UOOU (Czech DPA) — Employer (fingerprint biometric attendance system)
A completed UOOU inspection found an employer breached the GDPR data-minimisation principle by processing hashes of employees' fingerprints in an electronic attendance system, where the biometric data were not necessary for attendance record-keeping.
Key takeaway — how to prevent this
Biometric data (faces, iris, fingerprints) needs an explicit lawful basis or consent. Scraping or capturing it without one is unlawful across the EU/UK and many US states (e.g. Illinois BIPA) — and draws the largest fines.
Case brief
Read from a report on 2026-09-18. Every holding carries a short verbatim quote from that text (in CS, the document's language).
- Decided by
- Úřad pro ochranu osobních údajů
- Parties
- Úřad pro ochranu osobních údajů v. —
- Remedy
- The Office for Personal Data Protection concluded an inspection finding that the employer unlawfully processed employee fingerprint hashes in violation of data minimization requirements.
- Appeal
- No appeal
Key holdings
The Czech DPA conducted an inspection into the processing of employee fingerprint biometrics within an attendance tracking system.
“Úřad provedl kontrolu dodržování povinností stanovených GDPR a zákonem o zpracování osobních údajů v souvislosti se zpracováním osobních údajů (otisků prstů) v rámci docházkového či obdobného systému”
The employer violated the principle of data minimization by processing employee fingerprint hashes that were unnecessary for tracking attendance.
“Kontrolou bylo zjištěno, že zaměstnavatel porušil tzv. zásadu minimalizace údajů danou čl. 5 odst. 1 písm. c) GDPR”
The inspected employer did not submit any objections against the inspection findings within the prescribed deadline.
“Kontrolovaná osoba v tomto případě nevyužila možnosti podat proti kontrolním zjištěním ve stanovené lhůtě námitky.”
Biometric data requires strict protection because its uniqueness means any data leak constitutes an irreversible problem.
“zásadní nebezpečí týkající se biometrických údajů spočívá v jejich nezaměnitelnosti (jedná se o jedinečné fyzické znaky osob).”
In plain English
The Office for Personal Data Protection conducted an inspection into an employer that implemented an electronic attendance tracking system using fingerprint biometrics. The authority evaluated whether processing employee fingerprint hashes complied with data protection rules governing sensitive biometric data. The authority found that the employer breached the principle of data minimization set out in Article 5 paragraph 1 point c of the General Data Protection Regulation. The employer processed fingerprint hashes of its employees in its electronic attendance system even though storing such data was not necessary for recording employee attendance. The authority noted that while attendance systems rely on identifying individuals, biometric processing requires exceptional justification under Article 9, which was not present in this instance. The inspected entity did not file any objections against the inspection findings within the allowed time limit, rendering the findings final. The Office emphasized that biometric data presents severe risks due to its unique nature. Because biometric features are non-interchangeable, a leak of such information creates an irreversible problem, especially when data is stored outside the direct control of the data controller.
Inclusion does not imply wrongdoing or liability. Status reflects the latest information we have — always check the official source for current status.