Summary. This checklist gives companies a phase-by-phase program for collecting, using, sharing, and destroying biometric data lawfully, built around the Illinois Biometric Information Privacy Act and extended to Texas, Washington, Colorado, California, New York City, Portland, and the Federal Trade Commission. It starts with an applicability screen and a full inventory of biometric systems, including systems that are easy to miss such as identity-verification vendors, voice authentication, virtual try-on tools, and AI training datasets. It then covers the public retention and destruction policy, written notice and release before collection, vendor contract flow-downs, time-clock deployments, facial recognition, voiceprints, AI training data, security, and executing the destruction schedule. Red-flag boxes, a deadlines table, and a list of common failure points drawn from litigated cases help prioritize the work. Each item links the governing authority and notes how courts have treated it.

A regional fitness chain with twelve clubs in Illinois and Indiana rolled out "palm entry" in 2022: members held a hand over a reader at the front desk and the turnstile opened. The marketing team loved it. The vendor's contract said the vendor was "BIPA compliant." The membership app had a checkbox that said "I agree to the Terms of Use." Two years later the chain received a demand letter on behalf of a putative class of 41,000 members. The vendor's "compliance" turned out to mean that the vendor encrypted its templates. Nobody had written a public retention policy, the app checkbox did not mention biometrics, and the vendor's servers held templates of members who had cancelled in 2022.

Every item that failed in that example is on this checklist. Illinois law makes the duties simple and the penalties severe: publish a retention policy, inform people in writing, get a written release before collection, never profit from the data, disclose it only with consent, protect it, and destroy it on time. See the doctrinal background in Biometric Privacy Litigation: BIPA, Rosenbach, Cothron, the 2024 Amendment, and the Laws Following Illinois.

How to use this checklist

  • Work the phases in order. The inventory in Phase 1 determines everything else; companies that start by drafting a consent form usually miss a system.
  • Assign an owner to each item. Most items belong to privacy or legal, but HR owns employee onboarding, IT owns retention and destruction, procurement owns vendor terms, and product owns consumer flows.
  • Treat Illinois as the baseline. BIPA is the strictest regime with a private right of action. A program that satisfies BIPA satisfies most of the other biometric laws, with additions noted in Phase 0.
  • Document as you go. In litigation, the question will be what the company did and when. Version-dated policies, signed releases with timestamps, and destruction certificates are the evidence.
  • Use the templates. The policy, consent forms, vendor addendum, data inventory worksheet, and litigation hold referred to below are in Biometric Privacy Toolkit: Retention Policies, Consent Forms, and Vendor Terms.
  • If a claim has already arrived, stop and read Defending or Bringing a Biometric Privacy Claim: A Practical Guide before changing systems or deleting anything.

Phase 0: Applicability screen

  • Identify every state and city where biometric data is collected from people. The question is where the person is when scanned, not where the company is headquartered. Illinois courts ask whether the relevant circumstances occurred "primarily and substantially" in Illinois, under Avery v. State Farm Mutual Automobile Insurance Co., 216 Ill. 2d 100 (2005).
  • Illinois (BIPA, 740 ILCS 14). Applies to any "private entity" (not government) that collects, captures, purchases, receives, or otherwise obtains biometric identifiers or information, or possesses them. Private right of action; $1,000 / $5,000 liquidated damages per violation; five-year limitations under Tims v. Black Horse Carriers, Inc., 2023 IL 127801 and 735 ILCS 5/13-205.
  • Texas. Tex. Bus. & Com. Code § 503.001 applies to capture of a biometric identifier for a commercial purpose; requires notice and consent, bars sale with limited exceptions, and requires destruction within a reasonable time, generally no later than the first anniversary of the date the purpose for collection expires. Attorney general enforcement, up to $25,000 per violation.
  • Washington. RCW 19.375 governs enrolling biometric identifiers in a database for a commercial purpose (attorney general enforcement). The My Health My Data Act, RCW 19.373, treats biometric data as consumer health data and carries a private right of action through the Consumer Protection Act.
  • Colorado. The Colorado Privacy Act as amended by HB 24-1130 (effective July 1, 2025) adds biometric-specific duties, including a written policy with a retention schedule, consent, and employer-specific limits, and applies to biometric processing regardless of the Act's usual consumer-volume thresholds. The Attorney General enforces it and has rulemaking authority, so check the current Colorado Privacy Act rules.
  • California. Biometric information is personal information and, when processed to identify a consumer, sensitive personal information under Cal. Civ. Code § 1798.140, subject to the right to limit under § 1798.121. A breach of unencrypted biometric data can support a private action under § 1798.150.
  • Other comprehensive privacy states. Virginia, Connecticut, Texas, Oregon, and other states treat biometric data processed for identification as sensitive data requiring opt-in consent and a data protection assessment. For the multistate picture, see State Consumer Privacy Laws: The CCPA, the CPRA, and the Multi-State Patchwork.
  • New York City. Commercial establishments (retail, food and drink, entertainment venues) that collect biometric identifier information from customers must post clear signage at customer entrances and may not sell or share the data for value (N.Y.C. Admin. Code § 22-1201 et seq.).
  • Portland, Oregon. Private entities may not use face recognition in places of public accommodation (Portland City Code ch. 34.10).
  • Federal. The FTC treats unfair or deceptive biometric practices as violations of 15 U.S.C. § 45 and set out its expectations in its May 2023 Policy Statement on Biometric Information. Banks and other financial institutions should note that BIPA does not apply to entities subject to Title V of the Gramm-Leach-Bliley Act (15 U.S.C. § 6801; definition in § 6809), but the Gramm-Leach-Bliley privacy and safeguards rules do.
  • Exemptions. Record whether any BIPA exemption applies and why: health care (data collected for treatment, payment, or operations under HIPAA, 45 C.F.R. Part 164), financial institutions under Gramm-Leach-Bliley, and contractors working for government agencies. Do not rely on an exemption without written analysis; courts read them by their terms.

