Dutch DPA

The processing of biometric personal data deserves specific protection because of this unique identification. By virtue of Article 9 GDPR, the processing of biometric data is therefore prohibited, unless one of the exhaustive listed exceptions to Article 9(2) of the GDPR arise. In this case the controller couldn't demonstrate that its employees have given (explicit) permission for the processing of their fingerprints. Thereby several employees stated that fingerprint scanning was mandatory and that permission is not requested for this, not even in the context of signing the employment contract or by receipt of the employee handbook. Some employees where not informed at all. Whether identification by means of biometrics is necessary and proportionate for authentication or security purposes does not hold in this case, because there were other less far-reaching ways to make sure that the employees made their workhours.