Arkansas workplace biometrics security and retention standards
In Arkansas, businesses may collect employee biometrics, but specific legal safeguards apply to retention, security, and breach notification.
In the modern workplace, the punch card has been replaced by the fingerprint, and the keycard is rapidly giving way to facial recognition. For Arkansas employers, the adoption of biometric technology offers undeniable benefits in security and efficiency. However, it also introduces a new category of risk. Biometric data—unlike a password or an ID badge—cannot be changed if it is stolen. This permanence makes it “radioactive” data in the eyes of privacy regulators and cybersecurity insurers. A breach involving employee fingerprints is not just an IT incident; it is a permanent compromise of an individual’s identity.
While Arkansas does not yet have a standalone biometric privacy statute as aggressive as Illinois’s BIPA (Biometric Information Privacy Act), it is not a “wild west” of unregulated data collection. The Arkansas Personal Information Protection Act (APIPA) explicitly defines biometric data as sensitive personal information. This classification triggers strict requirements for reasonable security, breach notification, and data destruction. Employers who treat facial scans with the same casualness as an employee ID number are walking into a minefield of potential liability, particularly if that data is exposed in a cyberattack.
This article provides a definitive operational guide to workplace biometrics in Arkansas. We will dissect the definition of “biometric data” under state law, clarify the notification obligations when a vendor is breached, and outline a “reasonable security” framework that can withstand regulatory scrutiny. Whether you are implementing a new time-clock system or a retina-scan security door, understanding the baseline legal requirements is essential to avoiding costly compliance failures.
Critical Checkpoints for Arkansas Biometric Compliance:
- Definition Scope: APIPA covers fingerprints, face geometry, voice prints, and retina/iris scans. It excludes photographs and physical descriptions unless used for automated identification.
- Security Standard: Employers must implement “reasonable security procedures” appropriate to the sensitivity of the data. Biometrics require a higher standard than standard personnel files.
- Vendor Risk: If your time-clock vendor (e.g., ADP, Kronos) is breached, you (the data owner) are often responsible for notifying your employees under Arkansas law.
- Destruction Duty: You must take all reasonable steps to destroy biometric records that are no longer needed (e.g., after an employee quits) to make them unreadable.
See more in this category: Digital & Privacy Law
In this article:
Last updated: October 27, 2023.
Quick definition: The legal framework governing the collection, storage, and protection of biological characteristics (fingerprints, face, eyes) used for authentication in the Arkansas workplace.
Who it applies to: Any Arkansas employer (public or private) that collects biometric data from employees for timekeeping, security, or access control.
Time, cost, and documents:
- Compliance Timeline: Immediate upon collection.
- Cost: Implementation of encryption and secure storage; potential breach notification costs.
- Key Documents: Biometric Data Policy, Employee Consent Form, Vendor Security Addendum.
Key takeaways that usually decide disputes:
Further reading:
- Whether the data was encrypted (the “Safe Harbor”).
- Whether the employer had a written policy for retention and destruction.
- The speed and clarity of notification after a security incident.
Quick guide to Workplace Biometrics in Arkansas
- Consent is King (Even if not strictly mandated): While Arkansas law doesn’t explicitly mandate written consent like Illinois, obtaining it is the “gold standard” defense against common law privacy torts. Always get a signed release.
- Biometrics = Personal Information: Under the 2019 amendment to APIPA, biometric data is legally “Personal Information.” Losing a fingerprint database triggers the same notification laws as losing a database of Social Security numbers.
- The Encryption Safe Harbor: If you encrypt the biometric data and the encryption key is not stolen, you generally do not have to notify the state or employees of a breach. This is your most important technical control.
- Don’t Hoard Data: Delete the biometric template immediately when an employee leaves. Holding onto it “just in case” creates unnecessary liability with no business benefit.
- Vendor Vetting: Most employers use third-party vendors for biometric clocks. You must verify their security practices. If they fail, you pay the price in reputation and legal costs.
