Fingerprint at workplace access: biometric data, alternatives and erasure

A fingerprint reader at the workplace entrance appears convenient: an employee places a finger on the sensor, the door opens and the access event is recorded. Privacy law treats this as more than a technical access question. If the fingerprint is processed to identify a person uniquely, the system involves biometric data and therefore a special category of personal data.

This article addresses biometric workplace access in the employment context. It focuses on Article 9 GDPR, a defensible legal basis, real alternatives, a data protection impact assessment, safeguards and erasure. Video surveillance, general access rights to employee data and facial recognition in public spaces pursue different purposes. The employee data protection topic provides the wider employment framework.

Article 4(14) GDPR defines biometric data as personal data resulting from specific technical processing relating to physical, physiological or behavioural characteristics that allow or confirm unique identification. A system that creates a template from a fingerprint and compares it with a person’s identity for access can therefore fall within Article 9 GDPR. The manufacturer’s label does not decide the issue. The actual function does.

Article 9(1) GDPR expressly names biometric data used for uniquely identifying a natural person as a special category. Processing is generally prohibited. In addition to a general legal basis under Article 6 GDPR, an exception under Article 9(2) must apply. Turning a fingerprint into a template does not automatically remove its sensitivity.

The purpose should be narrow. Access to a particularly protected area is different from continuous time recording or analysis of movements at work. If the same templates are used for several purposes, data flows, necessity, legal basis and retention must be assessed separately. The special categories of personal data overview provides the starting point.

The business must first classify the processing under Article 6 GDPR. Different legal bases may be relevant depending on the actual process. For biometric data, however, that assessment is not enough. Article 9(2) GDPR additionally requires a suitable exception, such as explicit consent or a permission connected to employment and social law that includes appropriate safeguards.

Article 9(2)(b) GDPR requires employment-related obligations or rights to be authorised by Union or Member State law or a collective agreement and accompanied by suitable safeguards. An internal access policy does not replace that requirement. Legitimate interests under Article 6(1)(f) GDPR do not by themselves lift the prohibition in Article 9(1).

The records should therefore show the purpose, affected people, data categories, system steps, recipients and the specific reasoning for both levels. Articles 5(2) and 24 GDPR require demonstrable responsibility. The records of processing activities should also describe erasure periods and technical measures. The privacy compliance and governance topic helps structure that responsibility.

Under Article 7 GDPR, consent must be demonstrable, informed and freely given. Employment relationships, however, normally involve dependency. EDPB Guidelines 05/2020 therefore explain that employee consent often cannot be freely given where refusal causes a disadvantage or there is no genuine choice.

A signature from every employee does not automatically make biometric access lawful. Before consent is given, the organisation should explain the template, purposes, access, retention and withdrawal route. Withdrawal must be as easy as giving consent. The organisation also needs a realistic and equivalent access route that does not require biometric identification.

Depending on the security requirement, alternatives may include personalised cards, a PIN, keys, two-factor methods or a combination. The key question is not whether an alternative is equally convenient, but whether it meets the protection need with less interference. Compare misuse, loss, sharing, blocking, replacement and emergency access and keep the reasoning.

Article 35 GDPR requires a data protection impact assessment where processing is likely to result in a high risk to the rights and freedoms of natural persons. New technology, special categories, the employment context, systematic access and the consequences of a false match make it important to examine the requirement early. The decision belongs before the system starts.

The assessment should cover the full process: capture of the finger image, creation and storage of the template, matching at the reader, transmission to central systems, logging, supplier access, blocking, replacement cards and deletion. Assess false rejections, unauthorised reconstruction, data leakage and the effect on people who cannot use the biometric route.

Articles 25 and 32 GDPR require data protection by design and security appropriate to the risk. Measures may include local processing where possible, separated and protected templates, encryption, strict roles, personal administrator accounts, logging, recovery and a tested emergency route. The DPIA overview and the technical and organisational measures overview help structure the preparation.

Article 5(1)(e) GDPR requires storage limitation. A template should not be retained by default when biometric access is no longer necessary. On departure, a permanent move to another access method or the end of the protected area, deletion should be triggered and evidenced unless a specific legal duty requires retention. The erasure concept article provides a related organisational structure, but the concrete period must be assessed for this system.

Access logs serve a different purpose from templates. They may be needed for security incidents, access control or accountability, but they should not automatically become an unlimited record of movements. Define purpose, access, retention, restriction and deletion for each data type. Keeping one incident record longer needs a specific reason and documented justification.

Check backups, test systems, exports and the supplier’s systems as well. A deletion routine is reliable only when it reaches all copies or explains why a backup remains protected until its normal overwrite cycle. Changes to technology, software or the protected area should trigger a new deletion and risk review.

Article 88 GDPR allows Member States to provide more specific rules for employee data. Those rules should protect transparency, human dignity, legitimate interests and workplace monitoring systems. Austrian employment law may therefore need to be assessed alongside the GDPR. Section 96(1)(3) of the Austrian Labour Constitution Act concerns control measures and technical systems where human dignity may be affected.

Whether works-council consent is required cannot be answered merely from the label “access system”. Relevant factors include the extent of logging, the possibility of monitoring conduct or performance, links to working-time data and the actual evaluation. The assessment should take place before installation, not after the first dispute.

Employees should receive clear information about the data, the matching process, authorised exceptions and the contact route for a false rejection. Establish a review as well: are the same areas protected, are alternatives still available, do deletion and blocking work and is the biometric record used only for the agreed purpose? The article on access rights to employee data develops the role and control perspective.

Technology is treated as the legal basis: A supplier statement or strong encryption does not answer whether Articles 6 and 9 GDPR are satisfied.

Consent is distributed as a mandatory form: A signature does not show that employees had a free choice or an equivalent route.

Templates are treated like ordinary access data: Biometric data require a separate purpose, access and erasure assessment.

Access and time recording are combined without review: An additional evaluation expands purpose, data flows and possible employment-law risks.

The emergency route is missing: A person who is not recognised or cannot use biometrics needs a secure, documented and non-discriminatory alternative.

Start with a concrete system description. Which doors are protected, who needs access, which risk should be reduced and what data arise during enrolment, access, rejection, blocking and departure? Keep the biometric template separate from access logs and any working-time data.

Then compare at least one alternative without biometric identification. Assess security, error handling, loss, sharing, blocking, replacement, accessibility and emergency use. Record the decision by reference to the actual protection need and the interference with employee rights, not as a general preference.

The final file should contain the dual legal-basis assessment, information, DPIA decision, technical configuration, role matrix, deletion plan, supplier review, works-council assessment and test criteria. The video surveillance article shows a related but different security processing with its own retention and access questions.

We review the purpose, data flows, legal bases, alternatives, DPIA, technical safeguards, deletion and employment-law classification of your access system. If you are planning an introduction or reviewing an existing system, provide the system description, supplier documents, access and deletion concept and the planned employee information.