Belgian Data Protection Authority warns supermarket chain Carrefour about biometric data collection

The Belgian Data Protection Authority – the former Privacy Commission – wants to open an investigation into Carrefour, accusing the French supermarket chain of illegally collecting customer fingerprints, reports De Tijd.

Carrefour announced on Tuesday that it was planning a biometric payments pilot in a store in Brussels that enables customers to pay by scanning their fingerprints at the cash register.

The watchdog had already informally contacted Carrefour regarding another project that invited customers to use their fingerprints to add loyalty points.

EU’s GDPR, however, prohibits companies from collecting biometric data from consumers without explicit permission.

“There are exceptions, but then people have to give their explicit permission,” says Stevens, chairman of the Data Protection Authority [as per Google translation]. “And that is more than just a signature on a paper. Customers really have to understand the risks they run.”

When a company is suspected of not complying with guidelines, the organization follows a three-step procedure: informally ask questions, open an official investigation and then impose fines.

“We asked Carrefour a few questions and we discovered that a test had already taken place,” says Stevens. “Carrefour already appeared to have collected fingerprints. Now that we have heard the news about the new experiment with fingerprint payments, there is a good chance that we will send our inspectors along. I cannot yet formally confirm that we will do that effectively, but the chance seems to me great.”

Carrefour spokesperson Aurélie Gerth assures customers that their information is secure and that Carrefour is GDPR compliant.

“We will work with companies that specialize in security,” Gerth said. “We are not the first company to collect fingerprints and there are also companies that collect other very sensitive personal information from their customers. Think of banks and the financial data of their customers.”

Carrefour highlighted that the pilot project would be rolled out only in one store just to evaluate results, and there is no current plan for national implementation.

Article Topics

Belgium  |  biometric data  |  biometrics  |  data collection  |  data protection  |  fingerprint scanner  |  privacy