Ireland: Workplace biometrics cause controversy

In recent months, Ireland’s Data Protection Commissioner has been expressing increasing concern - shared by some trade unions - about the spread of workplace biometric systems that use data such as fingerprints and handprints to monitor employees’ attendance.

On this page:
Background
The Abbey Theatre case
Increased concern

Background

Over recent years, an increasing number of Irish employers have introduced biometric systems in the workplace, often to monitor employees’ clocking-in and clocking-out times and attendance. These systems involve the automatic identification or authentication/verification of a person, using biometric data. These data may be created from a person’s physical or physiological characteristics, typically a fingerprint, iris, retina, face, outline of a hand, shape of an ear, voice pattern, DNA or body odour. Biometric data may also be created from behavioural data such as handwriting or keystroke analysis. Generally, a digitised template is produced from the biometric data, which is compared with one produced when an employee presents at a reader.

Ireland’s first high-profile dispute over the use of workplace biometric systems arose in 2005, when staff at the National Gallery of Ireland complained to the Data Protection Commissioner - which oversees Ireland’s data protection legislation - that a planned fingerprint-based clocking-in system was in breach of the law. The commissioner investigated and concluded that, in the circumstances, the system was proportionate and did not constitute an unjustified interference with the privacy rights of individuals. However, with biometrics increasingly controversial, the commissioner published guidance on their use at the workplace (on the Data Protection Commissioner Ireland website).

The guidance aims to act as an aid to employers seeking to use a biometric system in the workplace, making them aware of their responsibilities under the data protection legislation. It encourages employers to consider fully if there is a need for a biometric system in the first place and then to assess the privacy impact of different systems. The recommended approach is that biometric systems should not be approved or condemned in a general way, but that situations must be judged on a case-by-case basis.

The number of organisations that have introduced workplace biometric systems is not known, but reported examples include Cavan and Galway county councils; the City of Dublin Vocational Education Committee; the Services, Industrial, Professional and Technical Union (SIPTU); the National Concert Hall; and the Abbey Theatre. Time Point, a Dublin-based provider of “biometric employee time recording solutions”, states that more than 1,000 businesses use its systems.

The Abbey Theatre case

In summer 2006, the Abbey Theatre introduced a “biometric time-and-attendance system” at its premises in Dublin, which it stated was one of a number of organisational and managerial changes aimed at remaining financially viable. The system was introduced in two phases, the first relating to the health and safety of the theatre’s 100 or so full-time staff and the second to monitoring their time and attendance. The system requires a fingertip to be inserted into a reader that converts the fingerprint into an encrypted algorithm; the worker then enters a unique PIN number onto a pad.

Most Abbey Theatre staff, many of whom are SIPTU members, used the new system but four members of the Building and Allied Trades’ Union (BATU), who are employed building sets, refused to do so. The dispute could not be resolved locally and was referred to conciliation under the auspices of the Labour Relations Commission. As no agreement was reached, the dispute was referred to the Labour Court in October 2006.

BATU argued before the Labour Court that the biometric system impinges on the fundamental rights of each worker using the system as it may store their fingerprint, and that a key criterion in introducing these systems must be the worker’s consent. The Abbey Theatre argued that there could be no infringement of fundamental rights, as copies of fingerprints are not stored nor can they be retrieved from the new system. The employer reported that the Data Protection Commissioner had reviewed the system and agreed that it was compliant with all data protection legislation. Further, in return for paying wage increases under recent national agreements, the employer said that it had a right to expect compliance with “technological advancement”.

In its recommendation (No.18914) issued on 13 June 2007, the Labour Court noted the safeguards built into the new time-management system. It regarded use of the system as “normal ongoing change” and recommended that the BATU members comply with use of the system.

However, the matter did not rest there. In late July, the Data Protection Commissioner, Billy Hawkes, reportedly wrote to the Abbey Theatre criticising the biometric time-and-attendance system. According to the Irish Independent newspaper, he warned the theatre that forcing workers to provide fingerprints to clock in could breach data protection legislation, and argued that most employers use “other less intrusive measures” to keep records, including cards or PIN numbers. BATU then sent a letter to the Labour Court, arguing that the commissioner’s position supported its argument in the earlier case that the system was an infringement of fundamental human rights and privacy, and seeking a review of the recommendation.

Increased concern

August brought further evidence of the Data Protection Commissioner’s increasing disquiet at the rapid spread of workplace biometrics, after the Gresham Hotel in Dublin introduced a handprint-based system. The technology records employees clocking in and out by recognising five points on their hand. Staff claimed that there had been no dialogue over the introduction of the system and SIPTU announced that it would investigate whether the rights of workers at the hotel were being breached.

After the Gresham Hotel scheme became public, the Data Protection Commissioner said that he was “concerned” about the growing use of biometric systems in the workplace “regardless of the type of biometric information collected or the technology used”. The commissioner’s office stated that it “expects full justification in any particular scenario for the introduction of a biometric system”. This could include progression through alternative systems, including swipe cards and PIN codes, before the introduction of a biometric system was considered. “This office has not been contacted by the Gresham Hotel in relation to the introduction of a biometric system for its employees,” a spokesperson told the Irish Independent.

Some commentators believe that the tougher line indicated by the Data Protection Commissioner’s recent comments may result in more stringent requirements for employers to justify existing and new workplace biometric systems.

This article was written by Mark Carley, editor, European Employment Review.

European Employment Review 405 (EER 405) contents