Fingerprint and face recognition clocks stop staff clocking in for each other. But when you use a fingerprint or a face to identify someone, UK GDPR treats it as special category data, so the law asks more of you. Here is what it asks, what went wrong when the ICO took action against one large employer, and how to get it right.
In short:
- Fingerprints and face scans used to identify staff are special category data under UK GDPR.
- You need a lawful basis and a special category condition, and you must complete a DPIA before you start.
- Be ready to show why a card, fob, code or app would not do the job.
- Consent is the most likely lawful basis, but only if staff can say no and clock in another way without losing out.
- In 2024 the ICO ordered Serco Leisure and seven leisure trusts to stop using face and fingerprint scanning to check staff attendance.
- The ICO’s guidance is under review after the Data (Use and Access) Act, so check for updates.
Is fingerprint clocking in legal in the UK?
Yes, it can be. But the ICO’s guidance on biometric time and access control makes clear that employers need to show it is necessary, have the right legal reasons, complete a data protection impact assessment, and offer staff another way to clock in. The ICO has ordered at least one employer to stop when it could not show this.
Why are fingerprints treated differently?
Article 9 of UK GDPR lists “biometric data for the purpose of uniquely identifying a natural person” as special category data. That covers fingerprint and face recognition clocks. Unlike a password or an ID card, a fingerprint can’t be changed if it leaks.
- Lawful basis. The usual reason you need to use any personal data.
- Special category condition. A second legal reason, needed for special category data.
- Higher risk. A data protection impact assessment is required before you start.
What went wrong for Serco Leisure?
On 23 February 2024, the ICO ordered Serco Leisure, Serco Jersey and seven community leisure trusts to stop using face and fingerprint scanning to monitor staff attendance, and to destroy any biometric data they were not legally required to keep. More than 2,000 staff at 38 leisure facilities were affected.
- Not shown to be necessary. The ICO said less intrusive options, such as ID cards or fobs, were available.
- No alternative offered. Staff were not proactively offered another way to clock in, and scanning was presented as a requirement for getting paid.
- No real choice. Because of the power imbalance between employer and staff, the ICO found staff were unlikely to feel able to say no.
- The wrong legal reason. Serco relied on its duties as an employer to record working time, but the ICO found biometrics were not necessary to meet them (Slaughter and May summary).
Do you need staff consent?
Usually. The ICO says consent is the most likely lawful basis for biometric time and access control, but only if there is a non-biometric alternative and staff are not disadvantaged for choosing it. If there is no alternative, consent will not be appropriate.
In practice, that means offering a card, a code or an app to anyone who says no, with no penalty for using it.
Do you need a DPIA?
Yes. The ICO’s guidance says you must carry out a data protection impact assessment whenever you intend to use biometric data to uniquely identify a worker, and you must do it before you start. Article 35 of UK GDPR sets out what a DPIA must cover.
If you use face recognition, the ICO also warns that it can work less accurately for some groups of people, so your DPIA should check for bias and how you will reduce it.
Tips for using fingerprint clocks lawfully
- Name the problem. Write down what you are trying to fix, such as buddy clocking, and the evidence for it.
- Try the gentler options first. Check whether cards, one-use codes or the app would do the job. If they would, use them.
- Complete a DPIA. Do it before you start, and talk it through with staff.
- Choose your legal reasons. Pick a lawful basis and a special category condition, and record why they fit.
- Offer an alternative. Give staff who say no another way to clock in, with no penalty.
- Tell staff. Update your privacy notice to explain what you collect, why, and for how long.
- Keep it safe and short. Store templates securely, keep them apart from other records, and delete them when they are no longer needed.
Stopping buddy clocking, without the fingerprints
Sense HR gives you ways to stop buddy clocking that don’t use fingerprints at all: one-use QR codes, one phone per account, and badges. If you do choose a fingerprint or face clock, staff who say no can use a card or the app instead, and every clock-in lands in the same record.