Originally published February 2010
Employee Consent Does Not Legitimise Biometric Data Processing
The Polish Supreme Administrative Court ruled on 1 December 2009 that employers are not allowed to process employee biometric data for the purpose of recording work time.
The case concerned introducing a system of recording work time based on employee fingerprint recognition (one type of biometric data). The company (LG Electronics) was processing data with the explicit written consent of employees. Employees were allowed to choose whether their work time would be recorded by means of electronic cards or fingerprint recognition.
The Polish Data Protection Authority (GIODO) decided that the company should cease the processing of biometric data, as such data was being processed without a proper legal basis. The employees' consent would not suffice to legitimize the process. In GIODO's opinion, the Polish Labour Code (PLC) provides an exhaustive list of what data can be legitimately processed by an employer, including name, surname, date of birth, address, national identification number, education, previous experience, and other data, if such data is necessary to provide the employee with his/her entitlements resulting from employment law or if the employee is obliged to disclose such data by legal provision. Biometric data is not included on that list.
The company appealed, and the Warsaw Province Administrative Court decided that biometric data can be lawfully processed with an employee's consent.
The Supreme Court, however, overturned that court's decision, holding that only such data as is specified in the PLC or other regulations can be lawfully processed by an employer. An employee cannot effectively consent to the processing of wider scope of data, because he/she is dependent of the employer, and therefore his/her consent cannot be freely given.
The Supreme Court also held that processing biometric data for the purpose of recording work time is disproportionate and inadequate for the purpose, and therefore illegal.
The ruling will have a substantial impact on employee data processing. Not only does it clarify that employers in Poland cannot legitimately use employee biometric data, but it also states that currently Polish employers are only allowed to process such employee data as is explicitly specified in PLC or other regulations.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
