The AEPD considers biometrics disproportionate
In its Guide on presence-control processing through biometric systems, the Spanish Data Protection Agency (AEPD) sets the criteria for using fingerprint, facial recognition or any other biometric method for time and attendance in the workplace.
The document establishes that the use of biometric data constitutes processing of special categories of high-risk data. The General Data Protection Regulation (GDPR) imposes strict limits on the processing of special categories of data, requiring the data controller to demonstrate necessity, proportionality and the absence of any less intrusive alternative.
Relevant AEPD resolutions
- APDCAT (Catalan authority) sanctions the municipal company "Gestió Iniciatives" for using fingerprint recognition for time tracking without legal justification.
- IVASS case (2024): the AEPD rules against a health institution for imposing fingerprint use on staff.
- April 2024 resolution against a football club for requiring facial recognition of players and technical staff to access facilities.
- Multiple fines to companies (2024) for time tracking via fingerprint without a valid legal basis.
Restricted or even banned for workplace time tracking
Many companies used articles 20.3 and 34.9 of the Workers' Statute to justify time tracking through fingerprint or facial recognition. But the new AEPD guide, aligned with the criteria of the European Data Protection Board and the Catalan and Andalusian authorities, makes it clear that biometric time tracking always processes special category data when linked to a specific person.
The AEPD warns: these articles of the Workers' Statute are not sufficient to authorise the use of fingerprint or facial recognition. They do not regulate the processing of biometric data nor establish the necessary safeguards to protect workers' rights.
Furthermore, the Data Protection Agency reminds us that the employee's consent is not valid in these cases. Why? Because there is a power imbalance between employer and employee, and consent is presumed not to be entirely free.
Alternative: time tracking with PIN code
The AEPD's own guide recommends PIN codes as the recommended alternative to biometric methods. It fulfils the same purpose (verifying that time is recorded personally by each employee) with a much lower privacy impact.
At ETEMPUS we have implemented time tracking via personal PIN from day one. The employee identifies themselves with a private numeric code on a tablet, mobile phone or PC. The record is nominal, verifiable and complies with all AEPD requirements without processing biometric data.