Biometric Time Tracking: Is Fingerprint Scanning Allowed Under the GDPR?

Is fingerprint time tracking allowed?

Biometric time tracking by fingerprint is only allowed within narrow limits. Fingerprints belong to the special categories of personal data (Art. 9(1) GDPR), and the Berlin-Brandenburg Regional Labour Court did not consider a biometric time-tracking system necessary in the case it decided (judgment of 4 June 2020, case no. 10 Sa 2130/19). In practice, this usually leaves only voluntary, explicit consent with an equivalent alternative (Art. 9(2)(a) GDPR). If there is a works council, it has a right of co-determination (Section 87(1) No. 6 BetrVG). This does not replace legal advice in an individual case.

Why are fingerprints specially protected in time tracking?

Fingerprints are biometric data used to uniquely identify a person and therefore belong to the special categories of personal data, whose processing is prohibited in principle under Art. 9(1) GDPR.

Since the German Federal Labour Court’s decision of 13 September 2022, employers in Germany have been obliged to systematically record their employees’ working time. Many companies rely on smart solutions for this. Biometric systems, such as those using fingerprints, promise high accuracy and security. But the law only requires that time is recorded – not how. And that is exactly where the problem begins.

Biometric data such as fingerprints is among the most sensitive types of personal data. Its collection and processing are subject to strict data protection rules. In this article, we examine the legal framework and explain why fingerprints generally cannot be used without consent.

The benefits of biometric time tracking

Biometric time tracking systems offer numerous benefits:

• High accuracy: Error-prone manual entries and “buddy punching” are eliminated.
• Authenticity: Only the authorised person can clock in and out.
• Convenience: No need to carry cards, chips or tokens.
• Efficiency: The entire time-tracking process is faster.

Despite these benefits, one thing is crucial: biometrics is not just a tool but a significant intrusion into personal rights. Unlike a password, a fingerprint cannot be changed once it has been compromised.

Which legal bases can justify fingerprint time tracking?

For employers, three routes are particularly relevant: necessity for the employment relationship, a collective agreement and consent. Background: biometric data used to uniquely identify a person belongs to the special categories of personal data (Art. 9(1) GDPR). Processing it is prohibited in principle – unless one of the exceptions in Art. 9(2) GDPR applies. The three routes at a glance:

• Necessity for the employment relationship (Art. 9(2)(b) GDPR, Section 26(3) BDSG): Processing must be necessary to fulfil obligations under employment law. According to case law, biometrics is not necessary for general time tracking in offices or warehouses, because less intrusive means are available. The situation may differ for access control to high-security areas.
• Works agreement (Art. 88 GDPR, Section 26(4) BDSG): A works agreement can serve as a legal basis for data processing but must maintain the level of protection required by the GDPR. It cannot make a disproportionate intrusion lawful.
• Explicit consent (Art. 9(2)(a) GDPR, Section 26(2) BDSG): The most common route in practice – but in an employment relationship it is only valid if it is truly voluntary.

Find out more about legal bases in our article on Art. 6 GDPR.

Does Section 26 BDSG still apply after the CJEU and Federal Labour Court rulings?

Not without further ado for Section 26(1) sentence 1 BDSG: in its judgment of 8 May 2025 (8 AZR 209/21), the German Federal Labour Court (BAG) held that this provision does not meet the requirements of the opening clause in Art. 88 GDPR because safeguards under Art. 88(2) GDPR are missing. It therefore remains unapplied, and where no valid more specific rules exist, the GDPR applies directly.

What this means for Section 26(2) to (4) BDSG is open. The BAG case did not concern biometrics but the transfer of employee data for testing new HR software. The judgment does not address Section 26(2) and (3) BDSG, and the BAG left open whether a works agreement under Section 26(4) BDSG is a more specific rule within the meaning of Art. 88 GDPR. The CJEU had already addressed a comparable state provision on 30 March 2023 (C-34/21); how far Section 26 BDSG can still serve as an independent legal basis has been disputed since then. You should therefore align your processing directly with the GDPR (Art. 6, Art. 9(2)) and have the individual case reviewed legally.

When is consent to fingerprint time tracking valid?

