UODO with the support of the Ombudsman for Children on the protection of children's biometric data
The Ombudsman for Children supports the cassation appeal of the President of the Personal Data Protection Office filed with the Supreme Administrative Court which regards the judgment of the Voivodeship Administrative Court in Warsaw, which allowed the processing of students’ biometric data by the Primary School in Gdańsk. The processing of these data took place while the meals were served to children.
The position of the Personal Data Protection Office (UODO) expressed in the decision of February 2020 imposing an administrative fine of PLN 20,000 PLN on the Primary School in Gdańsk, which processed the biometric data of children, is shared by the Ombudsman for Children (RPD). Therefore, it reported its participation in the cassation proceedings concerning the judgment of the Voivodeship Administrative Court in Warsaw (file no. II SA / Wa 809/20), which repealed the decision of the President of the Personal Data Protection Office.
In a letter to the Supreme Administrative Court, in which the Ombudsman reports its participation in the cassation proceedings, it points out that the processing of children's biometric data on account of its sensitivity is associated with an increased risk of violating the rights and freedoms of the data subject. In its opinion, the ruling of the Voivodeship Administrative Court should be repealed in its entirety and returned for re-examination.
Let us recall that the fined Primary School introduced a biometric identification system at the entrance to the school canteen, which allows to verify among students the payment for the meal. In the opinion of the supervisory authority, the provisions of generally applicable law in Poland do not allow schools to process biometric data. In the discussed case, the school processed biometric data in the form of fingerprints of students based on the written consent of parents or legal guardians.
However, the Personal Data Protection Office found that in this situation the consent which was given by the parents could not be regarded as voluntary, as the lack of it had negative effects. Students whose parents did not give their consent had to pass the other students in the queue for a meal.
Meanwhile, the Voivodeship Administrative Court stated that the consent provided for in Art. 9 (1)(a) of the GDPR legalizes the processing of children's biometric data.
UODO filed on March 2, 2021 a cassation appeal to the Supreme Administrative Court against the judgment of the Voivodeship Administrative Court in Warsaw.
You can read more about the whole case in the information regarding the decision of the President of the Personal Data Protection Office: https://uodo.gov.pl/pl/138/1453.
and in the information following the judgment of the Voivodeship Administrative Court: https://uodo.gov.pl/pl/138/1943.
