but if theres a reasonable business/security case to hold employees handprint data then presumably the employer could enforce the requirement for it ? as long as their storage of the data came within the data protection act ?