ANSPDCP (Romania) - TIP TOP FOOD INDUSTRY SRL
Romanian DPA fines food company €5,000 for biometric fingerprint-based employee monitoring without lawful basis
Romania's ANSPDCP (National Supervisory Authority for Personal Data Processing) fined TIP TOP FOOD INDUSTRY SRL €5,000 (RON 26,236) for operating a time-and-attendance and access-control system based on employees' fingerprints without a lawful legal basis and in violation of data minimization principles under GDPR. The DPA found violations of Article 5(1)(c) (data minimization) and Article 9 (special category data) GDPR, and ordered the company to replace the biometric system with a less intrusive alternative. The decision emphasizes that biometric data processing requires strict attention to lawfulness, necessity, proportionality, and data minimization due to significant privacy risks.
AI summary of the linked source. Not reviewed by an editor. How this works
Run TIP TOP FOOD INDUSTRY SRL?
Get an email when a new story names TIP TOP FOOD INDUSTRY SRL, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonTIP TOP FOOD INDUSTRY SRL deployed a biometric fingerprint-based time-and-attendance system without establishing a valid legal basis under GDPR, violating both the data minimization principle (Article 5(1)(c)) and the strict rules governing special category data (Article 9). Biometric data is inherently sensitive because it is immutable — unlike passwords, fingerprints cannot be changed if compromised — making unlawful processing a severe and lasting privacy risk for employees. The company failed to evaluate whether less intrusive alternatives (e.g., PIN cards or RFID badges) could achieve the same operational goal, breaching the proportionality requirement. This case underscores that organizations must conduct a thorough legal basis assessment and a Data Protection Impact Assessment (DPIA) before deploying any biometric system, not after a regulatory complaint.