School Fingerprinting: Pending Technician, Shared Drive, and Parent Access
A licensed fingerprint vendor in Sangamon County contracts with a small private school to fingerprint 18 job applicants for background checks. The school wants the vendor to send electronic images directly to the school’s HR shared drive, keep paper cards in a storage unit for five years, and provide copies to a parent volunteer who chairs the hiring committee. The vendor’s live-scan device stores images locally for 30 days by default; the vendor’s license is current, but the technician who will operate the device completed training two weeks ago and her employee registration is pending. The school says it will pay extra for same-day results. The vendor asks you whether it can use the device under the owner’s registration and whether the retention plan is acceptable.
1. Can the technician operate the live-scan device under the owner’s license or registration while her employee registration is pending? What should the vendor do?
Read the worked answer
No. The license and any employee registration are personal credentials; an owner cannot lend them to an unregistered technician, and “using the device under the owner’s registration” would misrepresent who performed the fingerprinting. Under the Act, the vendor agency must operate through properly licensed or registered personnel, and the pending application means the technician is not yet authorized to perform the regulated work for compensation.
The vendor should assign a currently registered technician to the school job, or delay the work until the new technician’s registration issues. The owner may train, supervise, and handle administrative tasks that do not require the credential, but should not let the unregistered technician operate the live-scan for the school. The vendor should also check with IDFPR and counsel on any temporary-training exception before acting; do not assume one.
2. Evaluate the proposed handling of fingerprint images and cards: HR shared drive, five-year storage, and parent-volunteer access.
Read the worked answer
The plan is not acceptable as described. Fingerprint images are biometric identifiers and, in a school employment context, are tied to criminal-history information; they require strict handling. Sending images to a general HR shared drive broadens access beyond authorized personnel and is a confidentiality and security risk. A parent volunteer on a hiring committee is not an authorized recipient for fingerprint images or criminal-history results; release should be limited to the school’s designated authorized official and to the ISP, FBI, or other agency as the law and contract require.
Paper cards should be in a locked, access-controlled location with a log, not a general storage unit. Five years is not a default: retain only as long as the contract and applicable law require, then destroy under a documented schedule. The vendor should also address biometric-privacy written notices and consents, a retention and destruction policy, encryption, breach notification, and secure transmission. Same-day results cannot be promised because ISP and FBI processing time is outside the vendor’s control.
3. What should the vendor tell the school, and what contract and records provisions should be added?
Read the worked answer
Tell the school in writing: the pending technician cannot operate the device yet; the vendor will staff the job with a registered technician or reschedule; images will go through an encrypted portal to a named authorized school official, not a shared drive; the parent volunteer will receive only the information the school is legally permitted to share, not fingerprint images; retention will follow a written schedule and destruction certificate; and same-day results are not guaranteed.
The contract should add scope, authorized recipients, data-security standards, retention and destruction, breach notice, consent responsibilities, indemnification, and fee adjustments for rescheduling. Keep an access log, transmission log, and destruction log. If the school insists on parent-volunteer access or indefinite storage, decline that part and document the refusal.