{"id":1604,"date":"2026-10-01T10:28:32","date_gmt":"2026-10-01T08:28:32","guid":{"rendered":"https:\/\/avocatludusan.ro\/?p=1604"},"modified":"2026-10-01T10:40:13","modified_gmt":"2026-10-01T08:40:13","slug":"pontaj-amprenta-angajati-gdpr-anspdcp","status":"publish","type":"post","link":"https:\/\/avocatludusan.ro\/en\/pontaj-amprenta-angajati-gdpr-anspdcp\/","title":{"rendered":"Is Fingerprint-Based Time and Attendance Tracking of Employees Lawful? Biometric Data and the GDPR \u2013 an ANSPDCP Case Study"},"content":{"rendered":"
\n\t\t\t\t
\n\t\t\t\t\t
\n\t\t
\n\t\t\t\t
\n\t\t\t\t\t

Is Fingerprint-Based Time and Attendance Tracking of Employees Lawful? Biometric Data and the GDPR \u2013 an ANSPDCP Case Study<\/h1><\/div>\t\t\t\t<\/div>\n\t\t
\n\t\t\t\t
\n\t\t\t\t\t

01\/10\/2026<\/p><\/div>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t

\n\t\t\t\t\t
\n\t\t
\n\t\t\t\t
\n\t\t\t\t\t
\"\"<\/div><\/div>\t\t\t\t<\/div>\n\t\t
\n\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Biometric time and attendance systems for employees and the limits on the processing of biometric data<\/h2>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

The use of a fingerprint-based biometric time and attendance system<\/strong> is an increasingly common technical solution among organisations seeking to control access to their premises and to keep records of employees\u2019 working time.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t\t\t\t\t\t

From a data protection perspective, however, the question is not merely whether the technology is effective, but whether the processing of employees\u2019 fingerprints is lawful under the GDPR<\/strong>, whether there is an appropriate legal basis and, above all, whether the use of biometric data is necessary and proportionate.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t\t\t\t\t\t

A recent case examined by the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)<\/strong> is relevant in this respect. Following an investigation, the Authority found an infringement of Article 5(1)(c) in conjunction with Article 9 of Regulation (EU) 2016\/679 and imposed a fine of RON 26,236, the equivalent of EUR 5,000. The investigation concerned the use of employees\u2019 fingerprints for time recording and access control<\/strong>.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t\t\t\t\t\t

The case provides a useful starting point for analysing the obligations of an employer that intends to use biometric data in the workplace<\/strong>.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t\t\t\t\t\t

1. What is biometric data and why does it enjoy special protection?<\/h2>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Under Article 4(14) GDPR, biometric data means personal data resulting from specific technical processing relating to the physical, physiological or behavioural characteristics of a natural person, which allow or confirm the unique identification of that person.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t\t\t\t\t\t

A fingerprint is one of the forms of data that may fall within this category where it is processed for the purpose of identifying a person or verifying their identity.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t\t\t\t\t\t

It is subject to a special legal regime.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t\t\t\t\t\t

Article 9(1) GDPR lays down, as a general rule, a prohibition on processing biometric data for the purpose of uniquely identifying a natural person, unless one of the conditions set out in Article 9(2) applies.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t\t\t\t\t\t

Consequently, in the case of a fingerprint time and attendance system<\/strong>, the employer cannot rely solely on the fact that it wishes to verify employees\u2019 attendance.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t\t\t\t\t\t

A further assessment of the lawfulness of processing biometric data is required.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t\t\t\t\t\t

2. Fingerprint time recording and the GDPR: why a single legal basis is not enough<\/h2>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Where biometric data is concerned, the general conditions for lawful processing under Article 6 GDPR and the specific conditions under Article 9 GDPR must be assessed together.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t\t\t\t\t\t

Article 6 GDPR sets out the circumstances in which the processing of personal data is lawful, whereas Article 9 GDPR establishes an additional regime for special categories of personal data.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t\t\t\t\t\t

Accordingly, for a biometric time and attendance system for employees<\/strong>, the controller must be able to identify:<\/p>

  • the legal basis for the processing;<\/li>
  • the applicable special condition under Article 9(2) GDPR;<\/li>
  • the specific purpose of the processing;<\/li>
  • the necessity of using biometric data;<\/li>
  • the proportionality of the measure;<\/li>
  • whether or not less intrusive alternatives exist.<\/li><\/ul>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t
    \n\t\t\t\t\t\t\t\t\t

