The obligation to keep daily records of employees’ working hours has led to an increase in the number of specific solutions to ensure the recording of employees’ time and attendance. In the market, there are several systems that allow time recording, but currently there is an increase in the use of systems that collect biometric data from employees (fingerprint, facial recognition, among others).

Biometric systems for labor control are becoming more and more familiar to us, due to the fact that they make it possible to achieve greater reliability in order to avoid risks of identity theft linked to the control of absenteeism. However, the use of this type of systems entails great risks and obligations for companies.

Important aspect to bear in mind

Not all biometric systems necessarily involve special category data. In a time registration system using biometric data, we must differentiate between two concepts:

Why is this differentiation important?

It is because we are obliged to keep and maintain a time record, but not to use special category data for this purpose. The biometric data will be considered special category data if the verification is carried out using the ONE-MANY type, but it will be considered “basic” data if the verification is carried out using the ONE-ONE system.

The use of these technologies entails a significant intrusion in the workers’ sphere, there are sanctions imposed by the supervisory authorities of up to 20,000 euros for the processing of biometric data that they have considered as invasive.

Any time registration system that processes this type of data must undergo a rigorous evaluation prior to the start of processing, requiring a legal-technical analysis to clarify whether the system is suitable for the purpose we need as a company.

So I can't use a time registration system that processes biometric data?

It is possible to use this type of system, but with attention to the recommendations established by the supervisory authority:

It is undoubtedly the case that the work time registration implies a mandatory processing for any employer. In order to process the data in these records in accordance with data protection regulations, the solution to be implemented must be carefully evaluated, taking into account the indications of the supervisory authorities and the applicable regulations, so as to provide adequate guarantees for the rights of workers.

Caberseg can help you in the process of selecting a suitable service provider that offers a solution that really complies with the regulations.