Biometric Time Tracking: Why Fingerprint Scanning Requires Employee Consent

Is fingerprint time tracking allowed?

Fingerprint time tracking is only allowed within narrow limits. Fingerprints are biometric data and therefore specially protected (Art. 9 GDPR). According to case law, they are not necessary for regular working time recording, because cards, PINs or apps serve the same purpose. In practice, this usually leaves only the voluntary, explicit consent of employees – with a genuine alternative for anyone who does not consent. If there is a works council, it must also agree.

Time tracking goes smart – but is it legal?

Since the German Federal Labour Court’s decision of 13 September 2022, employers in Germany have been obliged to systematically record their employees’ working time. Many companies rely on smart solutions for this. Biometric systems, such as those using fingerprints, promise high accuracy and security. But the law only requires that time is recorded – not how. And that is exactly where the problem begins.

Biometric data such as fingerprints is among the most sensitive types of personal data. Its collection and processing are subject to strict data protection rules. In this article, we examine the legal framework and explain why fingerprints generally cannot be used without consent.

The benefits of biometric time tracking

Biometric time tracking systems offer numerous benefits:

• High accuracy: Error-prone manual entries and “buddy punching” are eliminated.
• Authenticity: Only the authorised person can clock in and out.
• Convenience: No need to carry cards, chips or tokens.
• Efficiency: The entire time-tracking process is faster.

Despite these benefits, one thing is crucial: biometrics is not just a tool but a significant intrusion into personal rights. Unlike a password, a fingerprint cannot be changed once it has been compromised.

Legal basis: what the GDPR and German law require

Biometric data used to uniquely identify a person belongs to the special categories of personal data (Art. 9(1) GDPR). Processing it is prohibited in principle – unless one of the exceptions in Art. 9(2) GDPR applies. For employers, three routes are particularly relevant:

• Necessity for the employment relationship (Art. 9(2)(b) GDPR, Section 26(3) BDSG): Processing must be necessary to fulfil obligations under employment law. According to case law, biometrics is not necessary for general time tracking in offices or warehouses, because less intrusive means are available. The situation may differ for access control to high-security areas.
• Works agreement (Art. 88 GDPR, Section 26(4) BDSG): A works agreement can serve as a legal basis for data processing but must maintain the level of protection required by the GDPR. It cannot make a disproportionate intrusion lawful.
• Explicit consent (Art. 9(2)(a) GDPR, Section 26(2) BDSG): The most common route in practice – but in an employment relationship it is only valid if it is truly voluntary.

There is also some uncertainty: on 30 March 2023, the CJEU ruled (C-34/21) that a state provision comparable to Section 26(1) BDSG did not meet the requirements of the GDPR. Since then, it has been disputed how far Section 26 BDSG can still serve as an independent legal basis. Companies should therefore align their processing directly with the GDPR. Find out more about legal bases in our article on Art. 6 GDPR.

Why consent is usually the only option

Because biometrics is generally not necessary for time tracking, explicit consent is usually the only option. In an employment relationship, however, it is tricky, as employees depend on their employer. Consent is therefore only valid if it is:

• voluntary – without pressure or disadvantages for refusing,
• informed – including purpose, storage period and right of withdrawal,
• explicit and generally documented in writing or electronically (Section 26(2) BDSG),
• revocable at any time.

This means companies must offer a genuine choice by providing an alternative time-tracking method. Anyone who does not consent can, for example, clock in with a card or PIN. Without this alternative, consent is not valid.

The role of the works council

If the company has a works council, it has a right of co-determination when biometric time tracking is introduced (Section 87(1) No. 6 of the German Works Constitution Act, BetrVG). This applies to all technical equipment capable of monitoring employees’ behaviour or performance. Without the works council’s consent or a ruling by the conciliation committee, the system may not be introduced. In practice, the introduction is regulated in a works agreement that also defines the purpose, access rights and deletion periods.

Court rulings and regulators: where the lines have been drawn

The key decision on fingerprint time tracking comes from Berlin:

• Berlin Labour Court, judgment of 16 October 2019 (case no. 29 Ca 5451/19): An employee had refused to use a fingerprint time-tracking system and received a formal warning. The court ruled that the warning was invalid: without consent, the processing was not permitted, because it is not necessary for time tracking.
• Berlin-Brandenburg Regional Labour Court, judgment of 4 June 2020 (case no. 10 Sa 2130/19): The court upheld the decision on appeal.
• Regulators: The German Data Protection Conference (DSK) emphasises that consent in an employment relationship is only valid if a genuine alternative exists and no de facto pressure is applied.

These decisions show: requiring employees to use biometric time tracking without their consent is unlawful – regardless of any technical safeguards.

Possible alternatives to fingerprint scanning

There are several alternatives that involve much less intrusion:

• RFID cards or chips with an employee ID
• Terminals with PIN entry
• Digital time clocks with access controls
• Browser- or app-based time tracking with manual entries

These systems also need to be configured in a privacy-compliant way. For apps: only collect location data where it is truly necessary – permanent location tracking (e.g. via geofencing) is also a significant intrusion and only permitted within narrow limits.

Best practices for introducing biometric time tracking systems

If a company still decides to use biometric systems, the following points should be observed:

1. Conduct a data protection impact assessment under Art. 35 GDPR – for biometrics in the workplace, it is generally mandatory. More about the DPIA.
2. Involve the works council and conclude a works agreement.
3. Obtain voluntary, documented consent.
4. Offer alternatives – for anyone who does not consent.
5. Fulfil information obligations under Art. 13 GDPR.
6. Choose data-minimising technology: store only encrypted templates instead of fingerprint images, ideally decentralised on the employee’s card rather than in a central database.
7. Implement technical and organisational measures such as encryption, access controls and a deletion concept, and document all processing steps (accountability, Art. 5(2) GDPR).
8. Train and raise awareness among employees.

Conclusion: biometrics only with caution and strong safeguards

Biometric time tracking systems offer real benefits but are a high-risk topic from a data protection perspective. Without explicit, voluntary consent, a genuine alternative and – where applicable – the works council’s approval, they generally may not be used.

Companies should critically assess whether the added value justifies the intrusion into employees’ fundamental rights or whether a more data-minimising approach is the better choice. Trust isn’t built through technology alone, but through transparency, respect and legally sound practices.

With heyData, you introduce new systems such as time tracking in a privacy-compliant way: with data protection impact assessments, consent templates and experts who support you with every question.

Take the first step: Book a free demo now