    The mere existence of a legitimate purpose, such as recording working time<\/strong> or controlling access to the employer\u2019s premises<\/strong>, does not in itself resolve the question of lawfulness.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

    \n\t\t\t\t\t\t\t\t\t

    3. The data minimisation principle \u2013 Article 5(1)(c) GDPR<\/h2>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t
    \n\t\t\t\t\t\t\t\t\t

    One of the central principles in assessing a fingerprint time and attendance system<\/strong> is the principle of data minimisation.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

    \n\t\t\t\t\t\t\t\t\t

    Article 5(1)(c) GDPR provides that personal data must be \u201cadequate, relevant and limited to what is necessary in relation to the purposes for which they are processed\u201d.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

    \n\t\t\t\t\t\t\t\t\t

    This principle is of particular importance where biometric data is concerned.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

    \n\t\t\t\t\t\t\t\t\t

    The fact that a biometric system is high-performing, fast or difficult to circumvent does not automatically mean that the processing of fingerprints is necessary.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

    \n\t\t\t\t\t\t\t\t\t

    The controller must assess whether the intended purpose can be achieved by means that entail a lesser interference with employees\u2019 private lives.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

    \n\t\t\t\t\t\t\t\t\t

    In the case of electronic time recording<\/strong>, consideration should be given, for example, to the use of:<\/p>

    • individual access cards;<\/li>
    • personal codes;<\/li>
    • time-recording software applications;<\/li>
    • other identification mechanisms that do not involve the processing of biometric data.<\/li><\/ul>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t
      \n\t\t\t\t\t\t\t\t\t

      The relevant question is therefore not merely \u201cIs fingerprint time recording effective?\u201d<\/strong> but rather \u201cIs the processing of fingerprints necessary to achieve the intended purpose?\u201d<\/strong><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

      \n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"\"\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t
      \n\t\t\t\t\t\t\t\t\t

      4. The existence of a less intrusive alternative<\/h2>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t
      \n\t\t\t\t\t\t\t\t\t

      This is one of the most important conclusions to be drawn from the case examined by the ANSPDCP.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

      \n\t\t\t\t\t\t\t\t\t

      According to the Authority\u2019s findings, the purposes pursued through the biometric system \u2013 access control and the recording of working time \u2013 could have been achieved by alternative means that are less intrusive to employees\u2019 privacy<\/strong>. Accordingly, the Authority ordered the biometric system to be replaced with an alternative solution capable of achieving the same purposes without processing biometric data.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

      \n\t\t\t\t\t\t\t\t\t

      This approach is relevant to any employer intending to introduce a biometric time and attendance system<\/strong>.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

      \n\t\t\t\t\t\t\t\t\t

      Before implementation, an assessment of the available alternatives should be documented. It is not sufficient for the employer to assert that a fingerprint system is more convenient or more secure.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

      \n\t\t\t\t\t\t\t\t\t

      It must be assessed whether a non-biometric solution can adequately perform the same functions.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

      \n\t\t\t\t\t\t\t\t\t

      If so, the use of biometrics may raise serious concerns in light of the data minimisation principle.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

      \n\t\t\t\t\t\t\t\t\t

      5. Is it lawful to use employees\u2019 fingerprints for time and attendance purposes?<\/h2>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t
      \n\t\t\t\t\t\t\t\t\t

      The question cannot be answered in the abstract with a simple \u201cyes\u201d or \u201cno\u201d.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

      \n\t\t\t\t\t\t\t\t\t

      The lawfulness of a fingerprint time and attendance system<\/strong> must be assessed in light of the specific circumstances of the processing and of whether the conditions laid down by the GDPR are met.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

      \n\t\t\t\t\t\t\t\t\t

      Nevertheless, the fact that processing is intended to record working time does not, in itself, mean that the employer may use biometric data.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

      \n\t\t\t\t\t\t\t\t\t

      In such a situation, the following must be assessed cumulatively: legal basis + Article 9 GDPR condition + necessity + proportionality + data minimisation + availability of alternatives.<\/strong><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

      \n\t\t\t\t\t\t\t\t\t

      This assessment is all the more important given that a fingerprint is a biometric characteristic permanently linked to the individual.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

