To Consent Or Not To Consent? Fingerprint Clocking-In At Work

Companies that deploy security systems which require employee biometric data, such as fingerprints, to validate and record access to restricted areas must consider how they will process this data in order to be compliant with the GDPR when it comes into force in May 2018.

In order to be legally compliant with data protection law, an employer must have a "lawful basis" or justifiable reason to process an employee's personal data. As required under the current data protection regime, and in the GDPR, these reasons could include:

• employee consent
• where the processing is necessary for the performance of a contract to which the data subject has agreed to
• for compliance with an employer's legal obligation