Red flag: "We are not in Illinois." An out-of-state company with Illinois employees, Illinois customers, or an app used in Illinois can be sued under BIPA. If scanning happens in Illinois, assume BIPA applies.

Phase 1: Inventory every biometric system

  • List every system that may create a biometric template. Use the inventory worksheet in the toolkit. Common sources:
    • fingerprint, hand-geometry, palm, and face time clocks;
    • building and turnstile access control;
    • device unlock features in company-issued phones or laptops (note on-device processing; see below);
    • face-recognition cameras for loss prevention or security;
    • identity-verification vendors in onboarding or apps (selfie matched against an ID photo);
    • voice authentication in call centers;
    • voice assistants and transcription tools that identify speakers;
    • virtual try-on, beauty, eyewear, and fitting tools that map facial geometry;
    • photo-tagging, photo-organizing, and face-clustering features in consumer products;
    • proctoring, driver monitoring, and fatigue-detection systems;
    • datasets used to train or test face, voice, or gait models.
  • For each system, record: purpose; vendor; locations; go-live date; who is scanned (employees, contractors, temps, customers, visitors, minors); what is stored (image, template, hash) and where (on-device, on-premises, vendor cloud, which country); who can access it; whether it is shared; retention settings; and what notice and consent documents were used, with dates.
  • Confirm whether the system creates a template. A template, hash, or other mathematical representation derived from a fingerprint, hand, face, iris, or voice is biometric information. Vendors that say they store "only a number" are describing biometric information.
  • Distinguish on-device processing. If the template is created and stored only on the user's own device and the company never receives it, the company may not possess or collect it; see Barnett v. Apple Inc., 225 N.E.3d 602 (Ill. App. Ct. 2022). Document the technical facts that support this.
  • Distinguish detection from identification. A system that finds a face in an image without creating an identifying template may fall outside BIPA; see Zellmer v. Meta Platforms, Inc., 104 F.4th 1117 (9th Cir. 2024). But a template extracted from a photo is a "scan of face geometry"; see Rivera v. Google Inc., 238 F. Supp. 3d 1088 (N.D. Ill. 2017). Get the vendor's technical description in writing.
  • Map data flows. Draw the path from capture to storage to every recipient (vendor, subprocessor, payroll provider, cloud host, affiliate). Each recipient is a potential disclosure under section 15(d).
  • Identify the legal "collector" and "possessor" for each system. Usually the deploying business collects; the vendor that hosts templates possesses. Both have duties. A hardware seller that takes no active step to collect may have fewer; see Heard v. Becton, Dickinson & Co., 440 F. Supp. 3d 960 (N.D. Ill. 2020).
  • Assign an owner and review date for the inventory. Re-run it at least annually and whenever procurement approves a new system.

Red flag: the forgotten vendor. Identity-verification, voice-authentication, and proctoring vendors are often bought by product or security teams without privacy review. They are among the most common sources of unexpected BIPA exposure.