      \n\t\t\t\t\t\t\t\t\t

      6. Can the employer rely on employees\u2019 consent?<\/h2>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t
      \n\t\t\t\t\t\t\t\t\t

      A problem frequently encountered in practice is the attempt to justify biometric time recording<\/strong> by obtaining employees\u2019 written consent.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

      \n\t\t\t\t\t\t\t\t\t

      Consent, however, should not be regarded as an automatic solution.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

      \n\t\t\t\t\t\t\t\t\t

      The GDPR provides that, in order to be valid, consent must be freely given, specific, informed and unambiguous. Moreover, Recital 43 of the Regulation draws attention to situations in which there is a clear imbalance between the data subject and the controller.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

      \n\t\t\t\t\t\t\t\t\t

      In employment relationships, the existence of a relationship of subordination therefore calls for careful scrutiny of whether consent is genuinely freely given.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

      \n\t\t\t\t\t\t\t\t\t

      More importantly, even where valid consent exists, it does not remove the other obligations laid down by the GDPR.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

      \n\t\t\t\t\t\t\t\t\t

      The controller must still comply with the principles set out in Article 5 GDPR and be able to justify the necessity and proportionality of the processing.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

      \n\t\t\t\t\t\t\t\t\t

      Therefore, an employee\u2019s signature on a consent form does not automatically render a fingerprint time and attendance system lawful<\/strong>.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

      \n\t\t\t\t\t\t\t\t\t

      7. The employer\u2019s accountability obligation<\/h2>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t
      \n\t\t\t\t\t\t\t\t\t

      The GDPR requires the controller not only to comply formally with the rules but also to be able to demonstrate compliance.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

      \n\t\t\t\t\t\t\t\t\t

      Article 5(2) GDPR enshrines the principle of accountability, under which the controller is responsible for compliance with the data processing principles and must be able to demonstrate such compliance.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

      \n\t\t\t\t\t\t\t\t\t

      Where a biometric system is used for employee time and attendance<\/strong>, the internal documentation should make it possible to justify the decision to implement it.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

      \n\t\t\t\t\t\t\t\t\t

      Depending on the circumstances, this may include:<\/p>

      • identification of the purpose of the processing;<\/li>
      • determination of the legal basis;<\/li>
      • identification of the applicable Article 9 GDPR condition;<\/li>
      • an assessment of the necessity of the processing;<\/li>
      • a proportionality assessment;<\/li>
      • an assessment of alternative solutions;<\/li>
      • determination of the retention period;<\/li>
      • determination of the persons authorised to access the data;<\/li>
      • determination of the technical and organisational measures;<\/li>
      • provision of information to employees;<\/li>
      • a risk assessment;<\/li>
      • documentation of the security measures.<\/li><\/ul>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t
        \n\t\t\t\t\t\t\t\t\t

        Depending on the specific characteristics of the processing, the need to carry out a data protection impact assessment (DPIA)<\/strong> under Article 35 GDPR must also be considered.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

        \n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"\"\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t
        \n\t\t\t\t\t\t\t\t\t

        8. Biometric data and the risk of a personal data breach<\/h2>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t
        \n\t\t\t\t\t\t\t\t\t

        Another important aspect concerns the risks associated with processing biometric data.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

        \n\t\t\t\t\t\t\t\t\t

        A password can be changed.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

        \n\t\t\t\t\t\t\t\t\t

        An access code can be reset.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

        \n\t\t\t\t\t\t\t\t\t

        A card can be blocked and replaced.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

        \n\t\t\t\t\t\t\t\t\t

        A person\u2019s biometric characteristics, however, cannot be replaced in the same way.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

        \n\t\t\t\t\t\t\t\t\t

        For this reason, any compromise of a biometric database may give rise to significant risks for the data subjects.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

        \n\t\t\t\t\t\t\t\t\t

        This feature must be taken into account when the employer assesses whether it is appropriate to use a fingerprint access control system<\/strong> or a biometric time and attendance system<\/strong>.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

        \n\t\t\t\t\t\t\t\t\t

        The GDPR requires the controller to implement technical and organisational measures appropriate to the risks of the processing.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

        \n\t\t\t\t\t\t\t\t\t

        Accordingly, the assessment must not be confined to the moment the fingerprint is collected but must cover the entire data lifecycle: collection, use, storage, access, transfer, erasure and eventual destruction.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