Understanding Biometric Compliance in Practice
In Arkansas, the regulation of workplace biometrics is driven primarily by the Arkansas Personal Information Protection Act (APIPA). Before 2019, biometric data existed in a gray area. The 2019 amendment (Act 1030) clarified the landscape by explicitly adding “biometric data” to the definition of personal information. This means that any business that “acquires, owns, or licenses” such data is legally responsible for its security. The law defines biometric data broadly to include fingerprints, face geometry, voice prints, and retina/iris scans, provided they are used to identify an individual.
The core compliance pain point is “Reasonable Security.” The statute requires businesses to implement and maintain “reasonable security procedures and practices appropriate to the nature of the information.” Because biometric data is immutable (you cannot change your fingerprint), the standard for what is “reasonable” is higher than for a password. Storing biometric templates in a plain-text Excel file or on an unencrypted server would almost certainly be found “unreasonable” (and negligent) in court.
The “Immutable Data” Risk Factor:
- Risk: Unlike a password, a compromised fingerprint cannot be reset.
- Impact: A breach creates a lifetime risk of identity theft for the employee.
- Legal Consequence: Courts and regulators view negligence with biometric data more harshly than other data types due to the permanence of the harm.
- Mitigation: Use “hashing” (converting the image to a code) and “salting” so the raw image is never stored.
Legal and practical angles that change the outcome
A significant practical angle is the difference between “Raw Images” vs. “Templates.” Most modern systems do not store a JPG of the fingerprint; they store a mathematical representation (a template). Employers often argue, “We don’t store fingerprints, we store numbers.” While technically true, Arkansas law generally treats these templates as biometric data if they can be used to identify the person. Therefore, the same security rules apply. Do not fall into the trap of thinking templates are exempt from APIPA.
Another angle is Common Law Privacy Torts. Even without a specific biometric statute, Arkansas recognizes the tort of “Intrusion Upon Seclusion.” If an employer forces an employee to submit to an invasive biometric scan (like a retina scan) without a clear business justification and without consent, the employee could sue for invasion of privacy. While fingerprints for time clocks are generally accepted as reasonable, more invasive scans for low-security jobs could be challenged.
Workable paths parties actually use to resolve resistance
Employees sometimes refuse to use biometric scanners due to privacy or religious concerns. The workable path used by most HR departments is to offer an Alternative Method. Allowing an objecting employee to use a PIN code or an RFID badge instead of a fingerprint eliminates the legal risk of “forced” collection. It demonstrates that the employer is accommodating and respectful of privacy, which is a strong defense in any subsequent dispute. Refusing to offer an alternative and firing the employee for non-compliance is a high-risk strategy that invites litigation.
Practical application: Implementing a Biometric Policy
Rolling out a biometric system requires more than just installing the hardware. It requires a legal wrapper to protect the organization.
- Justification and Scope: clearly define why you need biometrics. “Preventing buddy punching” is a valid business reason. Document this in an internal memo.
- Vendor Security Review: Before buying the time clocks, ask the vendor: “Is the data encrypted at rest? Do you have a SOC 2 report?” If they cannot answer, do not buy their product.
- The Policy Document: Create a written “Biometric Information Privacy Policy.” It should state:
- What data is collected.
- How it is used (timekeeping only).
- How long it is kept (retention schedule).
- How it is destroyed.
- Employee Notice and Consent: Distribute a consent form. It should be separate from the general handbook acknowledgement. “I consent to the collection of my fingerprint for the purpose of timekeeping…”
- Implementation: Enroll employees. Ensure the scanner is clean and secure.
- Lifecycle Management: When an employee terminates, trigger a “Data Destruction” ticket for IT to wipe their biometric template within 30 days.
Technical details and relevant updates
The 2019 Amendment (Act 1030) was the game-changer for Arkansas. It aligned the state with the national trend of treating biometrics as highly sensitive. Specifically, it added “biometric data” to the list of elements that trigger breach notification if acquired by an unauthorized person. Importantly, the definition includes data generated from measurements or analysis of human body characteristics.
