Enquiry Case Notes

編號: 0112/2011/RP

標題: Using a fingerprint data system or facial recognition system for establishing staff identities

查詢內容:

    Company A enquired the GPDP about using a fingerprint data system or facial recognition system for establishing staff identities

回覆內容:

    Under its Articles 4(1)(1) and 3, the Personal Data Protection Act regulates the data processing aforementioned. Since Company A did not specify the purposes or issues involved, the GPDP could only answer the enquiry as a general remark.
  Regarding the use of biometric system, legitimacy, proportionality and the precautions required vary according to the purposes of its use. Therefore, guidelines and recommendations issued by the GPDP may be consulted, including the Issues Relating to Using Fingerprint/Hand Geometry Devices to Check on Work Attendance; On Using Attendance Devices of Biometric Technologies Other Than Fingerprint or Hand-geometry Identification; and On Using Facial Identification Attendance Control Systems.
  In addition, using biometric system for establishing employee identities is considered as automated processing of personal data. In accordance with Article 21 of the Personal Data Protection Act, a data controller must notify GPDP within 8 days after initiation of such processing.

註:
Please refer to "Personal Data Protection Act", articles 3,4,21 .