Biometric data collection at work 

I work for a company in Dar es Salaam, and recently, management introduced a new system that requires us to clock in using face recognition and fingerprint scanning. They explained that it’s meant to monitor attendance more accurately and reduce cases of absenteeism. But I feel uneasy and do not think this is necessary. I don’t know how my personal data will be stored, whether it will be shared with third parties, or if it could be misused. Once they have my biometric information, I feel like I’ve lost control over it. Is this legal in Tanzania, and do I have any rights to challenge it? Please guide me.

MK, Dar es Salaam

Your concern is very valid. Biometric data, such as fingerprints, facial recognition, and iris scans, are regarded as sensitive personal data under Tanzanian law. The Personal Data Protection Act, Cap. 44 [R.E 2023], sets out the framework for how employers and institutions may collect, store, and process such data. Employers may deploy biometric systems for legitimate purposes, such as attendance monitoring, but they must adhere to strict principles for personal data protection.

Firstly, the principle of consent. Employees should be informed and must agree before their biometric data is collected. Consent must be voluntary, informed, and specific. Secondly, there is the principle of purpose limitation. Data collected should only be used for the intended purpose, in this case, attendance monitoring, which is deemed a legitimate purpose, not for unrelated activities such as surveillance or profiling. Thirdly, employers must ensure data security, meaning biometric information must be stored securely to prevent unauthorised access, leaks, or misuse. Lastly, transparency is required. Employees have the right to know how long their data will be stored, who has access to it, and whether it will be shared with third parties.

As an employee, you cannot simply refuse attendance monitoring outright, but you can insist that your employer comply with the law. If they fail to do so, they risk penalties under the Act. You may also file a complaint with the Data Protection Commissioner if you believe your rights are being infringed. In practice, many Tanzanian companies are adopting biometric systems, but the law demands a balance between legitimate purpose and privacy rights. Seek advice from your human resources officer or lawyer for further guidance.