Biometric data refers to personal data resulting from specific technical processing relating to the physical, physiological, or behavioural characteristics of a natural person, allowing or confirming their unique identification.
An example of biometric data is a fingerprint, provided the controller is able to link it to a specific individual – i.e., has access to the appropriate technology, such as a fingerprint scanner. Biometric data is classified as a special category of personal data (sensitive data) and is subject to enhanced protection. Its processing must have a clear legal basis.
On 11 May of this year, the President of the Polish Data Protection Authority (UODO) issued a clear position stating that employers may not process employees’ biometric data for the purpose of recording working time. According to UODO, the provisions of Polish labour law do not provide a legal basis for such processing.
Pursuant to Article 221b of the Labour Code, an employer may process biometric data:
- with the employee’s consent, but only when the data is provided on the employee’s own initiative;
- when such data is necessary for access control to particularly sensitive information, the disclosure of which could harm the employer, or for access to secure areas requiring special protection.
Since recording working time does not fall within these categories, such processing is deemed incompatible with the GDPR.
Important Note: Employee Consent Is Not a Sufficient Legal Basis
As highlighted by UODO:
- Consent should not be relied upon as a legal basis for processing personal data in the context of the employer–employee relationship, as it may not be considered freely given due to the power imbalance.
- Additionally, processing of sensitive data on the basis of consent is only permissible if the consent is given on the employee’s own initiative. However, the implementation of a biometric timekeeping system is a top-down decision made by the employer, not the employee.
Which Tools Can Employers Use Instead?
Employers may choose from alternative tools such as:
- paper-based attendance lists,
- magnetic access cards, or
- dedicated computer software and applications.