Regarding Data Destruction, Ark. Code Ann. § 4-110-104 requires taking “all reasonable steps” to destroy customer (and by extension of practice, employee) records. For biometrics, “shredding” means digital sanitization. Simply “deleting” the file reference is insufficient if the data can be recovered. The standard is “unreadable or undecipherable.”
- Encryption Standard: To qualify for the safe harbor, use industry-standard encryption (e.g., AES-256). Proprietary or weak encryption may not qualify as “encrypted” in the eyes of a regulator.
- Access Control: Limit access to the biometric database to only those HR or IT administrators who absolutely need it. Audit logs should track who accessed the database and when.
- Retention Schedule: A common standard (borrowed from Illinois BIPA but good practice in Arkansas) is to destroy data within 3 years of the employee’s last interaction or immediately upon termination.
Statistics and scenario reads
Biometric usage is surging, but so are the legal challenges. Understanding where the risks lie helps prioritize compliance efforts.
Most litigation in this space (nationally, often influencing Arkansas strategy) stems from Lack of Consent and Failure to Delete. Security breaches are less frequent but catastrophic when they occur.
65%
25%
10%
Monitorable points for employers:
- Consent Rate: Target 100% written consent before enrollment.
- Deletion Lag: Average days between termination and data deletion (Target: < 30 days).
- Vendor Audit: Annual review of the biometric vendor’s SOC 2 or security report.
Practical examples of Biometric Scenarios
Scenario A: The Secure Manufacturer
A factory in Fort Smith uses fingerprint scanners for time clocks. They have a written policy distributed to all new hires. Employees sign a consent form during onboarding. The data is stored locally on the clock but encrypted, and the vendor does not have remote access. When an employee quits, the HR manager deletes the user from the clock immediately.
Verdict: High Compliance. They have consent, security (encryption), and a destruction process. Even if the clock is stolen, the data is encrypted safe harbor applies.
Scenario B: The “Lazy” Retailer
A retail chain uses facial recognition to clock in staff. They never asked for consent; they just told staff to “look at the iPad.” The data is uploaded to a cloud server that is not encrypted. A hacker breaches the server and steals the facial templates of 500 Arkansas residents.
Verdict: Violation & Liability. They failed to secure the data (no encryption), failed to get consent (privacy tort risk), and must now notify all employees and the Attorney General, likely facing lawsuits and fines for negligence.
Common mistakes in Biometric Implementation
Assuming “Templates” aren’t Data: Believing that because you store a mathematical hash and not a picture, the law doesn’t apply. It does.
Relying on Verbal Consent: “They complied when I asked them to scan” is not proof. In court, if it’s not written down, it didn’t happen.
Vendor Blindness: Assuming the vendor is handling compliance. The vendor provides the tool; you (the employer) are the data controller responsible for the policy and consent.
Never Deleting: Keeping the fingerprints of employees who were fired five years ago. This maximizes risk for absolutely zero business gain.
FAQ about Arkansas Workplace Biometrics
Is written consent mandatory in Arkansas?
Arkansas statutes do not explicitly mandate written consent in the same way Illinois does. However, relying on implied consent is legally risky.
Best practice is to treat written consent as mandatory to defend against common law invasion of privacy claims and to demonstrate “reasonable” practices.
Can I fire an employee who refuses to scan?
Arkansas is an at-will employment state, so generally yes, you can terminate for refusing a workplace policy. However, this carries risk.
If the refusal is based on religious grounds (e.g., “Mark of the Beast” concerns), firing them could violate Title VII. Offering an alternative (PIN/Badge) is always the safer legal route.
Does a photograph count as biometrics?
Generally, no. A standard employee ID photo is not biometric data. However, if that photo is scanned by facial recognition software to create a “face geometry” template for automated identification, that template IS biometric data.
The distinction lies in the automated processing and measurement of the image.
How long can I keep the data?
Arkansas law does not set a specific “number of years.” The standard is “no longer than reasonably necessary.”
