Connecticut Workplace Clinic Biometric Privacy Rules: What Employers Need to Know

Connecticut employers that operate or partner with workplace clinics increasingly rely on biometric identifiers to authenticate patients, secure medication rooms, or control access to clinical systems. Under the CTDPA and Public Act 26-64, these uses trigger specific duties around opt-in consent, notice, and governance, with Connecticut Attorney General enforcement and potential civil penalties for violations. This guide explains what counts as biometric data, when consent is required, key exemptions for employee data, and the newest 2026 updates affecting facial recognition and other sensitive data.

Biometric Data Definition and Scope

What counts as biometric data in Connecticut

Connecticut law defines biometric data as information generated by automatic measurements of an individual’s biological characteristics—such as a fingerprint, voiceprint, or retina/iris pattern—used to identify a specific person. Digital or physical photographs and routine audio or video recordings are excluded unless they are processed to identify someone. In practice, that means finger-scan time clocks, palm or vein scans, voiceprint authentication, and facial geometry used to uniquely identify a person fall within scope. ([prdext2.cga.ct.gov](https://prdext2.cga.ct.gov/2026/act/pa/pdf/2026PA-00064-R00SB-00004-PA.pdf))

When workplace clinic biometrics fall under CTDPA

CTDPA primarily protects consumers, not individuals acting in an employment context. If a clinic’s biometric data are collected and used solely within an employee’s role (for example, a nurse’s fingerprint to unlock a medicine cabinet), those records are generally outside CTDPA’s consumer scope. By contrast, if the clinic serves non-employee patients (e.g., dependents or members of the public) and uses biometrics to identify them, the CTDPA’s requirements apply. ([prdext2.cga.ct.gov](https://prdext2.cga.ct.gov/2026/act/pa/pdf/2026PA-00064-R00SB-00004-PA.pdf))

HIPAA and other health-data carveouts

Protected health information processed by covered entities or business associates under HIPAA is expressly exempt from CTDPA. Many onsite or affiliated clinics qualify, which means biometric data handled as PHI will follow HIPAA rather than CTDPA. However, the exemption is contextual: data are exempt only to the extent they are processed under HIPAA; other uses outside that setting may still be subject to CTDPA. ([cga.ct.gov](https://www.cga.ct.gov/2026/sup/chap_743jj.htm?utm_source=openai))

Consent Requirements for Employers

Opt-in consent for biometric data

Under the CTDPA, biometric data are “sensitive data.” Controllers may not process sensitive data without the consumer’s opt-in consent. “Consent” must be a clear, affirmative act—no pre-checked boxes, bundled terms, or dark patterns—and controllers must provide an easy way to revoke consent. If consent is withdrawn, processing must cease as soon as practicable and no later than 15 days after the request. ([prdext3.cga.ct.gov](https://prdext3.cga.ct.gov/current/pub/chap_743jj.htm?utm_source=openai))

Purpose specification and reuse limits

Connecticut requires you to limit collection to what is reasonably necessary for the stated purpose and to obtain fresh consent before reusing data for a new purpose that is neither necessary nor compatible with the original one. For clinics, that means you should not repurpose biometric identifiers collected for secure dispensing to support marketing, analytics, or unrelated access control without new opt-in consent. ([prdext2.cga.ct.gov](https://prdext2.cga.ct.gov/2026/act/pa/pdf/2026PA-00064-R00SB-00004-PA.pdf))

Special rules for minors

If your workplace clinic serves minors (e.g., employee dependents), biometric processing must follow COPPA’s parental consent framework when the controller has actual knowledge (or willfully disregards) that the consumer is a child. ([prdext3.cga.ct.gov](https://prdext3.cga.ct.gov/current/pub/chap_743jj.htm?utm_source=openai))

Exemptions for Employee Data

Employment-context exemption

CTDPA excludes individuals acting in an employment context from the definition of “consumer,” and it exempts data processed or maintained in the course of an individual applying to, employed by, or acting as a contractor or agent—so long as the data are collected and used within that role. In practical terms, an employee’s fingerprint used for timekeeping or to access a secure medication room is typically outside CTDPA. ([prdext2.cga.ct.gov](https://prdext2.cga.ct.gov/2026/act/pa/pdf/2026PA-00064-R00SB-00004-PA.pdf))

