This article was published in 2020. Laws, case law and regulatory guidance may have changed since then. Contact us for up to date advice.
Introduction
The Dutch Data Protection Authority (AP) has fined a company for processing fingerprints without the consent of its employees. This was decided following earlier complaints from employees. Employees of the company had to have their fingerprints scanned for attendance and time registration. This is contrary to the privacy rules, the AP made clear after its investigation.
In this case, following an investigation (PDF), the AP concluded that the company had no right to process its employees’ fingerprints. The company could not rely on any exemption for the processing of special categories of personal data. Fingerprints are classified as special categories of personal data. The company therefore receives a fine of 725,000 euros.
Fingerprints are special categories of personal data
Biometric data, such as a fingerprint, are special categories of personal data. The GDPR defines biometric data as “personal data resulting from specific technical processing relating to the physical, physiological or behavioural characteristics of a natural person, which allow or confirm the unique identification of that natural person, such as facial images or dactyloscopic data.” An organisation may not use special categories of personal data unless the law provides an exemption for doing so.
Using fingerprints as a means of identification: is it allowed or not?
In principle, there is a general prohibition on the processing of special categories of personal data. This therefore also applies to the processing of biometric data for the purpose of identifying a person. This is because in many cases it concerns highly sensitive information, and a potential data breach entails major risks.
Exemptions to the prohibition on processing fingerprints
There are exemptions to the general prohibition which, under certain circumstances, still make it possible to process biometric data. For example, processing fingerprints is permitted where the data subject has given explicit consent, or for the vital interest of the organisation.
The Dutch GDPR Implementation Act (UAVG) adds a third element. Namely, that the prohibition on processing biometric data does not apply where this “takes place for the purpose of identifying the data subject and only insofar as this purpose is necessary and proportionate for the protection of the legitimate interests of the controller or a third party”.
The AP concluded that this company cannot rely on any exemption for processing its employees’ fingerprints.
Consent as a suitable means?
The privacy legislation imposes strict requirements on asking for explicit consent. Consent must be unambiguous, specific, informed and freely given.
Does an employer ask employees for consent to process their fingerprints? In principle, this is not allowed. Employees are dependent on their employer and are therefore often not in a position to refuse.
This company did not demonstrate that the employees had given explicit consent. Moreover, employees experienced the recording of their fingerprints as an obligation.
How to avoid fines and comply with the privacy rules
Do you want to process personal data for your business operations without any worries? Then you need to weigh up the interests involved. That way you will know whether you are allowed to process certain personal data. A privacy baseline assessment can help you with this. In some cases you are required to carry out a Data Protection Impact Assessment (DPIA). This is a tool for mapping out in detail the risks that processing special categories of data entails.
Do you have questions about processing special categories of personal data? Do you want to process personal data without any worries? Contact us for an introductory meeting. This can also take place online.