Biometric Data Policy Statement

Effective October 26, 2026

 

1. Purpose

Employers Mutual Casualty Company ("EMC") has established this Biometric Data Policy Statement (this "Policy") as EMC's statement of policy regarding Biometric Data, including Biometric Identifiers and Biometric Information.

 

This policy governs the treatment of Biometric Data of our policyholders, claimants, employees, employment applicants, and other individuals that interact with EMC. Protecting the confidentiality and integrity of Biometric Data is a critical responsibility that must be taken seriously at all times. Compliance with this Policy is mandatory. 

2. Scope

This Policy applies to all Biometric Data collected, captured, maintained, transmitted, stored, retained, processed, or otherwise used by EMC regardless of the media on which that information is stored or what categories of individuals to whom it relates.

3. Definitions

"Biometric Data" means collectively all Biometric Identifiers and Biometric Information. 

"Biometric Identifiers" means retina or iris scans, fingerprints, voiceprints, or scans of hand or face geometry.

Biometric Identifiers do not include:

  • Writing samples and written signatures.
  • Photographs.
  • Human biological samples used for valid scientific testing or screening.
  • Demographic data.
  • Tattoo descriptions.
  • Physical descriptions, such as height, weight, hair color, or eye color.
  • Information captured from a patient in a healthcare setting.
  • Information collected, used, or stored for healthcare treatment, payment, or operations under the Health Insurance Portability and Accountability Act (HIPAA).
  • Donated organs, tissues, or parts as defined by the Illinois Anatomical Gift Act or blood or serum stored in connection with organ transplants.
  • Biological materials regulated under the federal Genetic Information Privacy Act.

"Biometric Information" means information, regardless of how it is captured, converted, stored, or shared, that is based on a Biometric Identifier. Biometric Data does not include information derived from items or procedures excluded under the definition of Biometric Identifiers.

4. Retention Schedule

In circumstances when Biometric Data is retained after the conclusion of the identity verification or authentication process, EMC and its third-party service providers will permanently destroy an individual's Biometric Data when the initial purpose for collecting or obtaining such Biometric Data.

 

Initial purposes for collection end for the following processes as stated below.

  • Background screening: 
    • Declined employment applicant: One month after the individual's application for employment is declined
    • Hired employment applicant: Six months after the individual has been hired
  • System authentication: When EMC receives the returned device, or 21 days after end of employment or engagement, whichever is sooner

5. Biometric Data Collection

EMC and its third-party service providers collect, store, and use facial scans for the purposes of identity verification or authentication and fraud detection. Before collecting Biometric Data from any individual, EMC will obtain the individual's written consent to the collection.

6. Biometric Data Security

EMC and its third-party service providers shall use a reasonable standard of care to store, transmit, and protect paper and electronic Biometric Data from unauthorized access, acquisition, use, disclosure, alteration, loss, or destruction. Safeguards shall be appropriate to the sensitivity of the Biometric Data and shall be at least as protective as those used for other confidential and sensitive information maintained by EMC. 

7. Biometric Data Disclosures

Subject to individual consent, EMC may disclose an individual's Biometric Data to its third-party service providers to facilitate identity verification, including background checks, system authentication, and document transactions.

 

EMC restricts disclosure or re-disclosure of Biometric Data unless:

  • The individual or the individual's legally authorized representative consents to the disclosure;
  • The disclosure is required by applicable law or regulation; or
  • The disclosure is required pursuant to a valid warrant or subpoena issued by a court of competent jurisdiction.

EMC does not sell, lease, trade, or otherwise profit from Biometric Data.

 

Effective 10/26/26