Contents
Biometrics is the exception, not the technology of choice
A fingerprint is biometric data for unique identification and therefore falls under Article 9(1) GDPR. Processing such data is in principle prohibited and permitted only where one of the exemptions applies.
In the employment relationship, Article 9(2)(b) GDPR is the main candidate, together with section 26(3) BDSG. Both require necessity, and that is exactly where time tracking fails: it can equally be achieved with a card, a fob, a PIN or an app.
On 16/10/2019 the Berlin Labour Court ruled (29 Ca 5451/19) that time tracking by fingerprint without consent is not necessary and therefore impermissible. A warning letter for refusing to use the system had to be removed from the personnel file.
Why consent rarely helps
In theory consent is possible (Article 9(2)(a) GDPR, section 26(2) BDSG). In practice it almost never holds up in an employment relationship: it has to be freely given, and freedom requires a genuine choice without detriment. Anyone who can only clock in with a finger has none.
On top of that, consent can be withdrawn at any time. A system that does not work for part of the workforce because they have withdrawn needs a second route anyway, and then the second route is the only one needed.
The works council has codetermination rights on introduction (section 87(1) no. 6 BetrVG), and processing special categories regularly requires a data protection impact assessment under Article 35 GDPR.
What works instead
Each of these variants satisfies the record-keeping duty without processing special categories of personal data.
| Route | What it suits | What to bear in mind |
|---|---|---|
| Card or key fob at the terminal | Production, trades, practices: anywhere not everyone has a work phone. | A lost card is blocked and reassigned. That process belongs in the log. |
| PIN at the terminal | As a second route when the card is missing. | PINs get passed on. So as the sole route only with a clear rule. |
| An app on a personal or work phone | Field work, building sites, working from home. | A location is not needed for this and should not be collected. |
| Web recording at the workplace | Office and knowledge work. | The simplest route where people are working at a computer anyway. |
Card or key fob at the terminal
- What it suits
- Production, trades, practices: anywhere not everyone has a work phone.
- What to bear in mind
- A lost card is blocked and reassigned. That process belongs in the log.
PIN at the terminal
- What it suits
- As a second route when the card is missing.
- What to bear in mind
- PINs get passed on. So as the sole route only with a clear rule.
An app on a personal or work phone
- What it suits
- Field work, building sites, working from home.
- What to bear in mind
- A location is not needed for this and should not be collected.
Web recording at the workplace
- What it suits
- Office and knowledge work.
- What to bear in mind
- The simplest route where people are working at a computer anyway.
Facial recognition is the same case
What applies to a fingerprint applies equally to any facial image used for identification: it is biometric data under Article 9 GDPR. A terminal with a camera that recognises people therefore processes a special category of personal data and needs the same justification that is regularly absent for time tracking.
Anyone running such a system needs a data protection impact assessment, works council codetermination and a solid legal basis. Anyone not running one needs none of it.
This is not legal advice; for a specific case at your workplace you are better off asking someone qualified to give it.
Published by: AMNAU GmbH
Editorial responsibility: Ugur Aydogan, Product development.
Last reviewed: 15 September 2026