Once the employee leaves, the necessity ends. Keeping it longer than the time needed to process their final paycheck and close their file (e.g., 30-60 days) is hard to justify.
What if the vendor gets hacked?
Under APIPA, if you “own or license” the data, you are responsible. Even if the data was on the vendor’s server, you (the employer) must typically notify your employees.
Your contract with the vendor should require them to notify YOU immediately and reimburse you for the costs of notification.
Do I need to notify the Attorney General of a breach?
Yes, if the breach affects more than 1,000 individuals. If it is fewer than 1,000, you only need to notify the affected individuals.
The notification must be made in the “most expedient time possible” and without unreasonable delay.
Are genetic tests considered biometrics?
DNA and genetic information are distinct from “biometrics” (like fingerprints) but are often protected under separate laws like GINA (Genetic Information Nondiscrimination Act).
APIPA includes “DNA” in the definition of personal information, so the security and notification rules apply equally.
Does this apply to customers too?
Yes. APIPA protects “individuals,” not just employees. If you use facial recognition to identify shoplifters or loyal customers, you have the same (or higher) obligations regarding security and data protection.
Customer data collection is often riskier due to the lack of an employment contract governing the relationship.
Is encryption mandatory?
Strictly speaking, the law requires “reasonable security.” However, because encryption provides a safe harbor from breach notification, it is effectively mandatory for any prudent business.
Not encrypting sensitive biometric data would likely be deemed “unreasonable” negligence in a lawsuit.
Can I sell the data?
Selling biometric data is explicitly restricted or prohibited in many jurisdictions and is a massive liability magnet. Do not do it.
Arkansas consumer protection laws could be used to attack any undisclosed sale of such sensitive personal information.
References and next steps
- Audit Your Clocks: Check with your IT team today. Is the biometric data encrypted? Who has access?
- Draft the Policy: If you don’t have a specific Biometric Privacy Policy, download a template and customize it for Arkansas immediately.
- Review Contracts: Ensure your vendor contracts place the liability for data breaches on the vendor, not you.
Related reading:
- Arkansas Personal Information Protection Act (APIPA) Full Text
- Best Practices for Biometric Data Security (FTC Guidelines)
- Illinois BIPA vs. Arkansas APIPA: Key Differences
- How to respond to a data breach in Arkansas
Legal basis
The primary statute governing this issue is the Arkansas Personal Information Protection Act (APIPA), codified at Ark. Code Ann. § 4-110-101 et seq.. The key amendment is Act 1030 of 2019, which expanded the definition of “personal information” to explicitly include “biometric data.”
Additionally, Ark. Code Ann. § 4-110-104 imposes the duty of “reasonable security procedures and practices” and the duty to destroy records. While Arkansas lacks a specific “Biometric Privacy Act” like Illinois, these general data protection statutes form a binding regulatory framework for all employers.
Final considerations
Workplace biometrics in Arkansas are a tool of convenience that must be handled with the precision of a hazardous material. The law acknowledges their utility but demands a higher standard of care. Employers who respect the permanence of this data—by securing it, limiting its retention, and being transparent with employees—will find it a valuable asset. Those who treat it as “just another file” are risking a breach that could define their company’s future.
The path to compliance is not expensive, but it is strict. Encrypt the data. Get the consent. Delete it when you’re done. These three steps form a shield that protects not just your employees’ identities, but your organization’s bottom line.
Key point 1: Biometric data is “Personal Information” in Arkansas, triggering breach notification laws.
Key point 2: Encryption is the only “Get Out of Jail Free” card for data breaches.
Key point 3: Consent is your best defense against invasion of privacy lawsuits.
- Implement a “written consent first” policy for all new biometric enrollments.
- Verify your vendor’s encryption standards (ask for “encryption at rest”).
- Set an automated reminder to delete biometric data 30 days after an employee terminates.
This content is for informational purposes only and does not replace individualized legal analysis by a licensed attorney or qualified professional.