Can an employer use a fingerprint-based time clock with employees' consent?

ANSWER

The answer to this question is not straightforward. According to the current position of the Personal Data Protection Office (UODO), biometric data should not be used by the employer to record employees' working time. Even employees' consent under Article 9(2)(a) GDPR will not in this case be a sufficient argument, as employee identification and recording of working time can be achieved using other means that do not interfere so significantly with employees' privacy. The author in this respect shares UODO's view. This position was also expressed by UODO in one of PUODO's decisions — an article of 5 March 2020 — in the case of verifying pupils using biometric data when entering the school canteen (https://uodo.gov.pl/pl/138/1453). In that case UODO took the position that even voluntary consent of the legal guardian is not a sufficient basis.