The Superintendence of Personal Data Protection addressed a citizen inquiry regarding the use of a biometric system for attendance registration in the workplace and its implementation in companies. Through official communication No. SPDP-IRD-2025-0031-O, the authority states:

1. The Data Protection Law (DPL) classifies biometric data as sensitive data, as it contains unique information about a natural person. Generally, the DPL prohibits its processing; however, it establishes specific exceptions, including consent.
2. For consent to be considered valid, it must be free, specific, informed, and unequivocal. Regarding the requirement of freedom, Data Protection Law specifies that this is only met when consent is free of defects, meaning that the individual’s decision must not be conditioned or unduly influenced.
3. The Superintendence of Personal Data Protection (SPDP) considers that an employee’s consent may be flawed due to reverential fear, given the hierarchical relationship between the parties. This concept refers to the fear of displeasing individuals to whom one owes submission and respect, such as supervisors or hierarchical superiors.
4. In this regard, the use of such a biometric system, according to the SPDP, would be flawed due to the lack of an adequate legal basis, as well as its failure to meet the proportionality principle.

Conclusion:

The SPDP considers that:

• The use of biometric data for employee attendance registration by the employer is disproportionate and unnecessary; therefore, its implementation is not recommended.
• Regarding explicit consent, it is not considered to be freely given, and thus, requesting it is not required.
• Additionally, the processing of such data without consent is not justified under any of the legitimate grounds established in Data Protection Law.

If additional information is required, as well as recommendations on how to proceed, we remain at your disposal.

If you require legal advice, contact our team