The Superintendence of Personal Data Protection (SPDP) issued a pronouncement in response to the consultation filed on March 25, 2025, related to the use of biometric data in the attendance register of public servants and other rights of the holder in the employment relationship. The following is a synopsis of the pronouncement.
- The question asked was: “Is the processing of biometric data applicable for the registration of attendance of public servants in the general interest? If applicable, under what circumstances of Art. 26, of the LOPDP would it be applicable?”
The SPDP, for the consulted case, argues that biometrics can be applied as long as the proportionality test is passed, and the result does not emit a high risk. It adds that a personal data protection impact assessment (PDIA) is required to establish the risk mitigation measures that are adequate, relevant, proportional and necessary to the specific data processing.
Although its pronouncement is not binding, the SPDP establishes that “the consent of the owners must be obtained” andthat in order to be considered free, specific, informed and unequivocal (criteria for the legality of consent), the owner must be given the real possibility of choosing among several alternatives for the control of his attendance.
- The question asked was: “Is it appropriate for an employee or former employee to request, by virtue of his right of access (Art. 13 of the LOPDP), his documents that were generated during the employment relationship (employment contracts, notices of entry and exit to social security, pay slips, resignations, among others), which contain personal information?”
The SPDP states that full access to all personal information that the holder has provided or that has been generated within the framework of the employment relationship (present or past) is applicable, provided that such data allows the identification of the holder or makes him/her identifiable.
- The question asked was: “In case of detecting erroneous or outdated information about the form of termination of the employment relationship, such as an alleged voluntary resignation or abandonment when in fact it was another cause, is it valid to request the rectification of such information in accordance with Art. 14 of the LOPDP?”
The SPDP considers such matters to be matters of fact. In this context, the rectification of such information shall be admissible when a judicial authority has declared in its enforceable judgment and passed on the authority of res judicata. Once the above is fulfilled, the rectification may be requested to the data controller.
We recall that according to Resolution No. SPDP-SPDP-2024-0012-R “The content of the resolution of a consultation is not an administrative act, nor is it an administrative decision; it is not binding, nor does it have any probative value or merit in favor or against the person who formulates or invokes it”.
Since biometric data are considered sensitive data and require a reinforced level of protection, as well as the appropriate attention to the rights of the holders, we offer you our specialized advice. For further information, please do not hesitate to contact our data protection team at pmerino@almeidaguzman.com.
Quito, D.M. / Guayaquil, June 2025
