Biometric Personal Data Processing in Employer Information Systems: Principles and Limitations

Abstract

The paper provides a comparative legal analysis of the regulation of the processing of biometric data of employees in the Russian Federation and the countries of the European Union. A key problem emerges: the Russian legal model, while formally declaring the priority of the subject's consent, in practice allows for broad exceptions justified by state and corporate interests, without proper verification of their proportionality. This leads to the erosion of the individual's sphere of private autonomy and creates the risk of establishing hyper-control over employees. The European model, based on the General Data Protection Regulation (GDPR), establishes a more balanced regime where prohibition is the rule, and any exception must be strictly justified and supported by principles such as proportionality, data minimization, transparency, and security. A key tool for complying with these principles is the mandatory data protection impact assessment (DPIA). The author substantiates the need to improve Russian legislation, arguing that this entails the risks of violating the constitutional principle of respect for working people, the right to privacy, and the fundamental duty of the state to ensure personal freedom. In conclusion, specific measures are proposed to improve Russian legislation, in particular the introduction of mandatory data processing impact assessments and the development of specialized methodological recommendations for employers.