The MediaMarkt must immediately stop fingerprinting its employees. Trade union FNV calls it a "far-reaching invasion of privacy" and also thinks it is unnecessary. Finally, the retailer is not honest about what it does with this data. So says Onur Erdem, director of FNV Handel.
Anyone who works for MediaMarket must surrender his or her fingerprint to the employer. By doing so, the retailer grants or denies employees access to specific areas of the shop floor. FNV speaks outrage at this practice. "Leaving your fingerprint to work in an electronics store. It doesn't have to get any crazier, does it? We are talking about the MediaMarkt, not a nuclear power plant or the headquarters of the secret service," FNV board member Onur Erdem told me.
He believes that fingerprinting is a "far-reaching invasion of employees' privacy and personal sphere. Erdem understands that not all employees should have access to all departments of the company. In his view, shielding certain business areas can be a lot easier without being "unnecessarily high tech" and collecting data from employees.
The fact that MediaMarkt does not give its employees clarity as to what it does with the fingerprint data, or with whom it shares it, does not please Erdem. "In short, this must end soon," he said.
Speaking to RTL News, a MediaMarkt spokesperson said that a process is currently underway to phase out employee finger scans. "The policy of collecting fingerprints from specific employees was aimed solely at mitigating essential security risks," the company said in a comment. That is the only purpose for which employee fingerprints are used.
The retailer further informs that other security measures "always carry risks, such as from the access card and the possibility of the access card being given to an unauthorized person." The fingerprints are stored centrally in a "secure system. Finally, the spokesperson let it be known that this data is automatically deleted when it is no longer needed for security purposes.
Fingerprints fall under the heading of biometric data. These are special personal data according to Article 9 of the General Data Protection Regulation (AVG). In principle, this data may not be processed by an employer, government agency or other body, unless there is a statutory exception.
For the use of fingerprints, there are two grounds for exceptions, according to the Personal Data Authority: if the data subject expressly consents to the taking and retention of his fingerprint, and if the use of biometric data is necessary for authentication or security purposes. The latter is used in practice at only a handful of companies, such as a nuclear power plant, data center or telecommunications company.
In May 2020, the regulator fined a company 725,000 euros for having unauthorizedly taken, stored and used the fingerprints of hundreds of (former) employees for years. The employer found that storing fingerprints had all sorts of practical advantages. He had no costs associated with the purchase, loss or damage of drops and it allowed him to more easily track and conduct time and attendance checks on his staff. He also wanted to replace the outdated system with droplet scanners to make his computer network more resistant to hacking attempts and corporate espionage in the future.
The Personal Data Authority ruled that using a fingerprint for these purposes was "not necessary and proportionate." Therefore, the company was not allowed to invoke the grounds for exception. "As with a garage, also at [VERTROUWELIJK] the need for security is not such that employees must be able to gain access with biometrics and for that purpose these data are recorded to exercise access control. In addition, other ways, which are less invasive of employee privacy, can also accomplish this," the privacy watchdog stated in its penalty decision.
The invasion of privacy is just one problem at MediaMarkt, according to the FNV board member. Erdem also commented on the way the company communicates with its employees. Employees, in his view, are barely given access to their paychecks and they have no insight into the minus hours they accrued during the corona pandemic. These unworked hours must be made up because they were paid for by the employer. Checking how many minus hours are involved is impossible.
"So that leaves you, as an employee, in the dark about all kinds of things that do concern you. The MediaMarkt is always looking for the 'wow' for you, except when you work there," Erdem said.
