On 27 November 2008, the Regional Administrative Court in Warsaw (WSA) issued a judgment upholding the right of LG Electronics process to employees’ fingerprints for the purposes of evidencing their working time. In doing so, the WSA overruled two previous decisions of the Polish Chief Inspector for Personal Data Protection (GIODO).
The case concerned the implementation by LG Electronics of a system for scanning employees’ fingerprints for the purposes of evidencing their working time. The GIODO has issued numerous decisions prohibiting employers from doing this, however, LG Electronics is the first employer to appeal the GIODO’s decision to the WSA.
The GIODO stated in its decisions that processing employees’ biometric data for the purposes of evidencing their working time is illegal due to the fact that such personal data is not listed in the list of personal data that an employer is permitted to demand from the employee under Article 22(1) ss 1 and 2 of the Polish Labour Code. According to GIODO, an employer is only entitled to process additional employee personal data where it is permitted to request such data under other regulations. There are no regulations which would clearly allow processing of scans of employees’ fingerprints for purposes of evidencing working time. The GIODO upheld its position even though the system based on scanning fingerprints was used only in relation to those employees of LG Electronics that agreed in writing to the fingerprinting and those who did not consent used the traditional timesheet system.
Article 22(1) ss 1 and 2 of the Polish Labour Code provide that an employer is entitled to demand the following personal data from its employees:
- name/i.e. surname and first name
- names of parents
- birth date
- place of residence (correspondence address)
- employment history
- other personal data of the employee including names and surnames and dates of birth of its children in case such data is required for the purposes of allowing the employee to exercise certain rights granted to him/her under labour law (in particular benefits and allowances, maternity leave etc.)
- PESEL number (Polish Common Electronic System of Population Evidence).
LG Electronics argued that Article 22(1) of the Polish Labour Code should not be interpreted as only authorising employers to process the personal data listed in this provision, but instead indicating the personal data which employees are obliged to make available to their employer. Other personal data may be processed by an employer if the employee has given consent to such processing. LG noted that one of the legal justifications for processing personal data set out in Article 23 of the Polish Act on Personal Data is where the explicit consent of the person whose data is to be processed has been obtained. This provision should therefore be considered to be more specific than the provisions of the Polish Labour Code concerning processing employee personal data and as such constitutes legal authorisation to process employee personal data other than those indicated in Article 22(1) of the Polish Labour Code, where employees have consented to its use.
The WSA shared LG’s views noting that as long as the effectiveness of the consent given by the employees to process their fingerprints is not challenged under civil law (due to error, threat or other circumstances vitiating the free will of the employee the legality of LG’s authorisation for processing fingerprints of its employees cannot be questioned. It should be noted however that the judgment of the WSA is not final and the GIODO has the right to appeal the decision to the Supreme Administrative Court (NSA).