logo czasopisma

Case law commentaries

Vol. 58 No. 5 (2025): Prawo i Więź nr 5 (58) 2025

Processing Children’s Biometric Data in the Context of Using a School Canteen. Commentary to the Judgment of the Supreme Administrative Court of 10.10.2024, III OSK 4804/21

DOI:
https://doi.org/10.36128/p1phm606
Submitted
14 April 2025
Published
18-11-2025

Abstract

The commentary is a critical analysis of the Supreme Administrative Court (NSA) ruling, which found that the processing of students’ biometric data by a school for verifying payments for the use of the school canteen services complies with the requirements of the GDPR. The analysis elaborates in detail on the court’s interpretation of the principle of data minimization, purpose limitation, and the criterion of „freely given” consent. The author points out inaccuracies in the court’s assessment, arguing that the processing of children’s biometric data in this manner constitutes a disproportionate interference with their privacy. The author discusses the court’s reasoning regarding the relationship between the consent of the data subject and the data processing principles outlined in Article 5 of the GDPR. Concerns are also raised about the court’s assessment that the legal guardians’ consent was „freely given”, which, according to the author, fails to sufficiently account for the relationship between the school and students and the potential imbalance of power between the parties.

References

  1. Finck, Michèle, i Asja Biega. “Reviving Purpose Limitation and Data Minimisation in Data-Driven Systems.” Technology and Regulation, nr 1 (2021): 44 – 61. https://doi.org/10.26116/techreg.2021.004.
    View in Google Scholar
  2. Frenzel, Eike Michael. “Art. 5 Grundsätze für die Verarbeitung personenbezogener Daten.” W Datenschutzgrundverordnung. Bundesdatenschutzgesetz, red. Boris Paal i Daniel Pauly, [bez numerów stron]. München: C.H. Beck, 2021.
    View in Google Scholar
  3. Gayrel, Claire. “The Principle of Proportionality Applied to Biometrics in France: Review of Ten Years of CNIL’s Deliberations.” Computer Law & Security Review 32, nr 3 (2016): 455 – 464. https://doi.org/10.1016/j.clsr.2016.01.013.
    View in Google Scholar
  4. Lubasz, Dominik. “5. Przesłanki legalizacyjne przetwarzania danych osobowych.” W Meritum. Ochrona danych osobowych, red. Dominik Lubasz, 119 – 142. Warszawa: Wolters Kluwer, 2022.
    View in Google Scholar
  5. Mednis, Arwid. “Wykorzystanie danych biometrycznych w szkole. Wyrok Wojewódzkiego Sądu Administracyjnego w Warszawie z dnia 7 sierpnia 2020 r., II SA/Wa 809/20.” Gdańskie Studia Prawnicze, nr 4 (2021): 129 – 137. https://doi.org/10.26881/gsp.2021.4.08.
    View in Google Scholar
  6. Rauhofer, Judith, i Burkhard Schafer. “Article 4(11). Consent.” W General Data Protection Regulation Article-by-Article Commentary, red. Indra Spiecker gen. Döhmann, Vagelis Papakonstantinou, Gerrit Hornung i Paul De Hert, 195 – 216.Baden-Baden: Nomos, 2023.
    View in Google Scholar
  7. Roßnagel, Alexander i Philipp Richter. “Article 5. Principles Relating to Processing of Personal Data.” W General Data Protection Regulation Article-by-Article Commentary, red. Indra Spiecker gen. Döhmann, Vagelis Papakonstantinou, Gerrit Hornung i Paul De Hert, [bez numerów stron]. Baden-Baden: Nomos, 2023.
    View in Google Scholar
  8. Sartor, Giovanni. “Article 6. Lawfulness of Processing.” W General Data Protection Regulation Article-by-Article Commentary, red. Indra Spiecker gen. Döhmann, Vagelis Papakonstantinou, Gerrit Hornung i Paul De Hert, 291 – 328. Baden-Baden: Nomos, 2023.
    View in Google Scholar
  9. Wendehorst, Christiane, i Yannik Duller. Biometric Recognition and Behavioural Detection: Assessing the Ethical Aspects of Biometric Recognition and Behavioural Detection Techniques with a Focus on Their Current and Future Use in Public Spaces. Brussels: European Parliament, 2021. https://www.europarl.europa.eu/thinktank/en/document/IPOL_STU(2021)696968.
    View in Google Scholar

Downloads

Download data is not yet available.