A school in Essex has recently received a statutory reprimand from the Information Commissioner’s Office (ICO), the UK data protection authority, for failing to carry out a Data Protection Impact Assessment (DPIA) before introducing a new facial recognition technology system used to take payments from students in a canteen. The biometric data captured through the system is classed as “special category personal data” for the purposes of the UK General Data Protection Regulation (GDPR) and certain considerations must be made prior to processing such data.
One such requirement is that a DPIA must be completed in order to assess the level and likelihood of risk to data subjects as well as the necessity and proportionality of the processing. The school had failed to do this and only carried out a DPIA after they had started using the facial recognition technology system. This was not good enough.
As special categories of personal data are being processed (namely biometric data), not only is there a requirement for the processor to have a legal basis to justify the processing, but they must also have an additional “special condition” to compliantly process the data. This may be obtaining the data subject’s explicit consent, if no other special condition applies.
However obtaining explicit consent of the data subject is not always straightforward…
The company Serco was reprimanded by the ICO for using a similar fingerprint system, as well as facial recognition technology, for HR time and attendance management. After an investigation by the ICO, Serco was ordered to stop use of the system. It was judged that a system that was not so intrusive to staff-member’s data privacy rights could be used just as effectively for Serco’s purposes, such as access cards or unique PIN numbers.
In Serco’s case, the legal basis they were relying on for processing the personal data under the GDPR was that the processing was “necessary for the employment relationship” which was deemed not to be compliant, given alternative systems could have been used.
One of the only feasible legal bases in such circumstances is likely to be obtaining the employee’s explicit (affirmative) consent, through for example, a written statement. However, in a relationship between an employer and employee, consent cannot usually be freely given because of the imbalance of power – the employee may fear they will lose their job if they do not agree. To try to get around this, the employee must be given the option to opt out and/or an alternative option must be given to those employees who wish not to consent. Serco failed to do this.
In Europe too, companies have been fined for non-compliantly implementing biometric systems. For example, a Spanish company was fined 360,000 Euros for processing employee fingerprint data without carrying out a DPIA to assess the risks of doing so and ensuring suitable security measures were in place.
The importance of treating special category data, such as biometric data, pursuant to the GDPR is paramount and it is clear the ICO will take action to prevent infringing behaviour. Companies must ensure they carefully consider the risks to data subjects, employ appropriate safeguards and maintain transparency at all times when looking to implement such systems.
Redfern can assist in carrying out thorough DPIAs in order to advise on necessity and proportionality and/or suitable alternative options, before implementing a biometric system. Please get in touch.
Madeleine Rhodes mrhodes@redfernlegal.com
