# Unknown Organisation: Insufficient legal basis for data processing

- Type: Enforcement
- Source: Autoriteit Persoonsgegevens
- Date: 2020-04-30
- Original: https://www.enforcementtracker.com/ETid-274
- Canonical: https://overview.legal/posts/46389
- Topics: Consent, Biometric Data, Biometric Data, Personal Data, Employees, Processing, Supervisory Authorities, Supervision

## Summary

The organisation had required its staff to have their fingerprints scanned to record attendance. However, as the decision of the data protection authority stated, the organisation could not rely on exceptions to the processing of this special category of personal data and the company could also not provide any evidence that the employees had given their consent to this data processing.

## Full text

The organisation had required its staff to have their fingerprints scanned to record attendance. However, as the decision of the data protection authority stated, the organisation could not rely on exceptions to the processing of this special category of personal data and the company could also not provide any evidence that the employees had given their consent to this data processing.

GDPR Articles: Art. 5 GDPR, Art. 9 GDPR
Industry: Employment

---
Generated by overview.legal · https://overview.legal/posts/46389 · 2026-08-22