We have recently installed a biometric system in the workplace to record time and attendance. One of our employees has indicated that she has an objection to using the system and wishes to opt out of doing so. She has also indicated to us that it is now our obligation to provide an alternative system for recording her time and attendance. Can we force her to use the biometric system which we have installed at a great expense to the organisation?

Jennifer Cashman writes:

The use of biometric systems (such as fingerprint or hand scanning for attendance purposes) in workplaces has increased in recent times. The use of such systems, and employees’ rights and entitlements in relation to same, raise a number of data protection issues for employers.

In his most recent annual report for 2010, Billy Hawkes, the Data Protection Commissioner, deals specifically with the issue of biometric data. The Commissioner sets out in his annual report that the most frequent complaints relate to the use of biometric time and attendance systems in the workplace and schools.

Substantial guidance material about the data protection implications of biometric systems has been published on the Data Protection Commissioner’s website which gives clear advice to data controllers about the steps necessary to satisfy the requirements of Data Protection legislation before such a system is deployed. Any employer even considering the installation of a biometric system in the workplace should in the first instance review the Data Protection Commissioner’s guidance to establish if there is likely to be any breach of the Data Protection Acts as a result of installation of the system.

In his annual report, the Data Protection Commissioner confirms that his position on biometric time and attendance systems for employees was tested in the Circuit Court in 2010. In that case, which concerned a major retail outlet, the Data Protection Commissioner found, in the course of a data protection audit, that a biometric system had been operating for some time. Staff had not been given an opportunity to opt out of the system and they were not supplied with information about the processing of their personal data through use of the system. It was the Data Protection Commissioner’s view that the data controller was in breach of the Data Protection Acts and he consequently served an enforcement notice requiring the employer to provide a range of information to its employees, including information on an alternative system for those who do not wish to use the biometric system. The enforcement notice was appealed to the Circuit Court and the case was then heard in full in April 2010.

Ultimately, settlement was reached in this matter which involved the data controller putting up a notice at all of its hand scanners as well as in its employee handbook and in its contracts of employment, setting out a range of data protection information. The employer also gave an undertaking to the court that if an employee objected to using the system, they would be informed of an alternative process. The alternative system would be considered by the data controller if a legitimate reason was put forward by the employee.

The data controller accepted, however, that this did not interfere with the Data Protection Commissioner’s discretion to determine what might constitute a legitimate reason in any specific case. It was also confirmed to the court that the Data Protection Commissioner would not regard a mere dislike of the system or desire not to use it as a legitimate reason which would give rise to an investigation on its part. The Data Protection Commissioner confirmed that he was satisfied with the outcome of this case and that his view was that it supported the firm position that he had adopted with regard to the data protection rights of people who were asked to use biometric systems.

The Data Protection Commissioner indicates in his annual report that he is concerned that some employers wish to use biometric time and attendance systems as an alternative to the employment of staff supervisors, for night shifts in particular. The Data Protection Commissioner sets out that any argument that because a staff member must run their finger or hand over a scanning device on entering the workplace provides some certainty that staff who are on site will remain there until the shift ends is not credible to support an argument that there is no need to employ a supervisor. The Data Protection Commissioner sets out that while a staff member may turn up at their workplace and use the system to record their presence, the system does nothing to assure the employer that the staff member actually stayed on site or, even if they did so, that they performed their duties while there. The Data Protection Commissioner goes on to set out that his office will continue to adopt a very firm line in relation to the deployment of biometric systems in such circumstances.

The Data Protection Commissioner goes on in his annual report to set out that during the course of an investigation concerning biometrics, his office was interested to learn from a company which operates in the UK and Ireland that opt out rates differed significantly in each jurisdiction. In the UK, the company reported that only 1% of people opted out of using a biometric system to record customer attendance. In Ireland, the company experienced an opt out rate of 15%. The opt out rate which the company found in Ireland reflects the Data Protection Commissioner’s findings on the ground and, in particular, the level of calls to the Data Protection Commissioner’s helpdesk when organisations roll out biometric systems for the first time.

The practical effect of the Data Protection Commissioner’s view on biometrics in the workplace is that an employer will have to show that it gave careful consideration to the Data Protection legislation when installing a biometric system. Employers must have a comprehensive Data Protection Policy document which deals with biometrics in the workplace, if such a system is in use. Furthermore, where an employee has a legitimate privacy concern about biometrics, that employee must have the right to opt out of using the system. The onus is then on the employer to offer an alternative means of recording time and attendance.

While the Data Protection Commissioner does not set out what might be an objective reason for an employee to seek to opt out of a biometric system, a practical example is as follows. Some biometric systems are capable of producing very detailed information about, for example, medical conditions from which an individual may be suffering. This is sensitive personal data pursuant to the Data Protection legislation and if an employee had a concern about a biometric system providing this level of information to an employer, it would, in my view, constitute a legitimate concern and an objective reason for the employee seeking to opt out of the system. In such circumstances, the employer would then have an obligation to provide an alternative means of recording time and attendance.

Therefore, in summary, in relation to the employee who has sought to opt out of your biometric system, you must ascertain the reason for the employee seeking to opt out to establish if it is a legitimate reason. However, furthermore, in anticipation of the employee making his complaints to the Data Protection Commissioner’s Office about the use of the biometric system in the workplace in the first place, you should carefully check the Data Protection Commissioner’s website and the guidance provided in relation to the use of biometrics to ensure that you are in compliance with the data protection obligations before continuing to insist on the use of the biometric system in the workplace.