| |
1.1 Before using FingerTec terminals to collect, use or disclose biometric data, as the data user, you have a responsibility to inform all users or persons (data subject) whose biometric data are collected. |
| |
|
| |
1.2 In certain jurisdictions where applicable law so requires, you may have to satisfy some or all of the conditions below: |
| |
| |
i. |
Provide this Notice to the individual in writing |
| |
ii. |
Indicate the specific purpose(s) for collecting the biometric data (i.e. only for employee's time attendance and access control purposes). The biometric templates that are collected may only be used for this authorized purpose and may not be used for any new purpose without prescribed consent. The data collected should be adequate for the purpose and not excessive. |
| |
iii. |
Specify the length of time for which it is being collected, stored, and used (e.g. only during the duration of active employment). |
| |
iv. |
Receive a written release that the individual consents to the collection, use or disclosure of their biometric data. The individual may at any time give notice to withdraw consent given, after which you (and other data processors) have to cease collecting, using or disclosing the data. |
|
| |
|
| 2. Notification to Data Subject (Access, Disclosure, Choice & Transparency) |
| |
|
| |
2.1 Furthermore, depending on the respective regulation, it may also be necessary to provide a written notice to inform a data subject of some or all of the following: |
| |
|
| |
| |
i. |
Data subjects have the right to request access to, to request correction of or to request erasure of the biometric data. |
| |
ii. |
The class of third parties to whom the data user discloses or may disclose the biometric data. Without consent of the data subject, the data shall not be disclosed by the data user unless under exceptional circumstances such as when legally required. |
| |
iii. |
Whether it is obligatory or voluntary for the data subject to provide the biometric data and the choice and means the data user offers the data subject for limiting the processing of such data ( e.g. the option of using a smartcard on its own with CCTV monitoring as an alternative to a fingerprint based attendance system) |
| |
iv. |
Should it be obligatory for the data subject to supply the biometric data, the consequences if he/she fails to supply the data. |
| |
v. |
Where applicable, the fact that the data user intends to transfer the biometric data to a third country or international organisation. The receiving country should also offer an adequate standard of data protection. |
|
| |
|
| |
2.2 The notice should be given to the data subjects as soon as practicable, such as when they are first asked by the data user to provide their biometric data. |
| |
|
| |
2.3 The notice should also be provided in appropriate, clear and plain language(s) (e.g. the national and English languages) and data subjects should have a readily accessible means to exercise their choice (e.g. choice to not voluntarily provide biometric data or to withdraw consent). |
| |
|
| |
2.4 In connection with items 1.2 and 2.1 of this Guideline, data user should devise Privacy Policies and procedures setting out clearly the rules and practices that are to be followed in collection and processing of biometric data. The policy should be available to all parties concerned and data users should draw the specific attention of the individuals affected to such policies and procedures. |
| |
|
| |
For example, refer to FingerTec's and TimeTec’s Privacy Policies:
https://www.fingertec.com/privacypolicy/index.php
https://www.timeteccloud.com/privacypolicy |
