RELEVANT ASPECTS
The Superintendence of Personal Data Protection (“SPDP”) has issued a statement regarding the use of biometric systems for employee attendance tracking. The SPDP has assessed whether this type of processing of sensitive personal data complies with the principles and lawful bases established under the Ecuadorian Data Privacy Act (“LOPDP”).
KEY FINDINGS OF THE SPDP’S STATEMENT
1. Nature of Biometric Data
Biometric data, such as fingerprints, facial recognition, or iris scanning, are classified as sensitive personal data under the LOPDP. This classification means that their processing is subject to a higher level of protection and can only be conducted under specific circumstances. The processing of biometric data must rely on a legitimate legal basis as set forth in the LOPDP.
2. SPDP’s Position on Consent and the Principles of Relevance, Data Minimization, and Proportionality
The SPDP has determined that consent for the use of biometric systems in workplace attendance control must meet the criteria of being freely given, specific, informed, and unambiguous. However, in the employment context, the subordinate relationship between employer and employee may create implicit pressure, which invalidates consent, as refusing to provide biometric data could lead to negative consequences for the employee’s job stability.
Thus, the SPDP considers that consent in such circumstances cannot be deemed fully valid, as employees are in a vulnerable position.
The principle of data minimization and relevance establishes that only data that are strictly necessary for a specific purpose should be collected. According to the SPDP, in the case of attendance control, there are multiple less intrusive alternatives, such as proximity cards or digital records, making the use of biometric data unnecessary and disproportionate.
Furthermore, the principle of proportionality dictates that the processing of personal data must be appropriate and justified in relation to the intended purpose. Given that attendance tracking can be achieved without processing biometric data,
the SPDP concludes that its use is not proportionate, and collecting such data could constitute an unjustified violation of employees’ right to privacy.
In summary, the SPDP has concluded that the use of biometric data for attendance control is not a legitimate practice under the LOPDP, because:
· Consent is invalid due to the subordinate relationship between employer and employee.
· The principle of data minimization is violated by collecting biometric data when less intrusive alternatives exist.
· The principle of proportionality is not met, as the use of biometric data in this context is neither appropriate nor necessary.
Therefore, the SPDP recommends that companies implement attendance tracking systems that do not involve biometric data processing and that ensure the protection of employees’ fundamental rights.
3. ALTERNATIVES FOR ATTENDANCE TRACKING
As biometric data collection is not legally required, the SPDP recommends that companies implement less intrusive alternatives for attendance control, such as identification cards, personal codes, or manual digital records.
4. LEGAL EFFECTS OF THE SPDP’S RESPONSE TO THE INQUIRY
Pursuant to the Regulation Establishing the Procedure for Handling Inquiries Submitted to the SPDP, the response to an inquiry:
“is not an administrative act nor an administrative decision; it is not binding and does not provide any evidentiary value in favor of or against the person submitting or invoking it, whether in judicial proceedings or administrative procedures.”
However, given that this statement reflects the institutional position of the SPDP, it is essential to take it into account when considering the implementation of biometric systems for employee attendance tracking.
We would be pleased to address any questions regarding this SPDP statement.
For further information, please contact:
· Dr. María Rosa Fabara – mfabara@bustamantefabara.com
· Esteban Dávila – edavila@bustamantefabara.com
· Rafael Gabela – rgabela@bustamantefabara.com