Biometric Data Retention & Destruction

The privacy questions surrounding biometric information do not end when a fingerprint, facial scan, voiceprint, or other biometric identifier is collected.

What happens months or years later can be just as important.

Companies may initially collect biometric information for a legitimate purpose such as authenticating an account, recording employee time, controlling access to a facility, or verifying someone’s identity. Eventually, that purpose may end.

An employee leaves the company. A customer closes an account. A person stops using a service. An organization replaces the biometric system with different technology.

The biometric information may nevertheless remain in a database.

Some state biometric privacy laws specifically address how long this information can be retained and when it must be destroyed. The requirements differ by jurisdiction, which makes retention a distinct part of biometric privacy rather than simply an extension of the initial collection process.

Net Law Advocates represents individuals nationwide in matters involving the collection, storage, retention, disclosure, and handling of biometric information.

Why Does Biometric Data Retention Matter?

Biometric technology is often introduced to solve an immediate problem.

A fingerprint authenticates an employee. Facial recognition verifies an account holder. A voiceprint confirms the identity of a caller.

Once the organization has the biometric information, however, retaining it can become routine.

The information may remain in an active database, archived system, vendor platform, or another location long after the individual stops using the service that originally required it.

This creates a basic privacy question: when the original reason for possessing someone’s biometric information has ended, why does the organization still need it?

Certain biometric privacy laws address that question directly by limiting retention or requiring policies for destruction.

Retention and Destruction Are Different From Consent

A person can consent to the collection of biometric information and still have a separate concern about how long the information is kept.

Suppose an employee receives the required disclosures and signs a legally sufficient release before enrolling a fingerprint in a workplace access system.

That may resolve questions surrounding the initial collection.

It does not necessarily give the employer unlimited authority to retain the fingerprint-related information forever.

Similarly, a company could potentially comply with a retention requirement even though there was a separate problem with how it initially obtained the biometric information.

These are different stages of the biometric data lifecycle.

Questions about authorization at the beginning of that lifecycle are addressed through Net Law Advocates’ biometric data collection and consent content. Retention focuses on what happens after the organization already possesses the information.

Illinois BIPA Requires a Biometric Retention and Destruction Policy

Illinois’ Biometric Information Privacy Act contains specific requirements concerning retention and destruction.

A private entity in possession of biometric identifiers or biometric information must develop a written policy that is made available to the public.

That policy must establish:

• A retention schedule for biometric identifiers and biometric information
• Guidelines for permanently destroying that information

BIPA then establishes a timeline for destruction.

The statute requires covered biometric identifiers and biometric information to be permanently destroyed when the initial purpose for collecting or obtaining the information has been satisfied or within three years of the individual’s last interaction with the private entity, whichever occurs first.

Absent a valid warrant or subpoena issued by a court of competent jurisdiction, the private entity must comply with its established retention schedule and destruction guidelines.

That “whichever occurs first” language is important.

Three years is not automatically a three-year period during which every company can retain biometric information. The initial purpose for collecting the information may be satisfied sooner.

What Does “Initial Purpose” Mean?

The answer depends on why the biometric information was collected.

Consider several examples.

An employer may collect a fingerprint so an employee can access a secure facility. A business might use facial recognition to authenticate a customer. A financial service could use a voiceprint to verify someone during telephone interactions.

The reason for retaining that information may continue while the relationship continues.

But circumstances change.

An employee who no longer works at the facility may no longer need biometric access. A former customer may no longer have an account requiring biometric authentication. A company might stop offering the service for which the biometric information was originally obtained.

Those events can affect whether the initial collection purpose has been satisfied.

The analysis is fact-specific. There is not necessarily one universal event that ends the retention period for every biometric system.

Former Employees Can Present an Important Retention Issue

Workplace biometrics illustrate why retention and destruction requirements matter.

An employee might provide a fingerprint during onboarding and use it for years to clock in, access a building, or authenticate workplace systems.

Then the employment relationship ends.

The former employee may never interact with the biometric system again, but that does not necessarily mean the information disappears from every system where it was stored.

An employer may use a third-party timekeeping, payroll, security, or workforce-management provider. The biometric information or a related template could therefore exist within systems operated by more than one company.

Questions may arise about when the collection purpose ended, which entities continued possessing the information, what retention policies applied, and whether destruction occurred when required.

The broader employment context is addressed through Net Law Advocates’ workplace biometric privacy content.

Biometric Time Clocks Create a Clear Retention Lifecycle

Biometric timekeeping provides an especially useful example.