Phase 2: Written public retention and destruction policy (BIPA § 15(a))

  • Adopt a written policy establishing a retention schedule and guidelines for permanently destroying biometric data. Use the policy template in the toolkit.
  • Set the destruction trigger correctly. BIPA requires destruction when the initial purpose for collection has been satisfied or within three years of the individual's last interaction with the entity, whichever occurs first. For employees, the purpose is usually satisfied at separation; do not default to three years.
  • Layer stricter state rules. Texas generally requires destruction no later than one year after the purpose expires. Colorado's amendment adds its own deadlines. If one policy covers several states, use the shortest applicable period or state-specific schedules.
  • Make the policy available to the public. Post it on the public website (not only an intranet or handbook) and link it from the privacy notice. A policy employees can see but the public cannot is a section 15(a) problem.
  • Follow the policy. A policy that is published but not followed is evidence of unlawful retention, which supports a concrete injury in federal court under Fox v. Dakkota Integrated Systems, LLC, 980 F.3d 1146 (7th Cir. 2020). Compliance with the schedule is required "absent a valid warrant or subpoena."
  • Coordinate with the litigation hold process. Define how the policy interacts with legal holds: preserve metadata and system records, and retain templates beyond the schedule only under a court order, subpoena, or written stipulation. See Phase 10.
  • Version-control the policy. Keep every version with its effective date and posting evidence (screenshots or web archive captures).

For how a retention policy fits a broader data-minimization program, see Data Minimization and Avoiding the Over-Retention of Personal Information.

Phase 3: Written notice, consent, and release (BIPA § 15(b) and (d))

  • Before any collection, give written notice that biometric data is being collected or stored. "Before" means before the first scan, including enrollment scans and test scans.
  • State the specific purpose (for example, "to verify your identity when you clock in and out for payroll").
  • State the length of term for which the data will be collected, stored, and used, consistent with the retention policy.
  • Obtain a written release. For consumers, the release must be informed written consent. For employees, BIPA allows a release executed as a condition of employment. Since August 2, 2024, an electronic signature satisfies the requirement (Public Act 103-0769); for electronic records generally, see 15 U.S.C. § 7001.
  • Include consent to disclosure. Section 15(d) bars disclosure without consent. The release should authorize disclosure to the named vendor (or a described category of service providers) for the stated purpose. A release that covers collection but not disclosure leaves a claim.
  • Do not bury it. A general "I agree to the Terms of Use" checkbox that does not mention biometrics is unlikely to be informed written consent. Use a separate biometric notice and a separate affirmative act (signature, typed name, or unchecked box that the person checks).
  • Minors. For people under 18, obtain the release from a parent or legally authorized representative. The leading BIPA case involved a 14-year-old's season pass; see Rosenbach v. Six Flags Entertainment Corp., 2019 IL 123186.
  • Translate. Provide the notice and release in the languages the workforce or customer base reads.
  • Store releases with timestamps linked to the person's enrollment record, so the company can prove the release preceded the first scan.
  • Offer an alternative where consent must be voluntary. For consumers (and for employees in states with stricter rules), offer a non-biometric option (badge, PIN, manual check-in) and do not penalize people who choose it.
  • Re-consent on material change. If the purpose, vendor, or retention period changes, issue a new notice and obtain a new release before the new use.
  • Remediate legacy enrollments. For people already enrolled without a release, stop collection until a release is signed (or re-enroll after signing). A later release does not cure past violations, and under Cothron v. White Castle System, Inc., 2023 IL 128004, each new scan without a release was a new violation; the 2024 amendment limits recovery to once per person per method but does not make continued non-compliance safe.

Red flag: consent after enrollment. The most common time-clock failure is a consent form rolled out after the clocks went live. It stops the bleeding but leaves every prior enrollment exposed for five years.

The notice language should also be consistent with the company's privacy policy; see Privacy Notice Toolkit: Policy Templates, Consent Flows, and Change Management Records.

