If the vendor changes from fingerprint to face geometry, adds a mobile biometric feature, begins transmitting templates to a new cloud region, or changes the purpose from timekeeping to door access, the organization should determine whether the existing notice accurately describes the new collection and use. The approval file should show who reviewed the change, what document version applied, and whether re-notice or a new release was required.

Treat the vendor contract as part of the BIPA control environment

The employer cannot manage disclosure and destruction obligations if the vendor contract is silent about where biometric data travels. Require the provider to identify subprocessors, hosting locations, backup practices, retention periods, security controls, incident-notification obligations, deletion capabilities, and the circumstances in which data can be disclosed. Contract language should prohibit sale, lease, trade, or other profit from covered biometrics and restrict disclosure to the purposes and recipients the employer has approved.

The contract should also address exit. A business changing payroll systems needs a documented way to disable collection, export any necessary non-biometric attendance records, permanently delete biometric identifiers and biometric information, propagate deletion to subprocessors and backups as the architecture permits, and obtain written confirmation. Procurement should not accept “data deleted on account closure” as the entire lifecycle plan without understanding what account closure actually does.

Prepare for a complaint, demand, or lawsuit before one exists

BIPA compliance is easier to defend when the company can reconstruct the timeline. Keep the policy versions, signed releases, vendor diligence, technical diagrams, contracts, administrator-access list, employee enrollment and offboarding records, deletion confirmations, incident records, and change approvals in a controlled evidence file. Rosenbach v. Six Flags confirmed that statutory violations can support an action without requiring the plaintiff to plead a separate injury beyond violation of the statutory rights. Public Act 103-0769 later limited repeated same-method collection or same-recipient disclosure to a single violation for recovery purposes, but it did not erase the underlying duties.

If a concern is raised, preserve the relevant records before administrators “fix” the configuration. Identify whose data was involved, what method was used, which notice and release applied, every recipient of the biometric information, and whether the retention schedule was followed. Remediation and preservation should happen together so the company does not lose the evidence needed to explain what happened.

Place biometric timekeeping in the employment-compliance program, not a generic AI folder

Biometric timekeeping is fundamentally a workforce privacy and employment-control issue even when the product uses machine learning or is sold as an AI-enabled device. The system touches onboarding, attendance, payroll, accommodations, discipline, offboarding, vendor access, and employee relations. The responsible owner should therefore sit inside a cross-functional employment/privacy process with HR, payroll, security, procurement, and legal participation.