Biometrics in the workplace could be the way of the future. But at what cost?

When Ellie Thomson arrives at work, she doesn't punch a physical clock or even check an app. Instead, she scans her finger.

“When I saw everyone else go ahead and do it, I just decided it was the right thing to do and there was no problem with it,” Thomson said. Cost of living.

Thomson, a 21-year-old waitress and bartender at Charbar in Calgary, is one of many employees who now use biometric technology like fingerprint scanning to time them in and out, and the number is growing.

Biometrics is already a billion-dollar industry. According to a report from research firm IMARC Group, the global biometrics market will reach US$39 billion in 2023.

And while Thomson isn't worried about Charbar having her fingerprints, privacy experts are raising concerns about the trend.

Why did the shift occur?

Employers have started using biometrics in the workplace for a number of reasons, says Hannah Johnston, who specializes in the digitalization of work and teaches human resource management at York University in Toronto.

She says employers say it's more convenient because people are less likely to leave their finger or thumb at home, like someone might forget a card. She also says employees have started using fingerprint scanning for watches because they say it's more accurate.

They want to know exactly when someone is entering data and be confident that no one else is doing it for them.

But not everyone agrees on this.

Jeff Bromley, head of the United Steelworkers of Canada's Timber Council, says when fingerprint watches were introduced at Canfor's Plateau sawmill in Vanderhoof, B.C., in 2022, people were outraged.

“They were mad as hell,” Bromley said. “Ultimately, they had no choice unless they wanted to find another job or get fired.”

About 100 workers filed a petition against the company for using biometrics, citing unwarranted invasion of privacy, and a union filed a grievance. But an arbitrator sided with the company.

Bromley says some people left the company over this, while others were fired for refusing to participate. CBC requested an interview with Canfor, but the company declined.

These security concerns are justified, says Urs Hengartner, a computer science professor at the University of Waterloo who specializes in data privacy.

He said scanning a fingerprint creates a virtual copy called a template, and while it's not an exact copy of the fingerprint, it's a pretty close copy.

“A lot of research has shown that you can reconstruct a fingerprint using this template,” he said. “Maybe not exactly your fingerprint, but a fingerprint that would allow a hacker to log in as you.”

“It's a problem from a privacy perspective, but also from a security perspective.”

Expression of concern

Johnston says there is no easy way for employees to opt out of many types of biometric check-in if they don't like them.

“One of the reasons that [it’s] so what about this [biometric data is] “The characteristic of the use of information in forums like these is that it is extremely sensitive and personalized,” Johnston said.

“If the goal of this type of system is to monitor work time, I would say there are many ways to provide this type of exercise in less invasive ways.”

She says there are critical questions she believes need to be asked, such as how data is used, stored and destroyed. That's where Johnston says the Canadian government needs to step in.

Alberta's Information and Privacy Commissioner Diana MacLeod says her agency considers the risks posed by a breach when reviewing data collection cases.

“You can't change your biometrics,” MacLeod said.

“[If] the information was stolen and somehow that fingerprint was copied and then it was used in your place for other types of biometric applications, leaving the person with no way to protect themselves.”

She argues that organisations can only collect personal data if there is a reasonable purpose for doing so and there must be consent.

The commissioner said she is developing recommendations and working with the Alberta government to protect data, such as biometrics, collected in the workplace.

“I would encourage people who are impacted by tools like this to actually file a complaint with our office because then that will give us the opportunity to make a decision and provide an interpretation that other organizations can consider,” MacLeod said.

Nancy Shapiro, a Toronto-based employment lawyer, says that at the moment, other than disclosing to employees what is being monitored, employees don't have many other rights.

There are no laws in Canada prohibiting the use of biometric data in the workplace, either in any province or at the federal level, she said.

“If you're not happy at work, you can always find a new job. Employees are really limited in their options — they just look for work elsewhere,” Shapiro said.

Moving forward

Johnston isn't just concerned about the current use of biometrics in the workplace. She's worried about what might happen next.

“The idea of ​​normalizing something like biometric data collection is very concerning because if we agree to allow that to enter the workplace, then what?” Johnston said.

“Will our computer start scanning our face to make sure we are the person sitting in front of our desk? … It's just a very slippery slope.”

Meanwhile, Thomson doesn't mind Charbar keeping her fingerprints on his file. In fact, she says there are some benefits to it.

This gives her confidence that no one else can start or finish the work for her.

She says we already use our faces and fingerprints to open our phones and pay for things. As far as she knows from her working life, biometrics is all she knows.

“I think there is a little bit of concern about identity theft, but because I'm 21 and I'm in this situation, it's not something that worries me too much, maybe just because I haven't been told about it,” Thomson said.

“As long as they don't start asking for blood samples, I think we'll be fine,” Thomson said.