Phase 4: Vendor flow-downs

  • Identify every vendor and subprocessor that receives, stores, or processes biometric data. Include cloud hosts and support contractors with access.
  • Sign a biometric addendum with each vendor. Use the vendor addendum in the toolkit. Core terms:
    • processing only on documented instructions and for the stated purpose;
    • no sale, lease, trade, or other profit from the data (BIPA § 15(c));
    • no disclosure except to approved subprocessors bound by equivalent terms;
    • security at least as protective as for other sensitive data (BIPA § 15(e));
    • deletion on the customer's instruction and on the retention schedule, with written certification;
    • prompt notice of security incidents, subpoenas, and lawsuits;
    • cooperation with consent collection where the vendor operates the enrollment interface;
    • audit or assessment rights;
    • allocation of responsibility for notices and releases, with indemnity tied to each party's obligations;
    • insurance requirements, including coverage that does not exclude biometric claims.
  • Do not accept "BIPA compliant" as a representation. Ask what the vendor does (where templates are stored, how deletion works, whether the vendor's own interface obtains consent) and get it in writing.
  • Check the vendor's own BIPA posture. A vendor that hosts templates on its servers possesses them and must have its own public retention policy. Ask for it.
  • Review indemnity carefully. Vendors frequently exclude "customer's failure to obtain consents" from their indemnity. Decide who will obtain consent and allocate accordingly.
  • Flow down to staffing agencies. Where temporary workers use the host company's clocks, decide who will give notice and obtain releases (usually both should), and put it in the staffing contract.

For vendor programs generally, see Building a Vendor and Third-Party Risk Management Program and, for AI vendors specifically, AI Vendor Procurement and Governance Checklist: A Practical Checklist.

Phase 5: Biometric time clocks and workplace systems

  • Decide whether biometrics are necessary. A badge or PIN clock avoids BIPA entirely. If the reason is "buddy punching," quantify it.
  • Get releases before enrollment for every worker, including temps, contractors, rehires, and transfers from out of state.
  • Build the release into onboarding so no one is enrolled without it; configure the clock so a worker cannot be enrolled until HR records the release.
  • Notify and, where required, bargain with the union. For bargaining-unit employees, timekeeping methods are a subject of bargaining. Union consent (or a management-rights clause) also matters for labor preemption of later claims; see Miller v. Southwest Airlines Co., 926 F.3d 898 (7th Cir. 2019), Fernandez v. Kerry, Inc., 14 F.4th 644 (7th Cir. 2021), and Walton v. Roosevelt University, 2023 IL 128338. Document the union's notice and response.
  • Do not rely on workers' compensation exclusivity. It does not bar BIPA claims; see McDonald v. Symphony Bronzeville Park, LLC, 2022 IL 126511.
  • Delete templates at separation. Configure the system (or the vendor) to delete a worker's template promptly after the final paycheck, and log the deletion.
  • Consider an arbitration agreement. An arbitration agreement with a class waiver is enforceable for employees under Epic Systems Corp. v. Lewis, 584 U.S. 497 (2018), but model mass-arbitration risk before relying on it. See Employment Arbitration Agreements After Epic Systems and the EFAA.
  • Update the handbook. The handbook should describe the biometric system, link the public policy, and explain the alternative (if any). See Employee Handbook Drafting Checklist: A Practical Checklist.
  • Health care employers: do not over-read the exclusion. The Illinois Supreme Court's decision in Mosby v. Ingalls Memorial Hospital, 2023 IL 129081, covers worker data used for treatment, payment, or operations (such as medication-cabinet access). Timekeeping and building access are not health care operations simply because a hospital does them. Get releases for those systems.

For the wider set of workplace monitoring rules, see Employee Monitoring and Workplace Privacy: A Practical Guide.

Phase 6: Facial recognition

  • Decide whether the use is permitted at all. Private use of face recognition in places of public accommodation is banned in Portland, Oregon. In Illinois, face recognition of customers requires a written release before collection, which is impractical for walk-in loss-prevention systems; the Clearview AI litigation shows the consequences of collecting faces from people with whom the company has no relationship.
  • Post required signage. In New York City, commercial establishments must post a clear and conspicuous sign at every customer entrance disclosing collection of biometric identifier information.
  • Assess accuracy and bias before deployment. The FTC's 2023 policy statement and its December 2023 action against Rite Aid identify the failure to test for accuracy and demographic bias, to train staff, and to monitor false matches as unfair practices under 15 U.S.C. § 45. The Rite Aid order banned the company from using face recognition for surveillance for five years and required deletion of images and derived models.
  • Establish human review. Do not take adverse action (removing a customer, calling police) based solely on an automated match.
  • Limit watchlists. Define who may be enrolled in a watchlist, on what evidence, and for how long; record the basis for each entry.
  • Retain the minimum. Delete non-matching faces immediately; set short retention for match records.
  • Consumer apps. For photo-tagging, face-clustering, or selfie features, obtain an opt-in release from users in Illinois and other opt-in states before creating templates, and consider whether templates of non-users (people in users' photos) are being created. The $650 million Facebook settlement arose from templates created for tag suggestions; see Patel v. Facebook, Inc., 932 F.3d 1264 (9th Cir. 2019).
  • Virtual try-on. If the tool maps facial geometry, treat it as biometric collection, obtain a release, and do not assume the health care exclusion applies to eyewear or cosmetics; see Marino v. Gunnar Optiks LLC, 2024 IL App (1st) 231826.

