Biometric data relates to access control, for example, through fingerprints or facial recognition. We receive many inquiries about processing biometric data, and here we’ll try to explain why we at SmartTID do not use it—even though it is technologically possible.

Under the General Data Protection Regulation (GDPR), the processing of biometric data falls under Article 9 of the GDPR, which pertains to sensitive personal data. Therefore, there must be a legal basis (Article 9(2)(f) of the GDPR) for this type of processing of employee data.

With reference to a case that was brought before the Data Protection Council back in 2019, it has been established that employees’ arrival and departure times are not considered a valid legal claim when the processing is carried out as part of monitoring an employee’s working hours, as the requirement of necessity under the provision has not been met.

The necessity requirement refers to “the least possible intrusion,” and it is possible to monitor an employee’s working hours with less intrusion than is required when using biometric data.

Can consent solve the problem?

The Danish Data Protection Agency does not consider consent to be a valid basis for an employer to process employees’ fingerprint data in connection with time tracking, as consent cannot, in principle, be considered to have been given voluntarily and thus cannot constitute a valid basis for processing.

Among other things, the arguments center on the fact that there is an unequal balance of power between the employee and the employer, which essentially means that an employee may have too much at stake to refuse to give consent.

Read more about the case on the Danish Data Protection Agency's websitehere