個人資料保護辦公室

Gabinete para a Protecção de Dados Pessoais

Office for Personal Data Protection

Complaint Case Notes
Print

No: 0011/2007/IP

Title: A employer collected fingerprint data of employees

Reason: Complaints

Brief:

    Resident X worked in Company A claimed that Company A compelled its employees to put their signatures as well as their fingerprints on the receipts as they received their wages.
  Resident X believed that Company A’s conduct violated the Personal Data Protection Act, and filed a complaint with this Office (GPDP).

Analysis:

    In accordance with the provisions in articles 4.1.(1) and 3.1 of the Personal Data Protection Act, the data processing involved in this case is within the scope of regulation by the said Act.
  Company A explained the reason why employees were demanded to give their fingerprints as evidence of receipt of payment was because many employees failed to produce signatures that matched the signatures on their ID cards.
  In GPDP’s opinion, fingerprints are biometric features identifying natural persons and thus are personal data protected by the “Personal Data Protection Act”. Personal data must be adequate, relevant and not excessive in relation to the purposes for which they are collected. Unless it is for vital interests or major security reasons, collecting employees’ fingerprints may infringe upon their privacy.
  In GPDP’s opinion, making employees give their fingerprints for receipt of wages is excessive collection of personal data and does not conform to Article 5 of the “Personal Data Protection Act” regarding adequate and relevant handling of personal data. Company A could have achieved the same goal by some other means, for example, paying wages to its employees through bank accounts, requesting employees to collect their wages at designated collection points and put their ID signatures on the wage receipts and so on. There is no need for collecting employees’ fingerprints.
  In summary, the data processing of Company A did not conform to Article 5 of the “Personal Data Protection Act”. Although it did not constitute an administrative offence, there was room for improvement.

Result:

    GPDP sent a letter to Company A, asked it to improve and stop collecting fingerprints for confirming employees’ receipt of wages.
  Company A followed GPDP’s instructions.

Reference:
Please refer to "Personal Data Protection Act", articles 3,4,5 .

Back

Avenida da Praia Grande, N.º 804, Edif. China Plaza, 17.º andar, Macau Tel:(853) 2871 6006 Fax:(853) 2871 6116