When Ellie Thomson comes to work, she doesn’t punch a physical time clock or check in on an app. Instead, she scans her finger.

“When I saw everyone else doing it, it just seemed right to me and there were no problems with it,” Thomson said. Cost of living.

Thomson is a 21-year-old waitress and bartender at Charbar in Calgary. She is one of many employees who now use biometric technology, such as fingerprints, to clock in and out, and their numbers are growing.

Biometrics is already a billion-dollar industry. According to a report by market research firm IMARC Group, the global biometrics market will reach $39 billion in 2023.

And while Thomson isn’t worried that Charbar has her fingerprint, privacy experts are raising concerns about this trend.

Why this change?

According to Hannah Johnston, who specializes in the digitization of work and teaches human resource management at York University in Toronto, employers have begun using biometrics in the workplace for several reasons.

She says employers argue that it’s more convenient because people usually don’t forget their finger or thumb at home, like they can with a swipe card. She also says employees have started using fingerprint scans for the time clock because they say it’s more accurate.

They want to know exactly when someone is punching and be sure that no one else is doing it for them.

But not everyone is on board.

Jeff Bromley, chair of the Wood Council of United Steelworkers Canada, says when fingerprint time clocks were introduced at Canfor’s Plateau Sawmill in Vanderhoof, BC, in 2022, there was an uproar from the workforce.

“They were extremely angry,” Bromley said. “Ultimately, they had no choice but to find another job or get fired.”

Around 100 employees had filed a lawsuit against the company over the use of biometric data, claiming that the company had unjustly invaded their privacy. The union also filed a complaint, but an arbitrator sided with the company.

Bromley says some people have left the company because of this and others have been fired because they refused to participate. CBC asked Canfor for an interview, but the company declined.

These security concerns are justified, says Urs Hengartner. Hengartner teaches computer science at the University of Waterloo and specializes in data protection.

He says that scanning fingerprints creates a virtual copy, called a template, and while it is not an exact copy of a fingerprint, it is still a fairly close copy.

“A lot of research has shown that with this template, it is possible to reconstruct a fingerprint,” he said. “Maybe not your exact fingerprint, but a fingerprint that allows the hacker to log in as you.”

“This is a problem from a data protection perspective, but also from a security perspective.”

Raise concerns

According to Johnston, there is no easy way for employees to opt out of many of these types of biometric time tracking if they are not comfortable with it.

“One of the reasons the use of biometric data in such forums is so concerning is that it is highly sensitive and personalized,” Johnston said.

“If the goal of this type of system is to monitor work time, I would argue that there are many ways to do this type of exercise in a less invasive way.”

She believes critical questions need to be asked, such as how the data is used, stored and disposed of. This is where the Canadian government needs to intervene, says Johnston.

Diane McLeod, Alberta’s information and privacy commissioner, says when analyzing cases involving data collection, her office considers the risks involved in the event of a breach.

“You can’t change your biometric data,” McLeod said.

“If the information was stolen and that fingerprint was somehow reproduced and then used to act as your name in other biometric applications, then the person has no recourse against it.”

In their view, organizations should only collect personal data if there is a reasonable purpose for doing so and consent has been obtained.

The commissioner says she is developing recommendations and engaging with the Alberta government to protect data collected in the workplace, such as biometric data.

“I would encourage people who are faced with such remedies to complain to our office because then we have the opportunity to make a decision and publish an interpretation that other organizations can consider,” McLeod said.

According to Nancy Shapiro, a Toronto-based employment lawyer, workers currently do not have many rights other than the obligation to tell them what is being monitored.

According to her, there are no provincial or federal laws in Canada that prohibit the use of biometric data in the workplace.

“If you are unhappy with anything at your job, you are always free to look for a new job. But the power of workers is limited to that – they can simply look for work somewhere else,” Shapiro said.

outlook

Johnston is not only concerned about the current use of biometrics in the workplace. She is also worried about what might happen next.

“The idea of ​​normalizing something like biometric data collection is very disturbing. Because what happens if we are OK with allowing something like this in the workplace?” Johnston said.

“Will our computer start scanning our face to make sure we are actually sitting in front of our workstation? … That’s a pretty sensitive issue.”

Thomson now agrees that Charbar has her fingerprint on his files. She even says that it has some advantages.

This gives her the assurance that no one else can clock in or out for her.

She says we already use our faces and fingerprints to open our phones and pay for things. In her professional life, she only knows biometrics.

“I guess there is some concern about identity theft, but as a 21-year-old in my situation, I’m not too worried about it, probably just because I’ve never been asked about it,” Thomson said.

“Until they start requesting blood samples, I think it will be fine,” Thomson said.