At our company, we are discussing allowing (but not forcing) the use of facial recognition to authenticate on employee laptops (Windows Hello). The laptops are owned by the company, but are for individual use.

Someone is concerned that enabling the feature and collecting the biometric data is not a necessary measure, and is therefore against the data minimization obligation of GDPR. They are also concerned about the obligation our company has with regards to this data once it is collected.

I've argued that this is a feature that employees want, and that biometric data is necessary to use the service. Only employees who consent to the use of their facial data can use the service.

Additionally, the data is collected and stored locally, by software designed by Microsoft. No one can access it. I don't even see how our company could be considered either Controller or Processor of this data.

As a compromise, we've proposed to extensively inform employees about what it means to use Windows Hello in terms of privacy (basically make a presentation from the Microsoft documentation) but this isn't completely satisfactory for them.

What responsibilities does a company have when allowing it's employees to use biometric authentication provided by another company?

  • You realize that you can bypass Windows Hello with a well enough photo of the employee? – Trish Feb 25 at 6:13
  • The last (publicly disclosed) photo bypass I've heard about was patched in fall 2017. Do you have any reference on a more recent one? In any case, the security aspect is not relevant to this question unless it involves theft of the biometric data. – Grooke Feb 25 at 9:10
  • Great first question, @Grooke. The only reason you haven't got an answer is it's quite a tough question in a new area of technology. When you say the presentation from Microsoft isn't completely satisfactory, what do you mean? – Sam_Butler Mar 9 at 9:40
  • Thanks @Sam_Butler. Our DPO says that even if we inform our users (through a presentation), it doesn't change the fact that the measure isn't necessary. It's true, but again I think they have the concept of data minimization wrong in this case. – Grooke Mar 10 at 9:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.