        \n\t\t\t\t\t\t\t\t\t

        9. What did the ANSPDCP find in this case?<\/h2>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t
        \n\t\t\t\t\t\t\t\t\t

        In the case under review, the ANSPDCP found that a controller was using employees\u2019 biometric data for access control and working-time recording<\/strong> without an appropriate legal condition under Article 9 GDPR and in breach of the data minimisation principle laid down in Article 5(1)(c) GDPR.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

        \n\t\t\t\t\t\t\t\t\t

        The Authority also held that the purposes pursued could have been achieved by alternative, less intrusive means.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

        \n\t\t\t\t\t\t\t\t\t

        As a result, a fine of RON 26,236, the equivalent of EUR 5,000<\/strong>, was imposed, together with a corrective measure requiring the biometric system to be replaced with an alternative solution.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

        \n\t\t\t\t\t\t\t\t\t

        The case is significant not only for the amount of the penalty but, above all, for the legal reasoning underlying the measure: the existence of a legitimate purpose is not sufficient where the controller chooses a means of processing that is more intrusive than necessary to achieve that purpose<\/strong>.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

        \n\t\t\t\t\t\t\t\t\t

        10. What should an employer check before implementing biometric time recording?<\/h2>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t
        \n\t\t\t\t\t\t\t\t\t

        Before introducing a fingerprint time and attendance system<\/strong>, the employer should complete at least the following steps:<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

        \n\t\t\t\t\t\t\t\t\t

        1. Define the purpose<\/strong><\/p>

        It must be clearly established whether the system is used for time recording, access control, premises security or several distinct purposes.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

        \n\t\t\t\t\t\t\t\t\t

        2. Identify the legal basis<\/strong><\/p>

        The applicable legal basis under Article 6 GDPR must be identified.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

        \n\t\t\t\t\t\t\t\t\t

        3. Assess Article 9 GDPR<\/strong><\/p>

        For biometric data, the specific condition permitting the processing under Article 9(2) GDPR must also be identified.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

        \n\t\t\t\t\t\t\t\t\t

        4. Test necessity<\/strong><\/p>

        It must be assessed whether the use of biometric data is genuinely necessary to achieve the intended purpose.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

        \n\t\t\t\t\t\t\t\t\t

        5. Assess the alternatives<\/strong><\/p>

        Available non-biometric solutions must be identified, and it must be assessed whether they can adequately achieve the same purpose.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

        \n\t\t\t\t\t\t\t\t\t

        6. Assess proportionality<\/strong><\/p>

        The employer\u2019s needs must be weighed against the impact of the processing on employees\u2019 rights and freedoms.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

        \n\t\t\t\t\t\t\t\t\t

        7. Comply with the data minimisation principle<\/strong><\/p>

        It must be verified that the data collected and the way it is used are limited to what is necessary.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

        \n\t\t\t\t\t\t\t\t\t

        8. Set the retention period<\/strong><\/p>

        It must be determined how long the data is retained and on what grounds that period is justified.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

        \n\t\t\t\t\t\t\t\t\t

        9. Implement security measures<\/strong><\/p>

        Biometric data must be protected by technical and organisational measures appropriate to the risks.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

        \n\t\t\t\t\t\t\t\t\t

        10. Document the decision<\/strong><\/p>

        The entire process must be documented so that the controller can demonstrate compliance with the GDPR.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

        \n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"\"\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t
        \n\t\t\t\t\t\t\t\t\t

        11. Conclusions: biometric time recording must be necessary, not merely convenient<\/h2>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t
        \n\t\t\t\t\t\t\t\t\t

        The case examined by the ANSPDCP sends an important message to employers: the use of modern technology is not, in itself, a legal justification for processing biometric data<\/strong>.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

        \n\t\t\t\t\t\t\t\t\t

        A fingerprint time and attendance system may be efficient, fast and accurate. However, these features must be weighed against the special nature of the data processed and the availability of alternative solutions.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

        \n\t\t\t\t\t\t\t\t\t

        Where biometric data is concerned, the GDPR assessment must start from one fundamental question:<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

        \n\t\t\t\t\t\t\t\t\t

        Is the use of the employee\u2019s fingerprint necessary to achieve the intended purpose, or can the same purpose be achieved by less intrusive means?<\/strong><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

