Platform Work Directive, Ban on One-to-Many Biometric Identification of Persons Performing Platform Work (Article 7(1)(f))

Article 7(1), point (f), provides that digital labour platforms shall not, by means of automated monitoring systems or automated decision-making systems, process any biometric data, as defined in Article 4, point (14), of Regulation (EU) 2016/679, of a person performing platform work to establish that person's identity by comparing that data to stored biometric data of natural persons in a database.

Recital 41 states that the ban does not affect the possibility for digital labour platforms to conduct biometric verification, namely verifying a person's identity by comparing his or her biometric data to data previously provided by that same person (one-to-one verification or authentication), where such processing of personal data is lawful under Regulation (EU) 2016/679 or other relevant Union and national law.

Recital 42 describes biometrics-based data as personal data which result from specific technical processing relating to the physical, physiological or behavioural features, signals or characteristics of a natural person, such as facial expressions, movements, pulse frequency, voice, keystrokes or gait, which may or may not allow or confirm the identification of a natural person.

Article 7(2) applies Article 7 to all persons performing platform work from the start of the recruitment or selection procedure, and Article 7(3) applies it also where digital labour platforms use automated systems taking or supporting decisions that affect persons performing platform work in any manner.

Article 1(2) states that the Directive provides measures on algorithmic management applicable to persons performing platform work in the Union, including those who do not have an employment contract or employment relationship. Article 2(1), point (c), defines a person performing platform work as an individual performing platform work, irrespective of the nature of the contractual relationship or the designation of that relationship by the parties involved.

Article 2(1), point (a), defines a digital labour platform as a natural or legal person providing a service that is provided, at least in part, at a distance by electronic means, at the request of a recipient of the service, that involves the organisation of work performed by individuals in return for payment as a necessary and essential component, and that involves the use of automated monitoring systems or automated decision-making systems.

Article 1(3) applies the Directive to digital labour platforms organising platform work performed in the Union, irrespective of their place of establishment or of the law otherwise applicable.

Article 24(1) makes the supervisory authorities responsible for monitoring the application of Regulation (EU) 2016/679 also responsible for monitoring and enforcing Articles 7 to 11 as far as data-protection matters are concerned, and applies the upper limit for administrative fines referred to in Article 83(5) of that Regulation to infringements of Articles 7 to 11.

Article 24(5) requires Member States to lay down the rules on penalties applicable to infringements of the national provisions adopted pursuant to the Directive, and the penalties must be effective, dissuasive and proportionate to the nature, gravity and duration of the undertaking's infringement and to the number of workers affected.

Article 29(1) requires Member States to bring into force the laws, regulations and administrative provisions necessary to comply with the Directive by 2 December 2026.