Biometric authentication

What it means

Biometric authentication verifies identity by unique physical or behavioural traits such as fingerprints, face, iris or voice. It is used to unlock phones, sign in to apps, enter buildings or confirm payments.

Unlike a password, biometrics cannot be forgotten or simply given away. They are often part of two-factor authentication or passkeys, where biometrics unlock a key stored on the device.

Biometric data used to uniquely identify a person are a special category of personal data under the GDPR. Processing them is prohibited in principle and allowed only under strict exceptions.

How it works in practice

If biometrics stay on an employee's own phone and the company has no access to them, this is a safe and common solution. The company only receives confirmation that verification succeeded, not the biometric data.

It is different when an employer introduces fingerprint or face recognition time clocks and stores biometric templates centrally. For attendance records the Slovak supervisory authority has repeatedly found such solutions disproportionate.

Before introducing biometrics, a data protection impact assessment is needed, less intrusive alternatives such as chip cards should be considered and employees offered a choice.

What to watch out for

A stolen password can be changed; a stolen fingerprint cannot. Leaks of biometric templates are therefore especially serious, and central storage requires strong encryption and access control.

Employee consent is not a reliable lawful basis for biometrics, because employees are not on an equal footing. Introducing biometrics without proper assessment risks a fine and an order to delete the data.