Peraza Consultores ®
  • DeutschEspañolFrançaisItalianoPortuguesрусский
  1. Peraza Consultores ®
  2. News

IMPORTANT: NOTICE ON ACCESS CONTROL AND WORKING DAY RECORD BASED ON FINGERPRINT DATA COLLECTION OR FACIAL RECOGNITION

01/12/2023

The Spanish Data Protection Agency has published a new Guide on presence control treatments using biometric systems in which it sets the criteria for the use of time records and access control based on fingerprint and facial recognition .

This guide is decisive given that it clearly indicates the guidelines that it considers legal to be able to implement these systems, and that, therefore, if they are not complied with , said systems would not be covered by the regulations and, therefore, their use would be punishable :

  1. If time registration or access control is done through fingerprint, facial or iris recognition , biometric data would be processed.

 

  1. The consent of the worker for its use would not be valid as there is an imbalance between the company and the worker.

 

  1. It also understands that, if the worker is given the option of using another clocking mechanism instead of the fingerprint, it is possible to use a less intrusive system and that, therefore, it is not necessary to use the fingerprint or recognition system. facial.

 

  1. The only option for its use is for a regulation with the status of law to specifically authorize the use of biometric data for time registration or access control .

 

  1. Currently there is no regulation that authorizes such use, UNLESS it is explicitly included in the Collective Agreement to which the company adheres .

 

  1. None of the general agreements have it specified, therefore, if you have a particular collective agreement, the use of these systems is possible as long as you modify your agreement and specifically include it .


For all these reasons, if your company does not have such regulation by agreement explicitly and is carrying out time records and/or access control based on the fingerprint or facial recognition of the workers, it would be failing to comply with the regulations. of data protection with a very serious infringement ( art. 72.1.e LOPDGDD 3/2018 ) and possibility of compensation.

To be in accordance with the regulations, the alternatives for registration would be to clock in using a code per worker or magnetic card .






Idaira Hernandez Peraza
Consultant