It's been called the "buddy punch" problem.
Employees will sometimes ask their co-workers to punch in for them at a job site. In response, some companies have turned to biometrics--unique physical, human characteristics--to digitally identify who's who and what they've been doing.
'Collected, Captured, Stored and Used'
McDonald's (MCD) employed this method, using a finger or handprint scanner as a primary method to clock-in at locations in Illinois.
The fast food giant also installed fingerprint scanners on cash registers as a way of detecting fraud and keeping track of who had access to the registers.
McDonald's recently agreed to a $50 million class action settlement involving Illinois employees who used their biometric information to log in or use the restaurants’ systems.
Plaintiffs in the case had their biometric information "collected, captured, stored and used by McDonald’s," according to a complaint, but they were not told in writing that this information was being stored, nor did they give written permission for it to be used.
McDonald's, which did not respond to a request for comment, is not only company contending with problems stemming from biometrics, which can include fingerprints, retina scans, face and voice recognition, keystrokes and even the way people walk.
In 2020, Facebook's parent company Meta (FB) agreed to pay $650 million to settle a biometrics lawsuit and analysts believe there will be more of these case as companies try to improve security while respecting an employee's privacy.
"Cases against employers who use biometric timekeeping have become extremely common over the last 5-10 years," said Matthew Kugler, associate professor at Northwestern University's Pritzker School of Law.
'Waking Up to the Dystopian Reality'
Kugler noted that "Illinois law requires explicit consent and disclosures for the collection and use of biometric identifiers, and many companies failed to have their employees complete such forms."
"More and more companies are adopting biometric verification technologies," said Margaret Hu, professor of law and of international affairs at Penn State. "At the same time, more states and local governments are enacting biometric privacy laws and ordinances. As a result, we’re likely to see similar class actions in the future.”
Dustin Marlan, assistant professor at the University of Massachusetts School of Law, said that "in the last few years, there’s been a much heightened awareness of privacy concerns both in the United States and internationally."
"People are waking up to the dystopian reality that we no longer own the aspects of ourselves we think we own," he said. "So advocates are using the laws available to them that regulate the taking of biometric data."
And what is it about biometrics that makes them such a legal minefield?
Kugler said much of the controversy with biometrics revolve around their permanence and immutability.
"Your employee ID number stops being associated with you when you leave your job, but your fingerprints and face remain the same," he said. "Some view this as posing an ongoing security and privacy risk."
"Biometrics can link an individual’s identity to a wide range of records and activities, digital and physical," Hu said. "Biometric surveillance can lead to multiple consequences, many of which are unseen and unknown.”
'Surveillance Capitalism'
Marlan said biometrics "leads to surveillance capitalism."
"There is unequal bargaining power between ordinary citizens who give up rights to aspects of our very identities, in raw form, and wealthy companies who can obtain them so easily through technology transfer," he said.
Marlan, who called $50 million "chump change" for a company like McDonald's, said that facial recognition software, in particular, is a major issue now.
"It can lead to racial profiling and discrimination, in addition to myriad other invasive surveillance concerns," he said. "Biometrics is a pressing matter of social and economic justice and we need enhanced regulation in this area."
Isabelle Moeller, chief executive of The Biometrics Institute, an international membership organization that promotes responsible and ethical use of biometrics, said "biometrics cannot be rushed, they require strong policies, processes and technology assessments."
Last year the institute issued its 20-year report, which highlighted the positive impacts of biometrics, including improved airport security and identification of victims of the 2004 Southeast Asian Tsunami.
"In 2020, we released our Three Laws of Biometrics as a concise reminder that policy has to come first when you look at implementing biometrics, followed by process and only then technology," Moeller said. "It also stresses the importance of not only knowing your algorithm but your data and your implementation."
Moeller said biometrics "requires careful planning, implementation, auditing, oversight."
"They are not a silver bullet or a quick fix," she said. "That is why we exist: to promote responsible and ethical use because, like many technologies, it is possible to use biometrics unethically and irresponsibly."
