Use of biometric systems
On November 23, 2023, the Spanish Data Protection Agency (AEPD) released a new Guide on the treatment of presence control through biometric systems.
As the most relevant aspects, the AEPD evaluates access control systems, both for work and non-work purposes, focusing particularly on time recording and presence control in the workplace. The aim of the Regulatory Authority with this Guide is to unify criteria with the European Union, as there had been conflicting statements from national supervisory authorities, leading to legal uncertainty for the data processing companies. The responsibility for analyzing the proportionality and justification for the adoption of such biometric systems is left to the companies themselves.
As a general rule, the Agency is clear: it is not possible to use biometric data for purposes of presence control, access control, or even for the registration of working hours. The justification is that this type of data is classified as special categories of data, requiring a prior and rigorous Data Protection Impact Assessment (DPIA) that allows the use of such data in very specific cases. This is to prevent abusive and disproportionate use that distorts the treatment itself, thus violating the rights and freedoms of the individuals affected.
The Guide reminds us that one of the fundamental principles of the GDPR is the principle of data minimization. This is developed with the understanding that the processed data will be adequate, relevant, and limited to what is necessary for the purposes for which they are processed, and only when such a purpose cannot be achieved by other reasonable and less intrusive means.
At UHY Fay & Co, we can advise you on the review and feasibility analysis of the existing systems in your company and on the study of implementing such extensive projects. We can also keep you informed about the risks associated with these types of data processing.
Do you have more questions? Do you want to know if this affects you?
Contact us:
Fe López- Socia UHY FAY & Co.
