Fingerprint and face scan time tracking: is it allowed?

Is time tracking by fingerprint or face scan allowed?

Time tracking by fingerprint or face scan is not permitted in most cases. Both methods process biometric data, which is given special protection under the GDPR. Without the voluntary consent of employees or a compelling necessity, companies are generally not allowed to use such systems – as a recent ruling by the Berlin-Brandenburg Regional Labour Court (Landesarbeitsgericht, LAG) shows.

Die wichtigsten Fragen im Überblick

Can employees be forced to clock in with a fingerprint?

In short: no. The Berlin-Brandenburg Regional Labour Court has ruled clearly that fingerprints (even where only partial features are stored) are sensitive biometric data. Without your express, voluntary consent, your employer cannot impose such a system, unless there is concrete evidence of large-scale abuse within the business.

Is a face scan allowed as a digital time clock?

Here too, extreme caution applies. The European General Data Protection Regulation (GDPR) classifies facial recognition as the processing of sensitive biometric data. A court in Spain recently fined a company more than €53,000 because it forced employees to use a face scan even though milder alternatives were available.

So how do we make sure nobody clocks in for a colleague?

The answer is: trust and smart digital solutions instead of surveillance. If you want to put a fixed time tracking terminal up in your business, an ordinary tablet is perfectly enough. With clockin every employee gets a personal, secure PIN to log in with.

Time tracking by fingerprint: what employment law says

A recent ruling by the Berlin-Brandenburg Regional Labour Court (Landesarbeitsgericht, LAG) shows very clearly where the legal limits of biometric checks lie. An employee at a medical practice refused to have his fingerprint scanned at the new time tracking terminal, and promptly collected written warnings from his boss.

The court decided clearly, however: the employee was in the right. Fingerprints – even where an algorithm stores only certain ridge branchings (known as minutiae) – count as sensitive biometric data. Without the express and voluntary consent of the employees, such a system is simply not permitted.

A fingerprint scanner may only be used where it is strictly necessary, for instance where there is concrete evidence of large-scale abuse within the business. But since one has to assume as a matter of principle that the vast majority of employees behave lawfully, the boss was not allowed to impose the scan and had to remove the written warning from the employee file.

Fingerprint scanners or facial recognition used for time tracking count as the processing of biometric data and are permitted under the GDPR only under very strict conditions.

Face scan at work: an expensive data protection breach

A similar case became even more expensive for a company in Spain. The High Court in Galicia fined a firm a hefty €53,000 and more. The reason? An employee was forced to clock in and out by facial recognition, even though far milder alternatives such as a conventional chip card or PINs would have been available.

Does that concern us in Germany at all? Absolutely! Both court rulings rest on the same legal basis: the strict European General Data Protection Regulation (GDPR). It clearly classifies facial recognition as the use of sensitive biometric data. So anyone in Germany who relies on face scans as a digital time clock without a compelling necessity also risks heavy fines and compensation payments.

In practice, biometric time tracking systems are legally problematic in many companies, because milder alternatives such as a PIN, a chip card or app-based time tracking usually exist.

Trust instead of surveillance: how digital time tracking works

One thing matters a great deal to us at clockin: time tracking means transparency, not surveillance. It makes work visible, protects you from miscalculation and creates fairness – but it is no substitute for company culture. A strong team works through trust and collaboration as equals.

The simple alternative: time tracking with clockin

We believe in clarity instead of complexity. You need a tool that adapts to your day-to-day work, with no frills and no legal grey areas. That is exactly why clockin deliberately does without excessive features such as fingerprint scanners or facial recognition.

How do you still get complete security and correct hours with clockin? Quite simply:

A central tablet terminal with a PIN: You can put a fixed tablet up in your workshop or break room. Every employee gets an individual, secure PIN. That way everyone clocks in quickly and tamper-proof, entirely without sensitive biometric data.
More flexible by smartphone: Are your doers out and about a lot on job sites or at customers? Then they simply use the clockin app on their smartphone.
Comfortable at the desk: Anyone working in the office or from home logs in easily in the web browser on their PC and starts the clock.

With clockin you save yourself expensive special hardware, biometric systems that risk formal warnings, and complicated training. It is so intuitive to use that your whole team can start straight away.