{"id":25638,"date":"2025-08-13T08:51:12","date_gmt":"2025-08-13T06:51:12","guid":{"rendered":"https:\/\/www.delucapartners.it\/news\/rilevazione-presenze-lautorita-garante-ribadisce-il-divieto-alluso-delle-impronte-digitali-2\/"},"modified":"2026-04-02T15:52:03","modified_gmt":"2026-04-02T13:52:03","slug":"rilevazione-presenze-lautorita-garante-ribadisce-il-divieto-alluso-delle-impronte-digitali","status":"publish","type":"post","link":"https:\/\/www.delucapartners.it\/en\/insights\/attendance-tracking\/","title":{"rendered":"Attendance tracking: the Italian Data Protection Authority reaffirms the ban on using fingerprints"},"content":{"rendered":"\n

\u201cThe use of biometric data in the workplace is permitted only if explicitly provided by specific legal provisions that protect employees\u2019 rights. Such processing must serve a public interest and meet the criteria of necessity and proportionality with respect to the pursued objective\u201d. This was reaffirmed by the Italian Data Protection Authority (i.e. \u201cGarante Privacy\u201d) in its provision No. 167 of March 27, 2025, published in the official newsletter on June 25, 2025.<\/p>\n\n\n\n

First, it is important to recall that biometric data are defined by Regulation (EU) 2016\/679 (the \u201cGDPR\u201d) as \u201cpersonal data resulting from specific technical processing relating to the physical, physiological or behavioral characteristics of a natural person which allow or confirm the unique identification of that person, such as facial images or dactyloscopic data\u201d (Art. 4, point 14). When used to uniquely identify individuals, they fall within the \u201cspecial categories\u201d of personal data under Article 9 due to their sensitivity, stemming from their close and stable connection with a person\u2019s identity.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

The general rule is that the processing of biometric data is prohibited, with exceptions listed under Article 9, paragraph 2, of the GDPR. In the employment context, such processing is lawful only when it is \u201cnecessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law\u201d, provided it is authorized by Union or member State law or a collective agreement under member State law, with appropriate safeguards in place to protect the fundamental rights and interests of the data subject.<\/p>\n\n\n\n

In other words, processing biometric data<\/a> in the workplace is lawful only when based on a valid legal provision that serves as an appropriate legal basis. Currently, there are no specific Italian laws authorizing the use of biometric data for the purpose of tracking employee attendance, nor do such provisions define the necessary safeguards.<\/p>\n\n\n\n

This lack of a legal basis cannot be overcome by obtaining employee consent. In the words of the Authority: \u201cGiven the power imbalance inherent in the employment relationship and the resulting need to verify, in each case, the employee\u2019s genuine freedom of consent, such consent does not, as a rule, constitute a valid lawful basis for the processing of personal data in the workplace, regardless of whether the employer is a public or private entity\u201d.<\/p>\n\n\n\n

Other related insights:<\/strong><\/strong><\/p>\n\n\n\n