Employees from Peacock Foods recently filed a class action suit against their employer. The group claims the company violated the Illinois Biometric Identifier Privacy Act. The employees say the company collected their fingerprints when they clocked in and out of work. They also claim the company didn’t follow the mandates meant to protect this information.

This Act requires private entities who collect biometric identifiers, such as iris scans, fingerprints, and even photos to create a written retention schedule. This schedule must be available to the public, specify why this data is collected, and include plans to destroy the records as soon as the retention period ends. Before they collect data, the company must have a written release from an individual.

So, how long can the company keep the records? Just long enough to use them for the purpose for which they were collected.

This group of employees said Peacock Foods violated all three areas of this act. The employees claim they didn’t know why the company collected their fingerprints. They also assert that they didn’t permit the company to collect and retain their fingerprint records. To add to that, they weren’t given a written notice of this policy. They also allege that they didn’t know the retention period for those records.

Peacock Foods Lessons for Records and Information Management

Although this lawsuit stems from a specific U.S. state law, the issue of unlawful collection of sensitive personally identifiable information (PII) is an issue that affects every company. This lawsuit and other similar suits should put all companies on notice. Stricter laws that control how companies collect and retain this category of PII are increasing across the U.S. These records are subject to even stricter standards across Europe. The European Union General Data Protection Regulation (GDPR), which goes into effect May, 2018, will increase regulations on these records.

To read about what steps Records and information management professionals should consider as they deal with PII: https://www.zasio.com/u-s-employer-class-action-lawsuit-employee-privacy-recordkeeping-violations/

Author: Jennifer Chadband, Senior Records Analyst at Zasio Enterprises, Inc.