HIPAA/PHI exemption

PHI handled by a HIPAA covered entity or business associate is exempt from CTDPA. If your onsite clinic is a covered provider or its vendor is a HIPAA business associate, biometric identifiers used as PHI (for authentication or patient matching) fall under HIPAA’s privacy and security rules instead of CTDPA. ([cga.ct.gov](https://www.cga.ct.gov/2026/sup/chap_743jj.htm?utm_source=openai))

Edge cases to watch

• Dual-use systems: If the same facial recognition system authenticates both employees and non-employee patients or visitors, the non-employee uses are subject to CTDPA (including opt-in consent and related disclosures). ([prdext2.cga.ct.gov](https://prdext2.cga.ct.gov/2026/act/pa/pdf/2026PA-00064-R00SB-00004-PA.pdf))
• Breach duties: Separate from CTDPA, Connecticut’s breach-notification law includes “biometric information” in its definition of personal information, triggering notice obligations if compromised. ([cga.ct.gov](https://cga.ct.gov/current/pub/chap_669.htm?utm_source=openai))

Enforcement and Penalties

Connecticut Attorney General enforcement

The Connecticut Attorney General has exclusive authority to enforce the CTDPA; there is no private right of action. Violations are treated as unfair trade practices under state law. ([portal.ct.gov](https://portal.ct.gov/ag/sections/privacy/the-connecticut-data-privacy-act?utm_source=openai))

Civil penalties and other remedies

Civil penalties for willful violations under Connecticut’s Unfair Trade Practices Act can reach up to $5,000 per violation, and courts may grant injunctive relief and other remedies. For certain specialized provisions (e.g., data broker registration under Public Act 26-64), additional per-day penalties may apply. ([prdext3.cga.ct.gov](https://prdext3.cga.ct.gov/current/pub/chap_735a.htm?utm_source=openai))

Cure period: past and present

Connecticut’s mandatory 60-day cure period ended on December 31, 2024. Since January 1, 2025, any opportunity to cure is discretionary and assessed against factors such as violation count, organizational size, likelihood of public injury, and data sensitivity. ([law.justia.com](https://law.justia.com/codes/connecticut/title-42/chapter-743jj/section-42-525/?utm_source=openai))

Recent Legislative Amendments

Public Act 26-64 at a glance (effective October 1, 2026)

Public Act 26-64 amends the CTDPA and related statutes, adding definitions (including “facial recognition technology”), updating key terms (“publicly available information”), prohibiting the sale of precise geolocation data, and creating new obligations for certain technologies. Employers should prepare now, as these changes take effect on October 1, 2026. ([prdext2.cga.ct.gov](https://prdext2.cga.ct.gov/2026/act/pa/pdf/2026PA-00064-R00SB-00004-PA.pdf))

Sensitive data expansion

The act broadens “sensitive data” to include consumer health data, neural data, certain financial account credentials, and specified government IDs (when not required to be publicly displayed), alongside genetic and biometric data. This expansion raises the bar for opt-in consent and safeguards around high-risk processing. ([prdext2.cga.ct.gov](https://prdext2.cga.ct.gov/2026/act/pa/pdf/2026PA-00064-R00SB-00004-PA.pdf))

Geolocation and reuse restrictions

Public Act 26-64 prohibits controllers and third parties from selling precise geolocation data. It also tightens purpose-limitation rules, reinforcing that new processing purposes generally require fresh consent. ([prdext2.cga.ct.gov](https://prdext2.cga.ct.gov/2026/act/pa/pdf/2026PA-00064-R00SB-00004-PA.pdf))

Direct-to-consumer genetic data

The law grants consumers property and control rights in their biological samples and imposes express-consent and transparency duties on direct-to-consumer genetic testing companies—relevant if your clinic offers or partners in such services outside the HIPAA context. ([prdext2.cga.ct.gov](https://prdext2.cga.ct.gov/2026/act/pa/pdf/2026PA-00064-R00SB-00004-PA.pdf))

