DPA case 114/2024 – €45,000 Fine (Belgium, 2024)

A company (the controller) introduced a system of timekeeping, based on fingerprints collection, within its two premises. The controller used a software provided by a third party (a processor), a subsidiary of a Japanese company, operating also in the USA and China. One of the controller's employees filed an access request with the controller twice. The first access request was answered orally, during the meeting with the representative of the union and the controller. The other reply only partially covered the questions asked by the data subject, for example by providing a fragmented list of the processing purposes pursued by the controller or not responding to the question about possible consent refusal (the data subject was interested in consequences of not consenting to fingerprints processing). The data subject lodged a complaint with the Belgian DPA (APD/GBA). They claimed the processing of their fingerprints violated their right to data protection. The data subject didn’t provide the fingerprints voluntarily and was not informed about the data retention periods. The data subject also expressed doubts regarding the adequate level of data protection in third countries where the data may be transfers. According to the documents provided by the controller, the processing of fingerprints served the purpose of: * recording of working time (including the preparation of paychecks); * fraud prevention; * safety reasons, including to know at all times how many people are present on the production site in case of fire or in case of monitoring the change of successive shifts; and * control of access to the employer's building. During the investigation, the controller did not present a legal basis for the processing, nor the rules regarding the retention period nor could it provide a written security and privacy policy. The DPA upheld the complaint. Initially, the DPA noted the controller processed biometric data under Article 4(14) GDPR, and consequently special c