Limits on Using Facial Recognition

SUMMARY

The courts of the City of Buenos Aires ordered the City Government to suspend the mandatory use of facial recognition to record staff attendance. The order was issued in an amparo action filed by an employee who argued that facial biometric data is sensitive personal data. The judge ordered fingerprint or ID-based attendance to be restored within two days and required the City Government to report on the legal basis, the Data Protection Impact Assessment and the availability of alternative methods.

A court in the City of Buenos Aires ordered the Government of the City of Buenos Aires (GCBA) to suspend the requirement of facial recognition for recording public employees’ attendance, in the context of a temporary injunction filed by a worker who challenged the legality and proportionality of the newly implemented biometric system.

The employee argued that facial biometric data is a category of sensitive personal data, as a person’s face may reveal information inherently linked to racial or ethnic origin and, potentially, to health conditions, thus meeting the criteria for sensitive data under Law 1845 and Resolution 4/2019 of the Agency of Access to Public Information. He also claimed that the GCBA failed to adequately inform the legal basis for processing the data, did not offer alternative methods, and did not make it clear whether it registered the facial biometric database with the Personal Data Registry of the Ombudsman’s Office of the City of Buenos Aires or conducted a Data Protection Impact Assessment (DPIA).

The Judge considered the claimant’s arguments had enough grounds and issued a preliminary injunction ordering the GCBA to reinstate, within two days, the previous attendance system using fingerprint or ID number registration, subject to daily fines to be imposed on the official in charge. The decision is grounded in the risk that the employee could be registered as absent for refusing to consent to the new system, potentially affecting his employment conditions.

Additionally, the judge required the GCBA to provide key information on the implementation process of the facial recognition system, including:

1. The administrative acts that authorized the technological change.
2. Information on whether the biometric database is registered before the Ombudsman’s Office.
3. Information on whether a DPIA was conducted in accordance with local and international standards.
4. The reasons of public interest that would justify processing sensitive data.
5. The existence of alternative systems for those who do not consent.
6. The measures applied to employees who refuse to provide their facial data.

By ordering the reinstatement of alternative methods and requiring detailed information from the GCBA, the court establishes a stricter standard for the use of biometric technologies in the public sector, emphasizing the need to assess their proportionality, legal basis, and compliance with existing privacy obligations.




 

Frequently Asked Questions

What did the Buenos Aires City court order?
To suspend mandatory facial recognition and restore fingerprint or ID-based attendance.

Why is facial data considered sensitive?
Because a face can reveal racial or ethnic origin and, potentially, health data.

What information must the City Government provide?
The system’s legal basis, its database registration, the impact assessment and alternatives for those who do not consent.