Press release
The processing of employees’ biometric data (fingerprints) for establishing the working hours and their video surveillance in the offices – declared illegal by the court
Following several inspections carried out following a complaint or notice, at the premises of certain employers, the supervisory authority noticed that they have implemented a series of systems for monitoring the working hours of the employees by recording their biometric data in order to establish the working time. Moreover, it was ascertain that the employers used also the video surveillance of the employees in the offices.
However, these measures were implemented without the observance of the provisions of Law no. 677/2001 and of Decisions no. 52/2012.
On these ground, those employers were sanctioned with a fine, sanctions which were kept by the courts, by final and irrevocable decisions, thus confirming the rationality and legality of the measures taken by the supervisory authority.
Therefore, the courts confirmed the arguments of the supervisory authority concerning the fact that the processing of personal data (fingerprints and images) of the employees was illegally carried out, because they did not perform an in-depth analysis of the necessity and proportionality of such measures before implementing the devices and they did not identify alternative solutions with a lower impact on the employees’ private life.
Furthermore, the court held that the direct information of the employees was not performed in a clear and complete manner, strictly concerning these processing, and the employees were not previously consulted directly and explicitly which lead to the conclusion that the employer acted outside the national and international legislation in the filed, the latter having primacy over national law.
In this context, we underline that in the European Court of Human Rights jurisprudence on Article 8 of the Convention for the protection of human rights and fundamental liberties (the right to the protection of private and family life), the European court stated that “it is not always possible to distinguish clearly which of an individual's activities form part of his professional life and which do not.” (Niemietz v. Germany, judgment of 16th of December 1992) and that the protection offered by this article would be unacceptably weakened if the use of modern scientific techniques in the criminal-justice system were allowed at any cost and without carefully balancing the potential benefits of the extensive use of such techniques against important private-life interests (S. and M. Marper v. The United Kingdom, 4th of December 2008).
Moreover, the court established that by installing video surveillance cameras in the offices a disproportionate measure was taken, and the right of private life of the employees was infringed thus creating the feeling of continuous surveillance, a state of pressure at the workplace and a discomfort by the means of a permanent surveillance.
The court concluded that the processing of such personal data is a very sensitive one, all the procedures should be rigorously observed and the measures take should respect the right balance between the aims and the human fundamental rights.
As a consequence, the supervisory authority draws attention upon the fact that, according to Article 8 (3) of Decision no. 52/2012, “the processing of employees’ personal data by means of video surveillance in the offices where they carry out their activity if forbidden, except for the situations provided by law or with the approval of the National Supervisory Authority for Personal Data Processing.”
At the same time, where there are no express legal provisions, the processing of employees’ biometric data (fingerprints) can take place only if these measures are proportionate to the risks faced by the controller (employer) and thoroughly justified the need for such an intrusive measure in the private life of the data subjects (employees).
In addition, in order to observe the principle stated in Article 4 (1) (c) of Law no. 677/2001, amended and completed, the data collected must be strictly the ones necessary to fulfill the purpose, which implies a prior analysis of the urgent necessity of collecting the data in order to avoid any interference in a person’s private life, as well as finding less intrusive solutions.
Since the implementation of such systems may affect the rights of data subjects as employees, in addition to the provisions of Law no. 677/2001 , as amended and completed, must be respected also those provided by the Labour Code or other laws governing the status, rights and obligations of the employees.
In this regard, the prior consultation of the employees' representatives or the trade union they belong, as appropriate, is necessary.
As a consequence, the supervisory authority appreciates constantly that the deployment of the fingerprint for the timekeeping and the implementation of the video surveillance cameras in the offices of the employees may increase the risk of infringing the rights and freedoms of the data subject in relation to the interest of the controller which could be harmed, therefore such a processing is excessive related to the intended purpose.
We state that the provisions of Article 14 and 15 of Law no. 677/2001, as amended and completed, guarantee to any person the right of intervention and the right to oppose to the processing of personal data.
In this context, where the person concerned considers that his rights guaranteed by law were infringed, according to Article 25 corroborated with Article 27 of Law no. 677/2001, as amended and completed, may file a complaint or may notice the supervisory authority. In this regards, there are information on section Complaints and Notices.
Legal and Communication Dept.
