Using Fingerprints For Time Recording May Violate GDPR

In a recent decision, the Litigation Chamber of the Belgian Data Protection Authority (DPA) indicated that it is unlikely that valid consent to the processing of biometric data can be given in the context of an employment relationship.

The employee in this case was first employed as a temporary worker and then as an employee of the employer. The employer used a time recording system based on fingerprints. The provider of the system was a subsidiary of a group headquartered in Japan. The employee feared a violation of the GDPR, in particular because of the risk of data being transferred to a non-EU country where data protection rules are less stringent.

Processing of biometric data