Why do some state laws regulate the collection of fingerprints or facial-geometry scans?

Short answer

Some state lawmakers have described privacy and security concerns about collecting biological data that can identify a person. Illinois says biometrics are biologically unique and that a compromise can leave a person at heightened risk of identity theft; Washington says collecting and marketing biometric information without the person’s consent or knowledge is a growing concern. [1] [2]

The details differ by statute. In Illinois, a fingerprint and a scan of face geometry are biometric identifiers, while photographs are excluded; the statute also sets retention-policy, written-notice, written-release, disclosure, and protection rules for private entities under its terms. [3] [4] Washington’s cited rule concerns enrollment in a database for a defined commercial purpose, says the exact notice and consent needed are context-dependent, and includes a security-purpose exception. [2]

These examples do not show that a particular workplace practice is covered or unlawful. The applicable jurisdiction, the technology and data involved, the entity, and statute-specific exclusions or exceptions can change the answer.

For a location-specific question, the official statute can be compared with the public notice, retention policy, release, and description of the data use. A qualified human reviewer is needed if the issue turns on coverage, an exception, an agreement, a deadline, a remedy, or a dispute.