個人資料保護辦公室

Gabinete para a Protecção de Dados Pessoais

Office for Personal Data Protection

Enquiry Case Notes
Print

No: 0112/2011/RP

Title: Using a fingerprint data system or facial recognition system for establishing staff identities

Content:

    Company A enquired the GPDP about using a fingerprint data system or facial recognition system for establishing staff identities

Result:

    Under its Articles 4(1)(1) and 3, the Personal Data Protection Act regulates the data processing aforementioned. Since Company A did not specify the purposes or issues involved, the GPDP could only answer the enquiry as a general remark.
  Regarding the use of biometric system, legitimacy, proportionality and the precautions required vary according to the purposes of its use. Therefore, guidelines and recommendations issued by the GPDP may be consulted, including the Issues Relating to Using Fingerprint/Hand Geometry Devices to Check on Work Attendance; On Using Attendance Devices of Biometric Technologies Other Than Fingerprint or Hand-geometry Identification; and On Using Facial Identification Attendance Control Systems.
  In addition, using biometric system for establishing employee identities is considered as automated processing of personal data. In accordance with Article 21 of the Personal Data Protection Act, a data controller must notify GPDP within 8 days after initiation of such processing.

Reference:
Please refer to "Personal Data Protection Act", articles 3,4,21 .

Back

Avenida da Praia Grande, N.º 804, Edif. China Plaza, 17.º andar, Macau Tel:(853) 2871 6006 Fax:(853) 2871 6116