At our company, we are discussing allowing (but not forcing) the use of facial recognition to authenticate on employee laptops (Windows Hello). The laptops are owned by the company, but are for individual use.
Someone is concerned that enabling the feature and collecting the biometric data is not a necessary measure, and is therefore against the data minimization obligation of GDPR. They are also concerned about the obligation our company has with regards to this data once it is collected.
I've argued that this is a feature that employees want, and that biometric data is necessary to use the service. Only employees who consent to the use of their facial data can use the service.
Additionally, the data is collected and stored locally, by software designed by Microsoft. No one can access it. I don't even see how our company could be considered either Controller or Processor of this data.
As a compromise, we've proposed to extensively inform employees about what it means to use Windows Hello in terms of privacy (basically make a presentation from the Microsoft documentation) but this isn't completely satisfactory for them.
What responsibilities does a company have when allowing it's employees to use biometric authentication provided by another company?