While an employee is working, a fingerprint or other biometric identifier may be used repeatedly to authenticate the employee for payroll and attendance purposes.

Once that employee leaves, the person generally no longer needs to clock in or out.

That creates a logical point at which to examine why the biometric information remains stored.

The legal deadline still depends on the applicable statute and circumstances. But the end of employment can be particularly relevant when determining whether the original purpose for collecting workplace timekeeping data has ended.

Net Law Advocates separately addresses the collection and repeated use of biometrics through fingerprint and biometric time clocks.

Vendors Can Make Biometric Destruction More Complicated

Deleting information from one company’s system may not necessarily eliminate every copy.

Biometric technology frequently involves outside vendors.

A business might collect the biometric identifier while another company provides the software, authentication system, database, cloud infrastructure, or workforce-management platform.

This can raise practical questions:

• Which company possesses the biometric information?
• Does the organization that collected it retain a copy?
• Does the technology vendor maintain another copy or template?
• Are backups or archived versions retained?
• Does deletion from the customer’s account also remove the information from the vendor’s systems?
• Is another service provider involved?

The legal significance of those questions depends on the applicable law and how the systems actually operate.

They also demonstrate why sharing biometric information with third parties and retaining biometric information are related but distinct privacy issues.

Destruction Should Address the Biometric Information, Not Merely Account Access

Disabling an account is not necessarily the same thing as destroying the biometric information associated with it.

A company might prevent a former employee or customer from accessing a system while continuing to store information associated with the account.

Similarly, removing someone’s name from an active user interface does not necessarily establish that biometric information has been permanently destroyed from the underlying database.

The important factual question is what happened to the covered biometric identifier or biometric information itself.

Answering that question may require technical records concerning storage, deletion procedures, database architecture, backups, and vendor practices.

Public Retention Policies Can Provide Important Evidence

Under Illinois BIPA, the required written biometric retention policy must be made available to the public.

That makes the policy itself potentially important evidence.

It may explain how long the company says it retains biometric information, what event triggers destruction, and how its stated retention practices are supposed to work.

An individual concerned about biometric retention may want to preserve a copy of the policy that existed during the relevant period.

Policies can change.

A company’s current biometric policy does not necessarily establish what policy was in place when the person’s information was collected or when the initial collection purpose ended.

Historical versions of privacy policies, employee documents, consent forms, and biometric notices may therefore be relevant when evaluating retention practices.

Retention Can Increase the Consequences of a Later Data Breach

The longer information remains stored, the longer it may potentially be involved in a security incident.

Imagine that a former employee’s biometric information should have been destroyed under an applicable retention rule but remains in a database. Two years later, that database is compromised.

The resulting questions could extend beyond cybersecurity.

Why was the biometric information still there? Which company retained it? Had the original purpose ended? What did the applicable retention policy require?

Those issues are separate from whether the company used reasonable security measures before the incident.

This is where biometric retention can intersect directly with a biometric data breach.

The existence of old biometric information in a compromised database does not itself establish liability, but it can make retention practices an important part of the legal analysis.

Texas Uses a Different Biometric Destruction Timeline

Illinois is not the only state that regulates biometric retention.

Texas’ Capture or Use of Biometric Identifier law establishes a different framework.

For biometric identifiers captured for a commercial purpose, the statute generally requires the person possessing the identifier to destroy it within a reasonable time and no later than the first anniversary of the date the purpose for collecting the identifier expires, subject to statutory exceptions.

The statute also specifically addresses employment.

When a biometric identifier captured for a commercial purpose has been collected by an employer for security purposes, Texas law presumes that the purpose for collecting the identifier expires when the employment relationship terminates.

Certain records that must be maintained longer under another law are subject to a separate timing provision.

This framework differs materially from Illinois BIPA and illustrates why biometric retention cannot be analyzed using one nationwide deadline.

Washington Focuses on How Long Retention Is Reasonably Necessary

Washington’s commercial biometric law uses yet another approach.

A person who knowingly possesses a biometric identifier enrolled for a commercial purpose generally may retain it no longer than reasonably necessary to accomplish specified purposes.

Those purposes include complying with certain legal retention requirements, protecting against fraud, criminal activity, claims, security threats, or liability, and providing the services for which the biometric identifier was enrolled.

Washington also contains provisions and exceptions that affect the scope of these requirements.

Unlike Illinois BIPA’s specific “initial purpose or three years” structure, Washington ties retention more directly to whether continued possession remains reasonably necessary for specified reasons.