Consent in an employment relationship is only valid if it is voluntary, informed, explicit and revocable. Because biometrics is generally not necessary for time tracking, explicit consent is usually the only option. In an employment relationship, however, it is tricky, as employees depend on their employer. In detail, it must be:

• voluntary – without pressure or disadvantages for refusing,
• informed – including purpose, storage period and right of withdrawal,
• explicit (Art. 9(2)(a) GDPR) and – where Section 26(2) BDSG applies – generally given in writing or electronically,
• revocable at any time.

This means companies must offer a genuine choice by providing an alternative time-tracking method. Anyone who does not consent can, for example, clock in with a card or PIN. Without this alternative, consent is not valid.

Does the works council have to agree (Section 87(1) No. 6 BetrVG)?

Yes. If the company has a works council, it has a right of co-determination when biometric time tracking is introduced (Section 87(1) No. 6 of the German Works Constitution Act, BetrVG). This applies to all technical equipment capable of monitoring employees’ behaviour or performance. Without the works council’s consent or a ruling by the conciliation committee, the system may not be introduced. In practice, the introduction is regulated in a works agreement that also defines the purpose, access rights and deletion periods.

What have courts and regulators decided?

The key decision on fingerprint time tracking comes from Berlin:

• Berlin Labour Court, judgment of 16 October 2019 (case no. 29 Ca 5451/19): An employee had refused to use a fingerprint time-tracking system and received a formal warning. The court ruled that the warning was invalid: without consent, the processing was not permitted, because it is not necessary for time tracking.
• Berlin-Brandenburg Regional Labour Court, judgment of 4 June 2020 (case no. 10 Sa 2130/19): The court upheld the decision on appeal.
• Regulators: The German Data Protection Conference (DSK) emphasises that consent in an employment relationship is only valid if a genuine alternative exists and no de facto pressure is applied.

These decisions show: requiring employees to use biometric time tracking without their consent is unlawful – regardless of any technical safeguards.

Which alternatives are there to fingerprint scanning?

There are several alternatives that involve much less intrusion:

• RFID cards or chips with an employee ID
• Terminals with PIN entry
• Digital time clocks with access controls
• Browser- or app-based time tracking with manual entries

These systems also need to be configured in a privacy-compliant way. For apps: only collect location data where it is truly necessary – permanent location tracking (e.g. via geofencing) is also a significant intrusion and only permitted within narrow limits.

What should you check before introducing it?

If you still decide to use a biometric system, check these points before introduction:

1. Check whether a data protection impact assessment is required: Art. 35(3)(b) GDPR names processing on a large scale of special categories of personal data (Art. 9(1) GDPR) as a case that requires a DPIA. Whether your processing is “large scale” depends on the individual case; clarify this with your data protection advisor, for example an external data protection officer. More about the DPIA.
2. Involve the works council and conclude a works agreement.
3. Obtain voluntary, documented consent.
4. Offer alternatives – for anyone who does not consent.
5. Fulfil information obligations under Art. 13 GDPR.
6. Choose data-minimising technology: store only encrypted templates instead of fingerprint images, ideally decentralised on the employee’s card rather than in a central database.
7. Implement technical and organisational measures such as encryption, access controls and a deletion concept, and document all processing steps (accountability, Art. 5(2) GDPR), for example in the record of processing activities.
8. Train and raise awareness among employees.

Depending on how you use the system, further points apply: if a service provider operates the system or stores the data, check whether a data processing agreement is needed. If the software analyses data with AI, the AI in HR compliance checklist helps. And in the event of a data breach, Art. 33(1) GDPR applies: the breach of personal data security must be reported to the supervisory authority without undue delay and, where feasible, within 72 hours, unless it is unlikely to result in a risk to the rights and freedoms of natural persons – read more in Reporting a data breach step by step in 72 hours.

Conclusion: biometrics only with caution and strong safeguards

Biometric time tracking systems offer real benefits but are a high-risk topic from a data protection perspective. Without explicit, voluntary consent, a genuine alternative and – where applicable – the works council’s approval, they generally may not be used.

Companies should critically assess whether the added value justifies the intrusion into employees’ fundamental rights or whether a more data-minimising approach is the better choice. Trust isn’t built through technology alone, but through transparency, respect and legally sound practices.

With heyData, you introduce new systems such as time tracking in a privacy-compliant way: with data protection impact assessments, consent templates and experts who support you with every question.

Take the first step: Book a free demo now