FACIAL/FINGERPRINT RECOGNITION AND TIME REGISTRATION

The obligation to keep daily records of employees’ working hours has led to an increase in the number of specific solutions to ensure the recording of employees’ time and attendance. In the market, there are several systems that allow time recording, but currently there is an increase in the use of systems that collect biometric data from employees (fingerprint, facial recognition, among others).

Biometric systems for labor control are becoming more and more familiar to us, due to the fact that they make it possible to achieve greater reliability in order to avoid risks of identity theft linked to the control of absenteeism. However, the use of this type of systems entails great risks and obligations for companies.

Important aspect to bear in mind

Not all biometric systems necessarily involve special category data. In a time registration system using biometric data, we must differentiate between two concepts:

  • Biometric verification/authentication implies that the system used compares only the employee's data against those data that are stored associated with the claimed identity in that database (one-to-one).

  • - Biometric identification implies that the system used performs a specific technical processing that compares the data of a specific person with the data of each of the individuals in a group (one-to-many).

Why is this differentiation important?

It is because we are obliged to keep and maintain a time record, but not to use special category data for this purpose. The biometric data will be considered special category data if the verification is carried out using the ONE-MANY type, but it will be considered “basic” data if the verification is carried out using the ONE-ONE system.

The use of these technologies entails a significant intrusion in the workers’ sphere, there are sanctions imposed by the supervisory authorities of up to 20,000 euros for the processing of biometric data that they have considered as invasive.

Any time registration system that processes this type of data must undergo a rigorous evaluation prior to the start of processing, requiring a legal-technical analysis to clarify whether the system is suitable for the purpose we need as a company.

So I can't use a time registration system that processes biometric data?

It is possible to use this type of system, but with attention to the recommendations established by the supervisory authority:

  • The system must obtain a biometric fingerprint pattern that is encrypted and stored on a smart card guarded exclusively by the employee himself, combining the reading of the fingerprint after the approach of the smart card to a reader.

  • That it is a type of system based on one-to-one biometric authentication, so that biometric data are not used as special categories of data.

It is undoubtedly the case that the work time registration implies a mandatory processing for any employer. In order to process the data in these records in accordance with data protection regulations, the solution to be implemented must be carefully evaluated, taking into account the indications of the supervisory authorities and the applicable regulations, so as to provide adequate guarantees for the rights of workers.

Caberseg can help you in the process of selecting a suitable service provider that offers a solution that really complies with the regulations.

Contact Us