FranceCNIL Standard Regulation on Workplace Biometric Access Control (Deliberation No. 2019-001)
In force since .
A biometric privacy rule binding public and private bodies.
- Audit expectation
- periodic
- Who audits it
- Self
- Where the report goes
- Produced on request
What it requires
- Run a data protection impact assessment and document why a less intrusive alternative was rejected before deploying a biometric access-control system for employees or building access in France.NIST Privacy FrameworkID.RA-P4NIST Privacy FrameworkID.RA-P5
- Do not rely on employee consent alone as the legal basis for a workplace biometric system; use a legal-obligation or legitimate-interest basis, or pair consent with a genuinely equivalent non-biometric alternative.NIST Privacy FrameworkCT.PO-P1
These lines are LexLint's reading of the law's text. Also read by: Commission nationale de l'informatique et des libertés (CNIL) (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- ID.RA-P4Problematic data actions, likelihoods, and impacts are used to determine and prioritize risk.
- ID.RA-P5Risk responses are identified, prioritized, and implemented.
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
The standard regulation is a binding instrument that the CNIL itself adopted, so the regulation is also the regulator's guidance on this duty.
- As of
- Guidance link
- https://www.cnil.fr/fr/question-reponses-sur-le-reglement-type-biometrie
- Guidance body
- Commission nationale de l'informatique et des libertés (CNIL)
- Open questions
- Does the CNIL standard regulation on biometric access control apply to access control for the staff of a contractor or for visitors, who are not 'personnel' of the organisation that imposes the biometric device, or must that processing rest on an Article 9(2) condition of its own?
What it makes you log
Who may demand the log
Regulator
What the log must hold
Event time, Actor identity, Access record
Log retention
The ceiling applies to the active database. Intermediate archives with restricted access are allowed where a law requires them or the data may matter in a dispute, for the limitation period.
- Unit
- Months
- As of
- Basis
- Fixed
- Maximum value
- 6
Logging duty
The controller defines how access logs are kept and managed as part of its access policy, and documents the justifications the standard asks for and keeps them available to the CNIL.
- Kind
- Explicit
- As of
- Provision
- CNIL Deliberation No. 2019-001, Arts. 4, 8, 10 and 11
- Trigger
- personal_data_processing
What this law does
CNIL's standard regulation for workplace biometric access control (English: Standard Regulation on the Implementation of Biometric Access-Control Devices) adds requirements to the General Data Protection Regulation (GDPR) and the Loi Informatique et Libertes: the controller must show why biometrics is needed where badges, passwords or other measures would not give the security level required, and must run a data protection impact assessment before deployment.
A CNIL guidance page on workplace biometric access control describes biometrics as covering fingerprints, iris, voice, face and gait.
CNIL guidance states that consent can only very rarely be the legal basis for processing data at work, since the hierarchical link between employer and employee affects whether consent is freely given; a legal obligation or the controller's legitimate interest is preferred, and an employer that does rely on consent must offer an equivalent alternative such as a badge or password.
When LexLint raises it
When your app profile says your app processes biometric data or processes personal data.
Back to the example · Lint your app
Page updated .