The GDPR and the Fall of Biometrics
In the GDPR, biometric data is being treated as part of a special category of personal data, which deserves a higher level of protection, whereby biometric data is defined as "personal data resulting from specific technical processing relating to the physical, physiological or behavioural characteristics of a natural person, which allow or confirm the unique identification of that natural person, such as facial images or dactyloscopic data" (Article 4).
In Cyprus, the Processing of Personal Data (Protection of Individuals) Law (Law 138 (I) 2001) (henceforth "the Law") has been enacted in year 2001 and is soon to be replaced by the General Data Protection Regulation (GDPR) and new legislation acts to come into force shortly. Article 18 provides for the appointment of the Commissioner of Personal Data Protection entrusted with the power and duty to safeguard the implementation of the Law.
The Commissioner has dealt with matters regarding biometrics and more specifically fingerprinting. The fall of biometrics in the face of the pending GDPR implementation has become all the more evident. By its decision dated 19/05/2017 the Administrative Court of Cyprus upheld a prior decision made by the Commissioner, dated 02/10/2012, regarding the use of fingerprints in a Private Hospital in order for the employees to clock in at work
The legal basis of the contested Commissioner's Decision was that the fingerprinting system set up by the applicants for the purposes of checking the time of arrival and departure of their employees from their workplace, was collecting and processing their fingerprints (biometric data) in excess of the authority of proportionality, which is a fundamental principle of lawful data processing (Article 4(1)(c) of the Law).
Based on a multitude of documents from European Authorities and Organizations and based on previous Decisions of all past Commissioners, it has been repeatedly held that the collection and processing of fingerprints, which are unique characteristics of the human body, poses an interference with the physical integrity and human dignity of the individual resulting in interference with his private life. The use of fingerprinting systems was therefore considered excessive in relation to the specific objective pursued, the control of staff working hours, particularly taking into account that such systems are used in facilities of the highest safety and for policing purposes.
The main reason for the applicants' contesting of the Commissioner's Decision was the Commissioner's alleged failure to carry out an appropriate search for the technical specifications or the operation of the system, and that the contested decision was taken as a result of a real error, since the system, as they alleged, did not collect or process fingerprints.
The Commissioner's defence claimed that it is an undeniable fact that the system in question collects and processes biometric data (fingerprints) which can recognise and identify an individual in their presence. The Commissioner also pointed out that the system is disproportional, contradictory to the principle of proportionality, in relation to the specific purpose used which was the control of staff working hours, given that there are many other measures less intrusive to human dignity which may be used instead.
The Court decided to dismiss the applicants' recourse after having held that they did not raise any allegations that cast doubt on the correctness and reasonableness of the Commissioner's judgment, as their main argument was the lack of information on the standards and the way in which the system operates.
The Court held that the operation of the system itself violates the principle of proportionality in relation to the specific purpose, the control of staff working hours and constitutes a disproportionate interference with the privacy of the individual.
The Court upheld the Commissioner's decision to impose on the Private Hospital the administrative penalty of the interruption of the processing and destruction of the relevant data (Article 25 (1)(e) of the Law) by interrupting the fingerprinting system and the destruction of data on fingerprints of employees.
It is worth mentioning that in a different case, the Commissioner published an opinion on 12/10/2016 on the use of a biometric system (fingerprinting) for access purposes in a gym. The noticeable difference with the previous case is that this case does not concern an employer-employee relationship which is a relationship of dependence and power, but a contractual relationship between a client and a gym owner, that is the product of free will and part of the guaranteed constitutional freedom to contract. The Commissioner further expressed the necessity of consent and the right to withdraw that consent at any time, as well as the existence of an alternative system for customers that don't wish to use the biometrics system.
The Administrative Court decision reflects the changing waves coming forth from the pending implementation of the GDPR.
Biometrics even though a great comfort in our everyday technology-heavy lives, form after all one of the greatest means in which personal data may be potentially violated.
Article provided by: Alexia Kountouri and Constantinos Andronicou, Partners of EuroCloud CPC Network in Cyprus.
Discover more about the Cloud Privacy Check(CPC) / Data Privacy Compliance(DPC) project
Director CPC project: Dr. Tobias Höllwarth, tobias.hoellwarth@eurocloud.org