Are you using biometric data? Get consent or pay the penalties.
Technology has changed transportation safety management controls. The obligation to protect the data collected and employees' privacy goes along with using technology.
Biometric data such as facial geometry data, fingerprints, digital voiceprints, and iris scans must be stored and protected with prior consent.
Carriers use dash cams to protect them from frivolous lawsuits, coach and commend their drivers, and other reasons. Electronic logging devices are required for many drivers to track hours of service. If the method of unsafe driving behavior detection or even the sign-on to a device, time clocks, or access to a truck yard or terminal building requires the use and/or storage of biometric data, a driver may have to provide prior written consent, depending on the state. If approval is not received, the carrier may be the target of litigation that has nothing to do with a crash.
State laws – existing and pending
Several states have enacted biometric-specific laws (bolded) or have privacy laws that include biometric information privacy, such as:
- Arkansas
- California
- Colorado
- Illinois
- Maryland
- New York
- Oregon
- Texas
- Virginia
- Washington
Illinois took the lead in biometric privacy laws when it enacted the Biometric Information Privacy Act (BIPA) in 2008. This law remains the toughest of its kind in the U.S. BIPA allows the collection of biometric data, but written consent is required to do so. Violating the BIPA has a maximum penalty of $5,000 per occurrence or scan regardless of whether the person an an IL resident or not. On February 17, 2023, the Illinois Supreme Court confirmed that claims under the BIPA accrue with each scan of a person's biometric data and each time the scan is sent to a third party.
Drivers sign on to devices or enter carrier truck yards every day. If biometric data is used without consent, penalties could add up quickly.
Several more states have pending biometric data-related legislation to protect a person's right to privacy.
Steps to protect data
Enacted laws focus on critical measures to protect privacy and data collected, such as:
- Inform the person of the purposes and length of term for which biometric information is being collected, stored, or used.
- Receive BIPA-compliant written consent to collect or disclose biometric information.
- Implement reasonable security procedures and practices.
- Maintain a compliant written policy with a retention schedule and guidelines for permanently destroying biometric identifiers and information.
Key to remember: Carriers eager to use technology that requires biometric information for sign-on must comply with the applicable laws or face penalties.