DPA case PS/00128/2020 – Violation Found (Spain, 2021)

The AEPD received a letter filed by the interested party against the respondent stating that on 20 March 2019, he addressed requesting information on the fingerprint clocking control in accordance with the provisions of the regulations on the protection of personal data, without having received a response to this request. The AEPD initiated an investigation procedure, to which the City Council responded with a Security Document in which it reports in accordance with the provisions of the GDPR and points out, among other things, that the body used a fingerprint detection system to control presence and access to its facilities, which does not perform a biometric analysis at any time, but rather produces an identification algorithm based on a reading of several points of the personal fingerprint and that the algorithm data cannot be decrypted or disassembled by any unauthorized entity. And in response to a new request for information, the Council sent a report including the impact assessment on the processing of fingerprint data for the control of employee presence. Is the use of biometric data to monitor working time without informing data subjects a breach of Article 13 GDPR? The AEPD held that the facts complained of involving the violation by the City Council of the provisions of Article 13 of the RGPD, by not informing of the processing provided for in relation to the fingerprint clocking control. As the investigated party is a public administration, the AEPD applies Article 77 LOPDGDD, according to which a warning sanction must be applied when the offence is committed by a public administration.