Facial Recognition Technology Regulation

Definition and covered uses

“Facial recognition technology” means technology that analyzes facial features in still images or video to uniquely and personally identify a specific individual. When used on premises to prevent, detect, or respond to security incidents and similar risks, the law imposes specific operational requirements. ([prdext2.cga.ct.gov](https://prdext2.cga.ct.gov/2026/act/pa/pdf/2026PA-00064-R00SB-00004-PA.pdf))

On-premises conditions and signage

If you use facial recognition on premises for security or related protective purposes, you must: (1) match images only against a database you exclusively maintain, and (2) post legible signage at each public entrance alerting consumers that facial recognition is in use and providing a hyperlink or QR code to your facial recognition policy, which must include the Attorney General’s contact information. ([prdext2.cga.ct.gov](https://prdext2.cga.ct.gov/2026/act/pa/pdf/2026PA-00064-R00SB-00004-PA.pdf))

Employee-only entrances

The signage requirement excludes entrances to areas restricted to authorized employees; however, if patients or visitors enter through other doors, those entrances require signage and an accessible policy. Plan for clinic lobbies or pharmacy counters that are open to the public. ([prdext2.cga.ct.gov](https://prdext2.cga.ct.gov/2026/act/pa/pdf/2026PA-00064-R00SB-00004-PA.pdf))

Compliance Best Practices for Employers

• Map uses of biometric identifiers across your workplace clinic and facilities. Classify each flow as HIPAA/PHI, employment-context data, or CTDPA-covered consumer data.
• When CTDPA applies, implement opt-in consent for biometric processing, present plain-language purposes, retention, sharing, and revocation rights, and honor revocations within 15 days.
• Limit collection to what is necessary; obtain new consent before reusing data for materially new purposes; do not sell sensitive data without consent.
• If using facial recognition in consumer-accessible areas, confine matching to your own database, post entrance signage, and publish an FRT policy that includes the Connecticut Attorney General enforcement contact.
• Harden security controls, segregate PHI from non-PHI, and configure vendor contracts with processors to include confidentiality, deletion/return, audit cooperation, and subcontractor flow-downs.
• Conduct and document data protection assessments before launching high-risk processing (e.g., sensitive biometric or facial recognition uses) and retain the analyses for Attorney General review if requested.
• Maintain an incident response plan aligned to Connecticut’s breach law, which treats biometric information as personal information for notification purposes.

Key takeaways

Biometric privacy in Connecticut turns on context: HIPAA-governed PHI and employment-context data are largely exempt from CTDPA, but consumer-facing clinic operations must meet opt-in consent, purpose limits, and new facial recognition rules under Public Act 26-64. Proactive consent design, tight vendor governance, and entrance signage where required will significantly reduce enforcement risk and civil penalties.

FAQs

What biometric data is protected under Connecticut law?

Biometric data includes information generated by automatic measurements of biological characteristics—like fingerprints, voiceprints, or retina/iris patterns—used to identify a specific individual. Photos and routine audio/video are excluded unless processed to identify someone. ([prdext2.cga.ct.gov](https://prdext2.cga.ct.gov/2026/act/pa/pdf/2026PA-00064-R00SB-00004-PA.pdf))

How must employers obtain consent for biometric data collection?

When CTDPA applies, you must obtain opt-in consent through a clear, affirmative act (no dark patterns or bundled terms), provide an easy way to revoke consent, and stop processing within 15 days of revocation. New, incompatible purposes require new consent. ([prdext3.cga.ct.gov](https://prdext3.cga.ct.gov/current/pub/chap_743jj.htm?utm_source=openai))

Are employee biometric data exempt from the CTDPA?

Generally yes. “Consumer” excludes individuals acting in an employment context, and CTDPA exempts data processed or maintained in the course of employment, provided the data are collected and used within that role. PHI processed under HIPAA is also exempt. ([prdext2.cga.ct.gov](https://prdext2.cga.ct.gov/2026/act/pa/pdf/2026PA-00064-R00SB-00004-PA.pdf))

What penalties apply for noncompliance with biometric privacy rules?

The Connecticut Attorney General has exclusive enforcement authority; there is no private right of action. Willful violations can draw civil penalties of up to $5,000 per violation, along with injunctive relief and other remedies under Connecticut’s Unfair Trade Practices Act. ([portal.ct.gov](https://portal.ct.gov/ag/sections/privacy/the-connecticut-data-privacy-act?utm_source=openai))