The GDPR factsheet is being updated to include the following guidance regarding the handling of staff biometric fingerprint data used for PoS login:
Staff biometric fingerprint data is stored solely for the purpose of logging into the PoS system.
At the time of fingerprint capture, the staff member must provide consent for their data to be stored.
The PoS system interacts with a dll provided by the fingerprint reader manufacturer.
The data received from the hardware device is encrypted, and the PoS further encrypts the file when storing it.
A separate file is created for each finger that is scanned.
When a PoS clerk is deleted, all associated fingerprint files.