The ICO is very clear in its statement:

“Businesses do not have free rein to use fingerprinting as they please. Like all advertising technology, it must be lawfully and transparently deployed—and if it is not, the ICO will act.”

The key considerations are:

Transparency:  Digital fingerprinting often occurs without users' knowledge, let alone consent, and this “invisible processing” of significant amounts of data flies in the face of data protection laws. Users must be made aware that fingerprinting is taking place. That information should be clear and transparent at all times.  Individuals must know when and how they are being tracked. And there must be a means of ensuring that individuals can choose not to be tracked in this way. 

Legal Basis - Consent: While fingerprinting for fraud prevention or identity theft may fall under the legal basis of legitimate interests, for advertising, consent is required. Although device fingerprinting only collects data about a user’s device (and not, for example, contact information like their name or email address), it still, like cookies, falls under the category of personal data. This is because all these pieces of information relate to an individual and can be used to identify them – either directly or indirectly.  So the GDPR and PECR both come into play.

If a company wishes to use device fingerprinting for advertising and marketing purposes, then they’ll have to obtain consent from the user to do so, and will need to ensure that such consent is logged. Under GDPR,  consent may be withdrawn at any time and the withdrawal process has to be as simple as the consent process, so a mechanism for withdrawing consent must also be provided.

Data Breaches:  If there is a breach around data held in fingerprinting databases, the risks include fraud, identity theft and a variety of other dishonest activity. The additional difficulty is that, in the event of a breach, digital fingerprint characteristics cannot easily be changed.

Purpose:  while the original purpose of collecting and processing the "fingerprinting" data elements may be clearly defined and explained, and consent obtained, there is a risk that the data could very easily be repurposed without the knowledge of the individuals concerned, and without their consent to do so.  For example, for surveillance or additional profiling.