Court case III OSK 4804/21 – Court Ruling (Poland, 2024)

A school (the controller) installed a fingerprint scanner by the entrance to the canteen. By scanning students’ fingerprints the device verified whether a meal was paid. The processing was based on their parents’ consent. The Polish DPA (UODO) initiated ex officio proceedings against the controller. During the proceedings, the controller explained they didn’t possess the students’ fingerprint samples. Such a sample was stored only within the fingerprint scanner. When a student ceased to eat in the canteen, their fingerprint stored in the fingerprint scanner was immediately deleted. After investigation, the DPA found violations of Article 5(1)(c) GDPR and Article 9(1) GDPR. The controller processed the biometric data under Article 4(14) GDPR. Nevertheless, the processing of biometric data was not based on a valid consent under Article 9(2)(a) GDPR. The students not using the fingerprint scanner were treated differently, i.e., they had to verify their identity by telling their name and contract number while entering the canteen. For this reason, the DPA claimed the consent was not freely given. Moreover, the DPA stated that processing of the biometric data violated data minimisation principle, as the controller was able to use less privacy intrusive means. Hence, the controller was fined PLN 20,000. Additionally, the DPA ordered deletion of the students’ fingerprints data and a ban on its further processing. The controller lodged an appeal with the Voivodeship Administrative Court of Warsaw (Wojewódzki Sąd Administracyjny w Warszawie). The controller argued they didn’t process biometric data. Furthermore, the controller disagreed with the DPA that the parents’ consent was an inappropriate legal basis for the processing at stake. The court upheld the appeal. For the court the interpretation of the data minimisation principle, relied upon by the DPA, was too strict. The controller proved the relation between the fingerprints processing and its purpose. Furthermore, the parents’ consent obtained by the controller was lawful and didn’t violate Article 9(1) GDPR and Article 9(2)(a) GDPR. The DPA brought a cassation appeal before the Supreme Administrative Court (Naczelny Sąd Administracyjny – NSA). The Supreme Administrative Court dismissed the cassation appeal. According to the court, if the consent for data processing was compliant with the GDPR, in particular Article 9(2)(a) GDPR, the purpose of processing and the scope of collected data were lawful as well. The court stated that lawful consent guaranteed that the data minimisation principle was respected. Consequently, the processing based on the consent had to be scrutinised by verifying whether the consent was, inter alia, freely given, informed, unambiguous and explicit. Since the controller obtained valid consent under Article 9(2)(a) GDPR, the DPA was unable to find a violation of the data minimisation principle. The court didn’t find any proof of discrimination of students not using the fingerprint scanner. All the students had access to the canteen and were served equally. Thus, the alleged violation of Article 9(2)(a) GDPR didn’t occur. Also, the court found the fingerprints were stored exclusively in the fingerprint scanner. Fingerprints collected by the fingerprint scanner were combined with a specific number, which was transferred to a software. The software attributed the number with the students’ identity. As a result, the fingerprint scanner was unable to combine the fingerprint with the students’ identity; at the same time, the controller didn’t possess the data base of students’ fingerprints.