Red flag: loss-prevention cameras with "facial analytics." Security vendors increasingly bundle face matching into camera systems. A store can begin collecting faceprints from every customer by accepting a software update. Require privacy review before enabling any face feature.

Phase 7: Voiceprints and voice technologies

  • Distinguish recordings from voiceprints. A call recording is not a voiceprint. A speaker-identification template (used to authenticate a caller or attribute speech to a person) is.
  • Inventory voice authentication in call centers and phone systems, including vendor fraud-detection services that analyze voice characteristics.
  • Obtain consent before enrollment. For voice authentication, the notice and release can be delivered in the IVR flow, with a recorded affirmative response and a written confirmation (for example, by email or text) to satisfy the written-release requirement. Have counsel review the flow against the electronic-signature definition added in 2024.
  • Evaluate the financial institution exemption carefully. Authentication services for financial transactions may fall within the Gramm-Leach-Bliley definition of financial activities, which is incorporated through 15 U.S.C. § 6809. Do not assume it applies to a non-financial business using the same vendor.
  • Review AI transcription and meeting tools. Tools that label speakers by name may create voiceprints. Check the vendor's documentation and settings, and disable speaker identification where it is not needed.

Phase 8: AI training data

  • Inventory datasets containing faces, voices, fingerprints, or other biometric data used to train, fine-tune, or evaluate models, including datasets licensed from third parties and data scraped from the web.
  • Document provenance. Record where each dataset came from, what rights and consents accompanied it, and whether it includes people in Illinois or other opt-in states. See AI Licensing Diligence Checklist: A Practical Checklist.
  • Decide whether templates are created. Training a face-recognition model typically involves extracting face geometry from each image. Assume that is collection of biometric identifiers unless the technical facts clearly show otherwise.
  • Avoid scraped biometric data. Collecting faces from the open web without consent is the Clearview pattern, and it has produced litigation in Illinois and enforcement abroad.
  • Plan for deletion of models. The FTC has required companies to delete models and algorithms built on improperly obtained biometric data (Everalbum in 2021; Rite Aid in 2023). Keep training lineage records so that, if a dataset must be removed, the company knows which models are affected.
  • Flow down to AI vendors. Require AI vendors to represent that training data containing biometrics was lawfully collected, and to notify the company before using its data for training. For protecting the company's own data in AI tools, see Generative AI Trade Secret Protection Checklist: A Practical Checklist.

Phase 9: Security (BIPA § 15(e))

Phase 10: Destruction schedule and execution

  • Define triggers for each population: employees (separation), customers (account closure or inactivity), visitors (end of visit), applicants (end of process), dataset subjects (end of project), with the three-year outer limit in Illinois and shorter limits elsewhere.
  • Automate deletion in the system or require the vendor to delete on a schedule, with deletion logs.
  • Obtain vendor certificates of destruction at least annually and at contract termination.
  • Audit for stragglers. Search backups, exports, test environments, and old devices for templates. A template left on a decommissioned clock is still retained.
  • Handle litigation holds deliberately. When litigation is reasonably anticipated, the company must preserve relevant evidence under Fed. R. Civ. P. 37(e) and cases such as Zubulake v. UBS Warburg LLC, 217 F.R.D. 309 (S.D.N.Y. 2003). Preserve enrollment and scan metadata, policies, and contracts; for the templates themselves, seek a stipulation or court order before retaining them past the BIPA deadline or destroying them. See Litigation Hold and Evidence Preservation Checklist: A Practical Checklist.
  • Record each destruction run (date, population, count, method, verifier). This is the evidence that defeats a retention claim.