        \n\t\t\t\t\t\t\t\t\t

        The answer to this question must be supported by a documented legal and technical assessment.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

        \n\t\t\t\t\t\t\t\t\t

        For employers, the implementation of a biometric time and attendance system<\/strong>, a fingerprint access control system<\/strong> or any technology involving the processing of employees\u2019 biometric data should not be treated as a mere IT or administrative decision.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

        \n\t\t\t\t\t\t\t\t\t

        It is, first and foremost, a decision to process personal data<\/strong>, subject to the requirements of the GDPR and, in particular, to the rules applicable to special categories of personal data.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

        \n\t\t\t\t\t\t\t\t\t

        Consequently, before installing a biometric system, the controller must be able to provide documented answers to three essential questions:<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

        \n\t\t\t\t\t\t\t\t\t

        Is there a legal basis?<\/strong><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

        \n\t\t\t\t\t\t\t\t\t

        Is a condition under Article 9 GDPR met?<\/strong><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

        \n\t\t\t\t\t\t\t\t\t

        Is the use of biometric data necessary and proportionate, having regard to whether less intrusive alternatives exist?<\/strong><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

        \n\t\t\t\t\t\t\t\t\t

        If these questions cannot be given a sound legal answer, the mere practical usefulness of a fingerprint time and attendance system is not sufficient to ensure compliance with the GDPR.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

        \n\t\t\t\t\t\t\t\t\t

        Author: P.A.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\n

        \n\n\t\t\n
          \n\t\t\t <\/ul>\n <\/div>","protected":false},"excerpt":{"rendered":"

          Este legal pontajul cu amprent\u0103 al angaja\u021bilor? Analiza GDPR a datelor biometrice la locul de munc\u0103, pornind de la amenda de 5.000 euro aplicat\u0103 de ANSPDCP.<\/p>","protected":false},"author":1,"featured_media":1616,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"elementor_header_footer","format":"standard","meta":{"_eb_attr":"","postBodyCss":"","postBodyMargin":[],"postBodyPadding":[],"postBodyBackground":{"backgroundType":"classic","gradient":""},"_thinkrank_schema_form_data":"","_thinkrank_selected_schema_type":"","_thinkrank_additional_schemas":"","_thinkrank_canonical_url":"","_thinkrank_og_title":"","_thinkrank_og_description":"Este legal pontajul cu amprent\u0103 al angaja\u021bilor? Analiza GDPR a datelor biometrice la locul de munc\u0103, pornind de la amenda de 5.000 euro aplicat\u0103 de ANSPDCP.","_thinkrank_og_image":"","_thinkrank_twitter_title":"","_thinkrank_twitter_description":"","_thinkrank_twitter_image":"","_thinkrank_imported_from":"","_thinkrank_focus_keywords":["pontaj cu amprent\u0103"],"_thinkrank_focus_keyword":"pontaj cu amprent\u0103","_thinkrank_robots_meta_enabled":0,"_thinkrank_robots_meta":"[]","_thinkrank_advanced_robots_meta":"[]","_thinkrank_exclude_from_search":0,"_thinkrank_exclude_from_archives":0,"_thinkrank_primary_category":11,"footnotes":""},"categories":[14,11],"tags":[],"class_list":["post-1604","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-dretul-muncii","category-gdpr"],"_links":{"self":[{"href":"https:\/\/avocatludusan.ro\/en\/wp-json\/wp\/v2\/posts\/1604","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/avocatludusan.ro\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/avocatludusan.ro\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/avocatludusan.ro\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/avocatludusan.ro\/en\/wp-json\/wp\/v2\/comments?post=1604"}],"version-history":[{"count":11,"href":"https:\/\/avocatludusan.ro\/en\/wp-json\/wp\/v2\/posts\/1604\/revisions"}],"predecessor-version":[{"id":1619,"href":"https:\/\/avocatludusan.ro\/en\/wp-json\/wp\/v2\/posts\/1604\/revisions\/1619"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/avocatludusan.ro\/en\/wp-json\/wp\/v2\/media\/1616"}],"wp:attachment":[{"href":"https:\/\/avocatludusan.ro\/en\/wp-json\/wp\/v2\/media?parent=1604"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/avocatludusan.ro\/en\/wp-json\/wp\/v2\/categories?post=1604"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/avocatludusan.ro\/en\/wp-json\/wp\/v2\/tags?post=1604"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}