© 2022 American Payroll Institute, Inc. APA Comments on Maryland Biometric Identifier Bill The APA requested expansion of the exceptions for employer biometric identifier systems in Maryland S.B. 335 and H.B. 259, the Biometric Identifiers Privacy Act. The proposed legislation does not fully recognize employers’ use of biometric timekeeping and security systems that help to ensure employees are paid full and fair wages. Payroll use of biometrics In general, employers cannot sell or trade employees’ personally identifiable information (PII) however, they may contract with third-party, workforce-management system vendors. Employers also may share employee data from biometric timekeeping systems with outsourced entities, such as payroll service providers, under agreements that require a high level of data security. For commercial workforce management systems that use biometric identifiers, employees must acknowledge and receive training in use of the system for purposes of access, timekeeping, and payroll administration. The training includes enrollment procedures, system use, data storage, data destruction, and security measures. The APA explained to state legislators that biometric timekeeping systems ensure employees’ hours are recorded correctly and that other employees and unauthorized individuals cannot alter the record of the hours an employee works. Facial recognition technology, in conjunction with voice activation features, has become increasingly sought after during the COVID-19 pandemic because of its ability to provide a touchless experience for employees. Destruction of biometric identifiers The proposed Biometric Identifiers Privacy Act requires private entities that collect or use biometric identifiers in Maryland to establish and make publicly available guidelines for permanently destroying those biometric identifiers. Under the proposed bills, the destruction must occur at the earlier of the following: the end of the initial purpose for the collection, within one year after the individual’s last interaction with the private entity, or within 30 days after the private entity receives an employee’s or employee representative’s request to delete the biometric identifiers. The public disclosure requirement is excluded if the biometric identifiers apply only to employees and when used solely for internal operations. The bill is unclear on whether the term “internal operations” includes outsourced services, such as payroll, earned wage access, workers’ compensation, or insurance companies. In addition, the exception only accounts for public disclosure of guidelines not to the destruction of biometric identifiers. The APA said the provision on the 30-day request requires greater exclusions. “An employer cannot eliminate biometric identifiers used to authenticate employees for secure access and ensure compliance with wage and hour laws within a 30-day request by employees or agents of employees,” APA said. Even when separated from an employer, the former employee may need to access information, such as for income tax reporting. In some instances, beneficiaries are identified through biometric identifiers and this information is shared with financial institutions, such as for retirement accounts. The bill’s employer exceptions do not recognize the potential need for beneficiaries to have access. Private right of action The APA requested that the Maryland legislature eliminate the private right of action for legitimate employer, workforce management provider, and payroll service provider biometric systems. There are appropriate avenues for employees to challenge employer practices through the Maryland Department of Labor and Attorney General’s Office. In the employment context, the private right of action opens the door for individuals and attorneys to sue employers without promoting the protection of employees’ PII and employers’ payroll management systems. These lawsuits would have a chilling effect on employers’ use of biometric systems to the detriment of securing employees’ PII and ensuring they receive accurate and timely payment of wages. APA Offers CFPB Recommendations on Earned Wage Access The APA reached out to the federal Consumer Financial Protection Bureau (CFPB) regarding the agency’s response to a request by New Jersey consumer groups to identify earned wage access (EWA) services as payday loans. The APA has maintained that employer-integrated EWA is a different financial tool than payday loans. “To ensure that employees are not placed in a cycle of debt, the early payment amounts must be identified earned wages,” APA said. The problem before the CFPB At issue is a November 2020 CFPB advisory opinion on March 2022 A Supplement to Payroll Currently, Issue 3, Volume 30
Next Page