Phase 11: Governance, insurance, and review

  • Assign a program owner and report status to management at least annually.
  • Train HR, facilities, security, procurement, and product teams to recognize biometric systems and route them for review.
  • Require privacy review in procurement for any system with a camera, microphone, or sensor that identifies people.
  • Review insurance. Many newer CGL, EPL, and cyber policies exclude biometric claims. Older policies may cover them; Illinois courts have held that BIPA claims can trigger "personal and advertising injury" coverage, see West Bend Mutual Insurance Co. v. Krishna Schaumburg Tan, Inc., 2021 IL 125978, and that broad catch-all exclusions may be ambiguous, see Citizens Insurance Co. of America v. Wynndalco Enterprises, LLC, 70 F.4th 987 (7th Cir. 2023). Keep old policies; negotiate biometric coverage where possible.
  • Conduct data protection assessments where comprehensive state laws require them for sensitive data processing.
  • Audit annually: re-run the inventory, sample releases against enrollment dates, confirm the public policy is posted, and check destruction logs.

For integrating biometrics into an overall privacy program, see Privacy Compliance Program Checklist: A Practical Checklist.

Red flags at a glance

Stop and fix immediately if any of these is true:

  • A biometric system is collecting data in Illinois and no written release was obtained before enrollment.
  • The retention policy is not on the public website.
  • Templates of former employees or cancelled customers still exist past the purpose or three-year deadline.
  • Biometric data is shared with a vendor under a contract that does not mention biometrics.
  • A face-recognition feature was enabled by a vendor update without review.
  • The company or a vendor sells, licenses, or otherwise monetizes biometric data or models trained on it.
  • The only consent is a general terms-of-use checkbox.
  • Minors are enrolled with their own click-through consent.

Deadlines and key time periods

Item Period Source
Notice and release Before first collection 740 ILCS 14/15(b)
Destruction (Illinois) When initial purpose is satisfied or 3 years after last interaction, whichever is first 740 ILCS 14/15(a)
Destruction (Texas) Reasonable time, generally no later than 1 year after the purpose expires Tex. Bus. & Com. Code § 503.001
Limitations for BIPA claims 5 years Tims; 735 ILCS 5/13-205
BIPA damages $1,000 negligent; $5,000 intentional or reckless; one recovery per person per method after Aug. 2, 2024 740 ILCS 14/20; Public Act 103-0769
Colorado biometric amendment Effective July 1, 2025 HB 24-1130
NYC signage cure period 30 days after written notice before suit on signage claims N.Y.C. Admin. Code § 22-1203
California breach claims 30-day notice and opportunity to cure before seeking statutory damages Cal. Civ. Code § 1798.150
Inventory and policy review At least annually Best practice

Common failure points

These patterns recur in BIPA complaints and decisions:

  1. The consent form came after the clocks. The company adopted a form when it learned of BIPA, but never addressed prior enrollments. Exposure runs five years back.
  2. The release did not cover the vendor. Collection was consented to; disclosure to the cloud-hosted vendor was not. That is a separate section 15(d) claim.
  3. The policy lived on the intranet. Employees could see it; the public could not.
  4. Nobody deleted anything. The vendor's default retention was indefinite. Former workers' templates sat on the server for years, supporting a concrete retention injury.
  5. The vendor's "compliance" was security only. Encryption satisfies part of section 15(e) but nothing else.
  6. A software update added face matching. The company never decided to collect faceprints.
  7. The union was never told. The company lost a labor-preemption argument because it could not show the union agreed to or was informed of the system.
  8. A rehire or transfer slipped through. Onboarding releases were signed at original hire in another state, not at Illinois enrollment.

Short worked example

Northfield Fitness, the chain in the opening scene, uses this checklist after receiving the demand letter (and after its litigation counsel has issued a hold). Phase 1 finds three systems: palm entry (vendor-hosted templates), a face-matching feature in its new security cameras (enabled in a 2023 update), and a staff fingerprint clock at two clubs. Phase 2 produces a public policy posted on the website with a destruction trigger at membership cancellation. Phase 3 replaces the app checkbox with a separate biometric notice and release and adds a key-fob alternative. Phase 4 renegotiates the palm vendor's contract to add a biometric addendum with deletion certification and to split indemnity based on which party operates the enrollment screen. Phase 6 disables camera face matching pending review. Phase 10 sets automated deletion at cancellation and, after a stipulation with claimant's counsel preserving enrollment metadata, purges templates of 9,000 cancelled members. The demand still has to be resolved, but the class stops growing, the retention claim stops accruing, and the next audit has a record to show.

This document is general information, not legal advice for any particular situation. Requirements vary by jurisdiction and are changing; confirm current law before implementing.

Related Documents

Related Articles

Related Guides

Related Checklists

Related Toolkits