Use of facial recognition or fingerprinting on site

The construction site is a coming and going of (foreign) workers (including subcontractors), temporary workers and self-employed workers. As a (main) contractor you want to keep unauthorized people off the construction site and know who is on the site and when. This is partly to ensure compliance with the collective agreement and to prevent illegal labor and sham constructions. For these reasons, the collective bargaining parties decided in 2016 to introduce the Construction Site ID. The Construction Site ID should make it clear who is working on the construction site, as it requires everyone working on the site to sign in and out. This is important in connection with the Wet ketenaansprakelijkheid and the Wet aanpak schijnconstructies. In addition, this promotes safety on the construction site and theft (of valuable materials) will occur less often.

However, the actual implementation of Construction Site ID is still pending. The question is how a (main) contractor can keep track of who is walking around on the construction site. This could be done using access gates that provide access to the construction site by means of an access pass, badge, fingerprint or facial recognition. Especially regarding the last two possibilities - the use of fingerprints or facial recognition - I have already received several questions from customers. However, the use of fingerprints or facial recognition is not allowed just like that. Reason enough to shed some light on that subject in this article.

Biometric data

When fingerprints and facial recognition are used, biometric data are processed. According to the General Data Protection Regulation (AVG), this data qualifies as so-called special personal data. With regard to special personal data, it is in principle forbidden to process these data, unless there is an exception in the AVG. For example, when the data subject has given explicit consent for the processing or the law provides that a certain processing is permitted for the purpose of carrying out obligations and exercising specific rights in the field of labor law. Seeking consent from an employee is not possible in most cases. This is because the legislator assumes that the relationship between employers and employees in an employment relationship is unequal, which means that an employee cannot give his consent completely "freely. This means that consent cannot be sought from the employee for the use of fingerprints or facial recognition on the construction site. In addition, there is also no other (legal) exception in the construction industry under which biometric data can be processed.

In addition to the AVG, the Implementing Act for the General Data Protection Regulation (UAVG) applies in the Netherlands. The UAVG provides that biometric data may still be processed in the Netherlands even if necessary for authentication or security purposes.

So what about on the construction site?

The Amsterdam court recently addressed the question of whether the use of a finger scan to unlock a POS system was permissible. According to the court, it was not, in part because the processing was not necessary for authentication or security purposes (the exception in the UAVG). In that situation, the employer could have opted for other less intrusive measures to secure its POS system, such as a pass, badge - whether or not based on two-factor authentication - combined with the use of cameras, employee lockers or alarm gates. The employer, however, had no other security measures in place at all and only used fingerprints. The court therefore found the use of fingerprints to be disproportionate. Moreover, the employer had not sufficiently researched alternatives to using fingerprints. According to the court, it had not been shown that the employer would necessarily have to use fingerprints and that other measures would not adequately secure the POS system.

Applying this ruling to the situation on the construction site, one could argue that the exception to the processing of biometric data could potentially apply if you, as a (general) contractor, observe the following conditions:

• First of all, a consideration must be made as to whether identification with biometric data is really necessary for authentication or security purposes. Here the legislator cites the nuclear power plant as an example: in that situation, access should actually be restricted to those authorized to do so. On the other hand, it is not considered necessary to use biometric data for timekeeping, because here there is no connection to authentication and/or security purposes.
• Second, the processing must be proportionate. For access to a garage business, for example, it is not necessary for security to be achieved through biometrics. Securing information systems (containing a lot of personal data) by means of biometric data, on the other hand, may again be proportionate.
• In addition - before using biometrics - less intrusive alternatives should be sought. Less intrusive means on the construction site include the use of an access pass, badge and/or code.

If it subsequently turns out that the processing is really necessary - for example, when handling hazardous materials or when very expensive materials are present on the construction site - and the security cannot be achieved in any other way, then the use of biometric data may be permitted. A (main) contractor may also choose to secure only part of the construction site with biometric data because only a limited number of people have access to it. This is more likely to make the processing proportionate.

So, all in all, the use of biometrics on construction sites remains troublesome and will not be permitted in most cases. Let us hope that the use of Construction Site ID will not be too long in coming. Until then, as a (general) contractor, you need to think about securing the construction site yourself. If we can help with that, feel free to contact me or my colleagues.