General principle: the processing of biometric data is against the law
Some companies use a time recording system to keep a closer eye on their employees’ attendance. In some cases, a time recording system is actually mandatory, for example where flexitime schedules are used.
There are various ways to record hours worked, such as time clocks or badges. Evolving technology means that there are now also systems that work on the basis of employees’ fingerprints. Fingerprints are classified as biometric – and therefore highly sensitive – data. Their processing is in principle prohibited under GDPR other than in specific circumstances.
Explicit consent as an exception – its application in the employment relationship
One of the exceptional cases where the processing of personal data is permitted is where there is explicit consent from the data subject. This consent must be valid, meaning that it must be given freely, specifically, on an informed basis and unambiguously.
We can explain this by looking at a decision by the Dispute Resolution Chamber of the Belgian Data Protection Authority (DPA[1]) on the validity of an employee’s consent concerning the use of a time recording system based on fingerprints.
This was the only time recording system present at the company in question. On joining the company, employees received a welcome brochure and the employment regulations in which the use of a fingerprint-based time recording system was mentioned. These documents were simply signed in confirmation of receipt.
A few years after the system’s introduction, a former employee filed a complaint on the grounds that his employer had processed his fingerprints without his free consent and he had been unaware of the storage arrangements and retention period for his biometric data.
Free consent
In an employment relationship it can be difficult to ensure that consent is given ‘freely’, partly because of the relationship of authority that exists between employer and employee. If the power imbalance in the work context makes it unlikely that an employee can refuse consent to the processing of such data without fear of adverse consequences, consent cannot be freely given.
The DPA again clarified that this does not mean that the exception of consent can never be relied on in an employment relationship, but the employer will have to demonstrate that the employee really does have a free choice. This can be done, for example, by providing an alternative time recording method (such as the use of a badge or code instead of just the fingerprint system).
In the case under consideration, the employer had not provided an alternative time recording method, which meant that the employees did not have a free choice. In addition, pay was calculated on the basis of the recorded hours, and the employment regulations provided for penalties if the recorded hours showed a shortfall. Clearly, an employee would not feel emboldened to refuse consent, given the serious negative consequences this might have.
Specific consent
The consent given must be specific. This means that it is given specifically for the processing of personal data for a particular purpose and that the personal data may not be processed for any other purpose.
Informed consent
The DPA made it clear in its decision that consent must also be ‘informed’. Merely mentioning such a system in a welcome brochure or the employment regulations (signed by the employees in confirmation of receipt rather than agreement) is not enough. The employees must understand what they are giving their consent to.
Obviously, the information that is provided must therefore be formulated clearly and in language that is easy to understand. Complete transparency is required about how the system works, who processes the data, how long it is stored for, where it is stored, and so on.
It is advisable not to present fingerprint scans as the ‘preferred alternative’ in the information document (or to describe the alternative systems such as a badge or code in unnecessarily negative terms). If this is done, the impression will be created that employees do not actually have a free choice.
Unambiguous consent
Finally, consent cannot simply be inferred from a failure to object to such a system: the employee must take some active step to give his or her consent. Merely signing to confirm receipt of the welcome brochure or the employment regulations is not sufficient. Consent must therefore be given explicitly in a written document (such as a separate annex to the employment contract or a box on an electronic platform that has to be ticked to indicate confirmation).
Withdrawal of consent
An employee who has given consent to the processing of biometric data can withdraw such consent at any time. At that point, any processing of this data must be stopped immediately.
Other data protection principles
In addition, it should not be overlooked that other data protection principles also apply:
- Purpose limitation: Data must be collected for specific, explicit and legitimate purposes.
- Proportionality: Data processing must be appropriate, necessary and not excessive for the achievement of the purposes. For example, the DPA ruled that the use of biometric data in the workplace is permitted if less far-reaching measures are not sufficient (e.g. as access control for certain locations for security reasons, such as a nuclear power station).
- Security: Appropriate technical and organisational measures must be taken to ensure a high level of security.
- Storage limitation: Data may not be stored any longer than is necessary for the purposes for which it is processed.
- Transparency: Employees must be properly informed about the processing of their data.
The DPA’s ruling
The investigation and analysis by the DPA showed that the processing of the biometric data was indeed unlawful and that, in addition, various principles had been breached, including purpose limitation and data minimisation. As a result, the employer was ordered to pay an administrative fine of 45,000 euros.
Conclusion
Companies must ensure that employees have a free choice when giving their consent to biometric time recording. This can be achieved by offering alternatives such as badges or access codes. In addition, it is crucial for employees to be clearly and comprehensively informed about the processing of their biometric data. Finally, biometric data must only be used for specific and necessary purposes, ensuring that processing is proportional. In practice, the use of consent as a legal basis in a relationship of authority between employer and employee will always require careful consideration.
[1] Decision on the merits 114/2024 of 6 September 2024 (NL/FR only) / English summary
