Time recording via fingerprint?

In its ruling of 14 May 2019 (C-55/18), the European Court of Justice ruled that Member States must oblige employers to set up a system for measuring the daily working time of employees. How exactly this obligation has to be implemented in Germany has not yet been decided by the German legislator. In its decision in June 2020, the Berlin-Brandenburg Regional Labor Court clarified that at least a time recording system using fingerprints is – in principle - not permitted in Germany.

LAG Berlin-Brandenburg, judgment of 4 June 2020, file no. 10 Sa 2130/19

The facts of the case

In the case at hand, the defendant's employees previously entered both their working hours and their desired assignments manually on a printed and displayed duty roster. For accounting purposes and in order to be able to create a weekly duty roster that corresponds to the employees' wishes, the defendant introduced the "Zeus" time recording model together with a personnel deployment plan on August 1, 2018. The system also includes a terminal that enables identification via a biometric fingerprint. The employees were informed by e-mail and accompanied by a data sheet and a declaration of conformity that the new time recording system would be put into operation on August 1, 2018. Employees were informed that the system does not store complete fingerprints, but the minutiae (fine features of the fingerprint, i.e. end points and branches of the papillary ridges, i.e. the skin grooves on the epidermis of the human finger) do. These would be converted into a numerical code. However, neither the minutiae nor a fingerprint of the employees could be reproduced from this code. It is also not possible to read this numerical code from the system. The plaintiff did not use the time recording system in August and September 2018. He continued to record his working hours in the previous form. The defendant then issued two warnings to the plaintiff. The plaintiff did not consider the warnings to be justified and requested their removal from the personnel file.

What was the verdict of the Regional Labor Court Berlin-Brandenburg?

The Berlin Labor Court granted the complaint and ordered the defendant to remove the warning. The defendant's appeal was also unsuccessful.

The defendant had not succeeded in demonstrating that the plaintiff had violated his employment contract obligations by the behavior reprimanded in the warnings. Minutiae are biometric data, contrary to the view expressed by the defendant in the appeal hearing. They are "only" finger line junctions, so that the associated fingerprint is not processed "as a whole". However, according to Art. 4 No. 14 of the European GDPR, biometric data are all personal data obtained using special technical procedures, including data relating to the physical and psychological characteristics of a natural person that enable or confirm the unique identification of the natural person. This is the case with minutiae. The defendant's argumentation in the appeal fails to take account of the regulatory content of the GDPR. Article 9 (1) of the GDPR expressly states that the processing of biometric data for the unambiguous identification of a natural person is prohibited. There are indeed individual exceptions to this. In the present case, however, only the exception under Art. 9 II b GDPR, according to which the processing must be necessary in order for the defendant or plaintiff to be able to exercise the rights arising from employment law and to comply with their obligations in this respect, insofar as this is permissible under European law, national law or a collective agreement. It is true that, according to the most recent case law of the European Court of Justice of 14 May 2019, employers are obliged to set up a system to measure the daily working time of each employee. However, it is not evident that such a system necessarily requires the processing of biometric data of the plaintiff (or other employees). In this respect, it should be pointed out that current technology enables a wide variety of other systems for recording working time (paper records, computer programs, electronic time cards). A justification also does not result from § 26 BDSG (German Federal Data Protection Act), this provision also depends on the necessity of the respective data collection.

The LAG Berlin-Brandenburg did not allow the revision. A complaint of non-admission is pending at the BAG with the file number 10 AZN 708/20.

Practical advice

In the present case, the court held that time recording by means of recording biometric data was inadmissible because it could easily be carried out by another method that was less restrictive in terms of data protection. Only if an employer can demonstrate that recording by means of fingerprints and thus by means of biometric data is absolutely necessary would fingerprint scanners in time recording systems be conceivable. In view of the numerous alternative technical time recording options, however, courts will place high demands on such a presentation. In practice, therefore, the recording of fingerprints or even minutiae for time recording purposes is likely to be permissible only in special individual cases.