THE Administrative Court upheld on Friday a 2012 decision of the Data Protection Commissioner to impose an administrative sanction on Apollonion private hospital in Nicosia calling it to disable the fingerprint scanning system used for the employees’ check in and to destroy all the relevant data it has kept so far.
The decision is seen as a setback to efforts to digitise services and use biometric systems to ensure higher levels of security and effective data management in public-use areas.
According to a statement of the commissioner’s office, the legal basis for the contested decision was that the fingerprint system installed by the applicants – Apollonion Hospital – for the purpose of checking the logs with the time of arrival and departure of their employees, was collecting and processing their fingerprints (biometric data) in violation of the principle of proportionality.
Based on a large number of documents from European authorities and organisations and on previous decisions of all outgoing commissioners, it said, it has been repeatedly held that the collection and processing of fingerprints, which are unique characteristics of the human body, was an interference of the physical integrity and human dignity of a person.
“It was therefore considered as an excessive measure for the control of staff hours, especially considering that similar systems are being used in maximum security facilities and for the purposes of police criminal policy,” the commissioner said.
The private hospital’s appeal was based on the commissioner’s failure to carry out an appropriate search for the technical specifications or the operation of the system, and that the contested decision was taken as a result of misinformation, as, according to their arguments, the system in question does not collect or process fingerprints.
“The commissioner’s defence claimed that it is an undeniable fact that the system in question collects and processes biometric data (fingerprints) which it can then identify and match in the physical presence of the individual,” it said.
It added that the commissioner argued that there are other measures less intrusive to human dignity for controlling staffing hours.
The court rejected the applicants’ appeal on the grounds that they had not raised any allegations that cast doubt on the correctness and reasonability of the commissioner’s judgment, since their main argument was the lack of information on the standards and the system’s method of operation.
It concluded that the operation of the system in question violates the principle of proportionality in relation to the purpose used, checking staff hours.