Biometric information collected from employees (such as fingerprints for timekeeping) is primarily regulated by: