Law note · Germany
GDPR Article 9 and BDSG Section 26(3), Special Categories and Employment Biometric Data in Germany
General Data Protection Regulation (GDPR) Article 9(1) governs biometric data as a special category. BDSG Section 26(3), the provision governing special category data in employment, was upheld as GDPR-compatible and is the controlling provision for a workplace-deployed biometric time clock, access control, or voice-authentication system; Section 26(1), the general employment lawful-basis clause, was found incompatible with GDPR's own conditions and cannot be relied on alone.
Consent is disfavored as the legal basis in an employment relationship because of the power imbalance, so employers typically rely on necessity under Section 26(3) or Article 9(2) rather than Article 9(2)(a) consent. A voiceprint or faceprint captured for identification is covered identically to a fingerprint; GDPR draws no distinction by modality.
Germany's leading biometric enforcement precedent is the Hamburg Commissioner for Data Protection and Freedom of Information's 2021 order against Clearview AI to delete a German complainant's biometric identifier, the first such order against Clearview worldwide.
What it asks of an app
- Where you deploy a biometric time clock, access control system, or voice-authentication system for employees in Germany, satisfy BDSG Section 26(3)'s conditions rather than relying on employee consent as the sole basis.
- Treat any biometric identifier your system derives through its own technical processing as General Data Protection Regulation (GDPR) Article 9 special category data, whether or not the source photo or audio was publicly available.
When LexLint raises it
Declared activities: processes_biometrics, processes_voice, high_risk_decisions
Primary source: Official Journal text, EUR-Lex, Regulation (EU) 2016/679
BDSG §26(3); Hamburg Commissioner Clearview AI order (2021)