Biometrics in the workplace may be the way of the future. But at what cost?

When Ellie Thomson arrives at work, she doesn’t punch in on a physical clock or even check in on an app. Instead, she scans her finger. 

“Seeing everyone else go ahead and do it, it just figured like the right thing to do and there was no issues with it,’” Thomson told Cost of Living. 

Thomson is a 21-year-old server and bartender at the high-end charbar restaurant in Calgary. She’s one of many employees who now use biometric technology, such as fingerprint scanning, to clock in and out — and that number is rising. 

Biometrics is already a billion-dollar industry. According to a report by market research firm IMARC Group, the global biometrics market reached $39 billion US in 2023. 

And while Thomson isn’t worried about the fact that charbar has her fingerprint, privacy experts are raising concerns about the trend.

Why the shift?

According to Hannah Johnston, who specializes in the digitalization of work and teaches human resources management at York University in Toronto, employers have started using biometrics in the workplace for a number of reasons. 

She says employers argue it’s more convenient, as people most often don’t forget their finger or thumb at home, like one might forget a swipe card. She also says employees have started using fingerprint scans for a punch clock because they say it is more accurate. 

They want to know exactly when someone punches in, and be confident no one else is doing it for them.

But not everyone is on board. 

Jeff Bromley, head of the Wood Council for United Steelworkers Canada, says people revolted when fingerprint time clocks were introduced at Canfor’s Plateau Sawmill in Vanderhoof, B.C., in 2022. 

“They were pissed off to no end,” said Bromley. “At the end of the day, they didn’t have a choice, unless they wanted to find another job or get fired.”

About 100 workers petitioned against the company for its use of biometrics, citing an unreasonable invasion of privacy, and the union filed a grievance. But an arbitrator sided with the company. 

Bromley says some people left the company over it, and others were fired for refusing to participate. CBC requested an interview from Canfor, but the company declined.

Those security concerns, Urs Hengartner says, are valid. Hengartner teaches computer science at the University of Waterloo and specializes in information privacy. 

He says fingerprint scans create a virtual copy called a template, and while it isn’t an exact replica of a fingerprint, it’s a pretty accurate copy. 

“Lots of research has shown that using this template, it is possible to reconstruct a fingerprint,” he said. “Maybe not precisely your fingerprint, but a fingerprint that will allow the hacker to login as you.”

“This is, from a privacy point of view, a problem, but also from a security point of view.”

Raising concerns

Johnston says there isn’t an easy way for employees to opt out of many of these types of biometric clock-ins if they are uncomfortable with it. 

“One of the reasons that [it’s] so concerning that [biometric data is] being used in these types of forums is that it’s highly sensitive and highly personalized,” said Johnston.

“If the objective of this type of system is to monitor working time, I would argue that there are many ways to achieve that type of exercise in ways that are less invasive.”

She says there are critical questions she believes need to be asked, such as how the data is being used, stored and disposed of. That’s where Johnston says the Canadian government needs to step in.

Diane McLeod, the Information and Privacy Commissioner of Alberta, says when analyzing cases involving data collection, her office considers what’s at risk if there is a breach. 

“You can’t change your biometrics,” said McLeod. 

“[If] the information was breached and somehow that fingerprint was replicated, and then it was used to stand in your shoes for other kinds of biometric applications, then that leaves the individual without any recourse.”

She says organizations can only collect personal information if there is a reasonable purpose for collecting that information, and there must be consent. 

The commissioner says she’s developing recommendations and engaging the Alberta government to protect data such as biometrics collected in the workplace.

“I would encourage people that are being subjected to these kinds of tools to actually make a complaint to our office because then it gives us an opportunity to make a decision and get an interpretation out there for other organizations to consider,” said McLeod.

Nancy Shapiro, an employment lawyer based in Toronto, says that, as of now, aside from disclosing to employees what is being monitored, there aren’t too many other rights that an employee has.

She says there are no laws preventing the use of biometrics in the workplace in any province, or at the federal level in Canada.

“If you’re not happy with anything at work, you’re always free to find a new job. The power of employees is really limited to that — it’s simply looking for work elsewhere,” said Shapiro. 

Going forward 

Not only is Johnston concerned about the current use of biometrics in the workplace. She’s worried about what might come next. 

“The thought of normalizing something like biometric data collection is very concerning, because if we acquiesce to allow that for entrance into the workplace, then what?” said Johnston. 

“Is our computer going to start scanning our face to make sure that we’re the one sitting in front of our workstation?… It’s just a very slippery slope.”

Meanwhile, Thomson is fine with charbar having her fingerprint on file. In fact, she says there are some benefits. 

It gives her the confidence that she knows no one else can clock on or off for her.

She says we already use our faces and fingerprints to open our phones and to pay for things. As far as her work life has been, biometrics is all she’s known.

“I guess there’s a mild concern for identity theft, but as a 21-year-old in my situation, it’s not something that I’m overly concerned with, probably just because it hasn’t been brought up to me,” said Thomson. 

“Until they start asking for blood samples, I think it’ll be OK,” said Thomson.