# Standards and Regulatory References — Employee Biometric Data

## Primary Legislation

### GDPR Article 4(14) — Definition of Biometric Data
Biometric data means personal data resulting from specific technical processing relating to the physical, physiological or behavioural characteristics of a natural person, which allow or confirm the unique identification of that natural person, such as facial images or dactyloscopic data.

### GDPR Article 9(1) — Prohibition on Special Category Processing
Processing of biometric data for the purpose of uniquely identifying a natural person shall be prohibited, subject to Art. 9(2) exceptions.

### GDPR Article 9(2) — Exceptions
- Art. 9(2)(a): Explicit consent — rarely valid in employment (WP29 Opinion 2/2017).
- Art. 9(2)(b): Employment law obligations — valid where national law authorises.
- Art. 9(2)(g): Substantial public interest — where national law provides basis.
- Art. 9(2)(h): Health professional processing — for occupational medicine assessments.

## National Law

### France — CNIL Règlement Type Biométrie (Deliberation No. 2019-001, 10 January 2019)
- Biometric access control permitted for premises, devices, and applications where justified.
- Storage hierarchy: individual device (preferred) → centralised with employee control → centralised without control (strongest justification required).
- Alternative non-biometric access method must be available.

### Germany — BDSG Section 26(3)
- Special category data processing for employment purposes where necessary for exercising rights under employment, social security, or social protection law.
- Works council co-determination under Section 87(1)(6) BetrVG.

### Netherlands — UAVG Art. 29
- Biometric processing permitted for authentication or security purposes where necessary.
- Autoriteit Persoonsgegevens restricts biometric processing to high-security contexts.

### Italy — Workers' Statute Art. 4 + Garante Guidance
- Biometric access control requires trade union agreement or labour inspectorate authorisation.
- Garante has restricted biometric timekeeping to specific sectors.

### Sweden — Datainspektionen
- DI-2019-2221: SEK 200,000 fine for school using facial recognition for attendance. Strong precedent against biometric attendance monitoring when alternatives exist.

## Enforcement Precedents

| Authority | Reference | Fine | Issue |
|-----------|-----------|------|-------|
| Datainspektionen (Sweden) | DI-2019-2221 | SEK 200,000 | Facial recognition for attendance disproportionate |
| CNIL (France) | Clearview AI, 2022 | EUR 20,000,000 | Biometric processing without basis or DPIA |
| AEPD (Spain) | PS/00218/2021 | EUR 20,000 | Fingerprint timekeeping without necessity test |
| Garante (Italy) | Provvedimento 9832838, 2021 | Prohibited | Facial recognition for access without Art. 9(2) condition |
| Autoriteit Persoonsgegevens (NL) | 2020 | Cease order | Fingerprint timekeeping disproportionate |
| ICO (UK) | 2022 Enforcement | Cease order | Palm vein scanning without DPIA |