The Polish Supreme Administrative Court (the Supreme Court) ruled on 1 December 2009 that employers are not allowed to process employee biometric data for the purpose of recording work time.

The case concerned the introduction of a system of recording work time based on employee fingerprint recognition by LG Electronics ("LGE"). LGE was processing this data with the explicit written consent of employees. Employees were allowed to choose whether their work time would be recorded by means of electronic cards or fingerprint recognition.

The Polish Data Protection Authority (GIODO) decided that LGE should cease the processing of biometric data, as such data was being processed without a proper legal basis. The employees' consent would not suffice to legitimise the process. In GIODO's opinion, the Polish Labour Code (PLC) provides an exhaustive list of what data can be legitimately processed by an employer, including name, surname, date of birth, address, national identification number, education, previous experience, and other data, if such data is necessary to provide the employee with his/her entitlements resulting from employment law or if the employee is obliged to disclose such data by law. Biometric data is not included on that list.

LGE appealed, and the Warsaw Province Administrative Court decided that biometric data could be lawfully processed with an employee's consent.

The Supreme Court, however, overturned that Court's decision, holding that only such data specified in PLC or other regulations can be lawfully processed by an employer. An employee cannot effectively consent to the processing of wider data, because they are dependent on the employer, and therefore their consent cannot be freely given. The Supreme Court also held that processing biometric data for the purpose of recording work time is disproportionate and inadequate for the purpose, and therefore illegal.

The ruling will have a substantial impact on employee data processing. Not only does it clarify that employers in Poland cannot legitimately use employee biometric data, but it also states that Polish employers are only allowed to process such employee data as is explicitly specified in PLC or other regulations.