Biometric data

The purpose decides the protection

Biometric data can be created from a fingerprint, face, voice, iris, gait or another physical or behavioural trait. A photograph is not automatically biometric data. The definition applies when specific technical processing lets a system identify or confirm a person uniquely.

When biometric data is used for unique identification, it is special category data. The employer then needs both an Article 6 lawful basis and an Article 9 condition, plus any matching Data Protection Act 2018 safeguard.

Convenience is not enough

Clocking in or opening a door with a fingerprint may look efficient, but it creates information a person cannot replace like a password. The ICO's employment guidance says employers using biometric data for time, access or monitoring must complete a data protection impact assessment.

Compare the proposal with less intrusive options such as a card, code or manager-approved record. Explain what problem the biometric system solves, how reliable it is, what happens when it fails and whether a genuine alternative is available. Consent can be difficult to rely on at work where refusing may carry a disadvantage.

Control templates, access and deletion

Find out whether the system stores an image, a mathematical template or both, and where each copy travels. Limit enrolment and administration access, protect transfer and storage, and document how false matches and rejected scans are handled.

Set deletion rules for failed applicants, workers who leave and people who switch to an alternative. The contract should cover return or deletion, security incidents, subprocessors and evidence that data is removed from devices, backups and hosted services when it is no longer needed.