Data Protection Commission Finds Prison Security System In Breach Of GDPR

The Data Protection Commission has found a security system used in Irish prisons to be in breach of the General Data Protection Regulation (GDPR) after investigating a complaint by a prison officer (the Complainant).  The security system involves scanning prison officers' thumbprints in order to admit them through security gates.

The Complainant worked in Castlerea prison and initially complained about the system to prison management and to his union, the Prison Officers Association, in early 2019, on the basis that the system contravened the GDPR.  "Dactyloscopic data", meaning data relating to identification by comparison of fingerprints, is specifically referred to in the GDPR as an example of biometric data, being "personal data resulting from specific technical processing relating to the physical, physiological or behavioural characteristics of a natural person, which allow or confirm the unique identification of that natural person."