Resolutions, opinions and reports search tool

Biometric data subject to specific technical processing for biometric recognition purposes, whether in the form of identification or biometric authentication, should be considered as a special category of data. Thus, this consideration would be given to both the fingerprint, to which specific technical treatment is applied, when used for the purpose of authenticating the identity of a natural person, and the biometric signature obtained on a tablet, measuring the formation of letters, the direction of traits, pressure and other unique dynamic characteristics, insofar as it is submitted for specific technical treatment in order to confirm authorship.

The inclusion of the biometric data, among them those of the digital impression, among the special categories of data foreseen by the RGPD it does not allow to go in an automatic way that the implantation of a system of hourly control based on the collection of this type of data can consider itself proportionate and, therefore, in agreement with the principle of minimization. It is necessary to make an evaluation of the impact about the data protection in view of the circumstances concrete in what the treatment is carried out to determine the legitimacy and the proportionality, included the analysis of the existence of alternatives less intrusives, and to establish the suitable guarantees.

The system of examined biometric access control would not adapt at the beginning of proportionality, for which it would be advisable to implant a fallback that gives suitable answer to the purpose aimed for by the school professional without putting the correct fulfillment of the principles and guarantees of the regulations of data protection personal at risk.

The installation of a system of access control and timetable based on the identification of the workers of a Public Administration through the biometric pattern entails the data processing personal. In so far as the collection of these biometric data is carried out in a juridical work or administrative relation and has the control as a purpose, precisely, of its fulfillment, the Administration can treat them and pick them up without the need for requiring the consent from the affected ones. In this case, the fulfillment of the duty of information will have to be produced in the moment of the initial collection of the biometric pattern.

Implantation of a system of hourly control through the digital imprint on the part of a provincial Regional Government. The digital imprint has consideration of personal datum (art. 3 to) LOPD and 5.1 f) RLOPD). Its treatment is considered in agreement with the principles of proportionality and quality of the data (art. 4 LOPD), to be a suitable, pertinent and non excessive treatment in relation to the purpose of to control the fulfillment of the timetable of the workers, without necessary being to have its consent (art. 6.2 LOPD). However, it will be necessary to comply with the rest of principles and duties to the LOPD, especially, the duty of informing (art. 5 LOPD), the modification of the file of "staff" or, the creation and inscription of a specific file for this treatment (article 20 of the LOPD) and the adoption of exigible safety measures, and if, the application of additional measures in attention to the nature of the treated information and the predictable risks, is proper.

Implantation of a system of hourly control through the digital imprint on the part of a public administration. The digital imprint has consideration of personal datum (art. 3 to) LOPD and 5.1 f) RLOPD). Its treatment is considered in agreement with the principles of proportionality and quality of the data (art. 4 LOPD), to be a suitable, pertinent and non excessive treatment in relation to the purpose of to control the fulfillment of the timetable of the workers, without necessary being to have its consent (art. 6.2 LOPD). However, it will be necessary to comply with the rest of principles and duties to the LOPD, especially, the duty of informing (art. 5 LOPD), the creation and inscription of the file (art. 20 LOPD) and the adoption of exigible safety measures, and if, the application of additional measures in attention to the nature of the treated information and the predictable risks, is proper.