Employer

What happened

The DPA fined an employer €45,000 for the unlawful usage of a timekeeping system that processed biometric data, specifically, its employees’ fingerprints.

Summary from GDPRhub (noyb), written by its volunteers, not by Fino. CC BY-NC-SA 4.0.

Rules involved

• Art. 5Principles relating to processing of personal data5(1)(a) · 5(1)(b) · 5(1)(c) · 5(2)Read →
• Art. 6Lawfulness of processing6(1)(a)Read →
• Art. 9Processing of special categories of personal data9(1) · 9(2)(a)Read →
• Art. 12Transparent information, communication and modalities for the exercise of the rights of the data subject12(1)Read →
• Art. 13Information to be provided where personal data are collected from the data subject13(1)(c) · 13(2)(c) · 13(2)(d) · 13(2)(e)Read →
• Art. 15Right of access by the data subject15(1)Read →
• Art. 30Records of processing activities30(1)(a) · 30(1)(b) · 30(1)(c) · 30(1)(d)Read →
• Art. 35Data protection impact assessmentRead →

• DPIA
• Data principles
• Data subject rights
• Special categories
• Transparency
• Unlawful processing