Biometric time clocks and facial-recognition monitoring in a distribution centre
LagerPro runs a 40,000 m2 distribution centre in Poland with 2,500 warehouse staff and high seasonal turnover. Sharing of entry badges ('buddy punching') is estimated to cost 3% of payroll hours. Management proposes fingerprint scanners at every entrance and ceiling cameras with facial recognition in the picking aisles to detect idle time. The vendor says templates are stored as irreversible hashes, but matching happens in the vendor's cloud. The company has drafted a one-page DPIA stating the processing is 'necessary for security and efficiency' and that staff 'expect to be monitored in a warehouse'. The works council has objected. The DPO has not been asked to comment. A pilot with 50 staff is planned for next month, and the Polish DPA has previously fined employers over biometric monitoring.
1. Is a DPIA mandatory here, must it be completed before the pilot, and what role does the DPO have?
Read the worked answer
Mandatory. Article 35(1) requires a DPIA where processing is likely to result in a high risk. Article 35(3)(b) makes it explicit for large-scale processing of special category data. Fingerprint and facial-recognition templates used to identify individuals are biometric data under Article 4(14) and, when processed to uniquely identify a person, fall under Article 9(1). With 2,500 staff this is large-scale.
The EDPB's nine criteria reinforce this: systematic monitoring of a publicly accessible or workplace area, innovative technology, data matching, vulnerable data subjects, and a clear imbalance of power between employer and employee. Two criteria are enough; this scenario meets at least five. The Article 29 Working Party list for Poland also treats biometric and video monitoring of employees as DPIA-triggering.
Timing. Article 35(1) requires the DPIA before processing begins. A 50-person pilot is processing, so the pilot cannot run first and be assessed afterwards.
DPO role. Article 35(2) requires the controller to seek the DPO's advice, and that advice must be documented. Not consulting the DPO is a procedural breach in itself, and it deprives the company of the independent view that the works council and the authority will expect. The one-page statement is not a DPIA: it contains no systematic description of the processing, no necessity and proportionality assessment, no risk analysis and no mitigation measures under Article 35(7).
If residual risk remains high after mitigation, Article 36 requires prior consultation with the Polish DPA (UODO) before processing starts. Breaches of Articles 35 and 36 attract fines of up to EUR 10 million or 2% of worldwide turnover under Article 83(4).
2. Assess necessity and proportionality. Is legitimate interest a workable basis, and what alternatives should the DPIA examine?
Read the worked answer
Necessity. The stated purpose is to stop 3% payroll leakage. Fingerprint scanning at every entrance may address buddy punching, but facial recognition in picking aisles targets 'idle time', which is a different and much broader purpose. Article 5(1)(b) requires purposes to be specified and not extended; continuous productivity surveillance is not necessary to control clocking fraud.
Proportionality. Article 5(1)(c) and Article 25 require data minimisation and privacy by design. A system that sends biometric templates to a vendor cloud is more intrusive than a local badge-plus-PIN or a supervisor check. The claim that hashes are irreversible does not neutralise the risk: matching still occurs in the cloud, so a template that can authenticate is by definition usable, and the vendor is a processor needing an Article 28 contract and a transfer assessment if data leaves the EU.
Lawful basis. Consent is a poor fit in an employment relationship because of the imbalance of power (Recital 43, EDPB guidance): a refusal is not realistically free. Article 6(1)(f) legitimate interest is possible for fraud prevention, but it requires a documented three-part test: a genuine interest, necessity, and a balance that does not override employees' rights, taking account of their reasonable expectations and the availability of less intrusive means. Article 9(2)(b) is only available if Polish law specifically authorises biometric processing in the employment context; otherwise no Article 9 condition exists and the processing is prohibited regardless of Article 6.
Alternatives the DPIA must analyse: badge plus PIN or randomised supervisor checks, spot audits against output data, access-turnstile photo matched manually, and a fingerprint system with local matching only. Choosing the least intrusive effective measure is the core of the proportionality argument, and the works council should be consulted under Polish labour law before any deployment.
3. What must the DPIA actually contain, and what should happen if the residual risk stays high?
Read the worked answer
Required content under Article 35(7):
- Systematic description of the processing and purposes: which entrances, which cameras, what is captured, where templates are stored, who can access them, retention periods, and the vendor's role and location.
- Necessity and proportionality assessment against Article 5 principles: why biometrics rather than a less intrusive alternative, why continuous aisle monitoring is needed at all, and how data minimisation and storage limitation are met.
- Assessment of risks to rights and freedoms, not just to the company: function creep, misidentification, template theft (biometrics cannot be reissued like a password), chilling effects on staff, and the power imbalance in the workplace.
- Measures to address the risks: local matching, template encryption, short retention, access controls, no use of data for performance management without a separate basis, transparency to staff, and a process for deletion on leaving employment.
- Consultation records: the DPO's written advice under Article 35(2), the works council's position, and any external expertise.
If residual risk stays high. Article 36 requires the controller to consult the Polish DPA before processing. The consultation must include the DPIA, the controller's view of the residual risk and the safeguards proposed. The authority may impose conditions or prohibit the processing.
Practical conclusion. On these facts, fingerprint clocking might survive with local matching and strict retention, but aisle facial recognition for idle-time detection is very unlikely to pass the proportionality test. The defensible outcome is a documented decision to drop that element, retain badge-based controls with randomised checks, and record the reasoning - which is exactly what a DPIA is for.