There Is No Single Nationwide Biometric Deletion Deadline

Illinois, Texas, and Washington demonstrate the problem with treating biometric retention as though one rule applies everywhere.

Illinois uses a statutory destruction trigger tied to the initial purpose and the individual’s last interaction.

Texas generally connects destruction to expiration of the collection purpose and imposes a one-year outer period after that purpose expires, subject to its statutory framework.

Washington generally focuses on whether continued retention remains reasonably necessary for specified purposes.

Other state privacy laws may impose additional requirements depending on the information, organization, and circumstances.

The relevant jurisdiction therefore matters as much as the type of biometric technology.

Can You Ask a Company to Delete Your Biometric Data?

Potentially, but the answer depends on the law governing the information and the circumstances.

Some privacy statutes provide consumers with deletion rights subject to exceptions. Biometric-specific statutes may instead impose retention and destruction obligations directly on organizations.

Those are not necessarily the same thing.

A statutory obligation requiring a company to destroy biometric information after a particular event can exist independently of whether an individual submits a deletion request.

Likewise, an individual’s request does not necessarily mean the organization must immediately delete every piece of information it possesses. Applicable law may permit or require certain information to be retained for legal, security, fraud-prevention, or other specified reasons.

A person seeking deletion should therefore understand which law applies rather than assuming every company is subject to the same process.

What If a Company Says Your Biometric Data Was Deleted?

A statement that biometric information was deleted may resolve the concern, but sometimes additional questions remain.

For example:

Was the information deleted from the primary database? Did an outside biometric provider also delete it? Were archived copies maintained? What information did the company classify as biometric? When did deletion occur?

Those questions become particularly relevant when a later event suggests that information remained in a system after the company said it would be destroyed.

An attorney evaluating a potential retention issue may need to examine policies, technical records, vendor agreements, data inventories, and other evidence rather than relying solely on the label attached to a deletion process.

Does Keeping Biometric Information Too Long Automatically Create a Lawsuit?

No.

A company possessing biometric information for an extended period does not automatically mean a law has been violated or that an individual has a viable claim.

The analysis may depend on:

• Which state’s law applies
• Whether the information qualifies as a protected biometric identifier or biometric information
• Why the information was originally collected
• Whether that purpose has ended
• When the person’s last interaction with the organization occurred
• Whether an exception permits continued retention
• Which organizations possess the information
• What the applicable retention policy says
• Whether the statute provides an individual right to sue
• What injury or damages, if any, must be established

Illinois BIPA is particularly significant because it provides a private right of action to a person aggrieved by a violation of the Act. Other state biometric statutes use different enforcement mechanisms.

The existence of a retention requirement should therefore be separated from the question of who may enforce it and what remedies may be available.

What Information Should You Preserve?

People usually cannot see what happens inside a company’s databases, but documents can help establish the timeline.

Potentially useful records include:

• Biometric consent and release forms
• Copies of biometric retention policies
• Employee handbooks
• Employment start and termination records
• Account-opening and account-closing records
• Privacy policies
• Emails or notices concerning biometric systems
• Documents identifying biometric technology vendors
• Communications concerning deletion requests
• Statements confirming that information was deleted
• Data breach notices involving previously collected biometric information

Dates can be particularly important.

When was the biometric information first collected? When did the reason for collection end? When was the person’s last interaction with the company? When did the company say it destroyed the information?

Those facts can help determine which retention requirements may apply.

Biometric Privacy Continues After Collection Ends

A biometric system may stop interacting with someone while the information it generated remains behind.

That is why destruction is a core part of biometric privacy.

The initial collection asks whether the organization was permitted to obtain the information. Retention asks how long the organization can continue possessing it. Sharing concerns who else receives it. Security addresses how it is protected while it remains stored.

Together, these stages describe the lifecycle of biometric information.

A meaningful privacy framework therefore must address not only how biometric information enters a company’s systems, but also how and when it leaves them.

Speak With Net Law Advocates About Biometric Data Retention

People may have no practical way to know whether a former employer, technology provider, financial institution, application, or other company continues storing biometric information after the original relationship has ended.

Whether continued retention violates the law depends on the information involved, why it was collected, how long it has been stored, which organizations possess it, the applicable jurisdiction, and any statutory exceptions.

Net Law Advocates represents plaintiffs nationwide in biometric privacy matters. If you believe a company or employer retained your fingerprint, facial geometry, voiceprint, or other biometric information longer than permitted by applicable law, contact Net Law Advocates at 888-913-2318 to schedule a free, confidential consultation.