[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fnLPT3YS6P90bx9LPtZpacBHtpRZNZRT-L0dXDJ9wrsU":3},{"article":4,"iocs":44,"watch_terms":45,"solutions":46,"lesson":49},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"3a320c0b-38b0-4fe3-afac-6c78e1752d2d","ANSPDCP (Romania) - TIP TOP FOOD INDUSTRY SRL","anspdcp-romania-tip-top-food-industry-srl-167878","Created page with \"{{DPAdecisionBOX |Jurisdiction=Romania |DPA-BG-Color= |DPAlogo=LogoRO.jpg |DPA_Abbrevation=ANSPDCP |DPA_With_Country=ANSPDCP (Romania) |Case_Number_Name=TIP TOP FOOD INDUSTRY SRL |ECLI= |Original_Source_Name_1=Autoritatea Naţională de Supraveghere a Prelucrării Datelor cu Caracter Personal |Original_Source_Link_1=https:\u002F\u002Fwww.dataprotection.ro\u002F?page=Comunicat_Presa_25_09_2026&lang=ro |Original_Source_Language_1=Romanian |Original_Source_Language__Code_1=RO |Origi...\" New page {{DPAdecisionBOX |Jurisdiction=Romania |DPA-BG-Color= |DPAlogo=LogoRO.jpg |DPA_Abbrevation=ANSPDCP |DPA_With_Country=ANSPDCP (Romania) |Case_Number_Name=TIP TOP FOOD INDUSTRY SRL |ECLI= |Original_Source_Name_1=Autoritatea Naţională de Supraveghere a Prelucrării Datelor cu Caracter Personal |Original_Source_Link_1=https:\u002F\u002Fwww.dataprotection.ro\u002F?page=Comunicat_Presa_25_09_2026&lang=ro |Original_Source_Language_1=Romanian |Original_Source_Language__Code_1=RO |Original_Source_Name_2= |Original_Source_Link_2= |Original_Source_Language_2= |Original_Source_Language__Code_2= |Type=Complaint |Outcome= |Date_Started= |Date_Decided= |Date_Published= |Year= |Fine=26236.0 |Currency=RON |GDPR_Article_1=Article 5(1)(c) GDPR |GDPR_Article_Link_1=Article 5 GDPR#1c |GDPR_Article_2=Article 9 GDPR |GDPR_Article_Link_2=Article 9 GDPR |GDPR_Article_3= |GDPR_Article_Link_3= |GDPR_Article_4= |GDPR_Article_Link_4= |EU_Law_Name_1= |EU_Law_Link_1= |EU_Law_Name_2= |EU_Law_Link_2= |National_Law_Name_1= |National_Law_Link_1= |National_Law_Name_2= |National_Law_Link_2= |Party_Name_1= |Party_Link_1= |Party_Name_2= |Party_Link_2= |Appeal_To_Body= |Appeal_To_Case_Number_Name= |Appeal_To_Status= |Appeal_To_Link= |Initial_Contributor=lh | }} The DPA fined a company €5,000 (RON 26,236) for using a system to monitor its employees’ attendance and access to its premises that relies on the processing of personal data in the form of fingerprints. == English Summary == === Facts === TIP TOP FOOD INDUSTRY SRL (controller) used a time-and-attendance and access-control system on its employees at its premise. This system was using personal data in the form of the employees’ fingerprints. An individual lodged a complaint with the DPA. === Holding === The DPA held that the system used by the controller violated the principles of data minimisation ([[Article 5 GDPR|Article 5(1)(c) GDPR]]) and lawfulness because the controller could not rely on a legal basis for processing biometric data pursuant to [[Article 9 GDPR|Article 9 GDPR]]. According to the DPA, the controller could have used less intrusive means for the objectives of access control and time tracking and therefore violated [[Article 5 GDPR|Article 5(1)(c) GDPR]]. The DPA stressed that when processing biometric data, the controller must pay specific attention to the principles of lawfulness, necessity, data minimisation and proportionality. This is because of the significant risks arising from the processing of biometric data in case of unauthorized access and the possibility to link biometric data to the identity of the data subject. The DPA fined the controller Romanian RON 26,236 (€5,000). Additionally, the DPA ordered the controller to replace the access control and time-keeping system with an alternative system that is less intrusive and does not rely on the processing of biometric data, and thus complies with the principle of data minimisation. == Comment == ''Share your comments here!'' == Further Resources == ''Share blogs or news articles here!'' == English Machine Translation of the Decision == The decision below is a machine translation of the Romanian original. Please refer to the Romanian original for more details. September 25, 2026 Fine for Violation of the GDPR The National Supervisory Authority for Personal Data Processing has concluded an investigation into TIP TOP FOOD INDUSTRY SRL and found a violation of the provisions of Article 5(1)(c) (1)(c) in conjunction with Article 9 of Regulation (EU) 2016\u002F679. As such, TIP TOP FOOD INDUSTRY SRL was assessed an administrative fine of 26,236 lei (equivalent to 5,000 euros). The investigation was conducted following a complaint submitted by an individual alleging the use of a time-and-attendance and access control system based on the processing of employees’ fingerprints at the premises owned by the controller. The investigation found that the operator processed the biometric data of its own employees for the purposes of access control and work time tracking without a legal basis, in violation of the legal requirements established by the provisions of Article 9 of Regulation (EU) 2016\u002F679, in conjunction with a violation of the principle of data minimization, as provided for in Article 5(1)(c) of the same European regulation. At the same time, it was noted that the purposes pursued by the controller could have been achieved through the use of alternative means that were less intrusive to the employees’ privacy. In order to remedy the situation identified and ensure that the processing operations comply with the provisions of Regulation (EU) 2016\u002F679, the Authority also ordered a corrective measure, requiring the controller to ensure compliance with the principle of data minimization, by replacing the access control and time-keeping system based on the processing of employees’ biometric data with an alternative solution that achieves the same objectives without processing biometric data. We emphasize that, when using biometric data, special attention must be paid to compliance with the principles of lawfulness, necessity, proportionality, and data minimization. At the same time, any compromise or unauthorized access to biometric data can pose significant risks to the rights and freedoms of individuals, given the specific nature of such data and the possibility of directly linking it to a person’s identity. Therefore, the use of biometric data must be carried out with particular caution, and data controllers must be able to demonstrate the existence of an applicable legal basis, as well as the fact that the processing is necessary and proportionate to the purposes pursued. In this context, the Authority reminds controllers of their obligation to carefully assess the necessity of using biometric technologies and to opt for solutions that involve alternative, less intrusive means, so as to ensure that risks to privacy and other fundamental rights and freedoms of individuals are minimized. Legal and Communications Department A.N.S.P.D.C.P.","Romania's ANSPDCP (National Supervisory Authority for Personal Data Processing) fined TIP TOP FOOD INDUSTRY SRL €5,000 (RON 26,236) for operating a time-and-attendance and access-control system based on employees' fingerprints without a lawful legal basis and in violation of data minimization principles under GDPR. The DPA found violations of Article 5(1)(c) (data minimization) and Article 9 (special category data) GDPR, and ordered the company to replace the biometric system with a less intrusive alternative. The decision emphasizes that biometric data processing requires strict attention to lawfulness, necessity, proportionality, and data minimization due to significant privacy risks.","Romanian DPA fines food company €5,000 for biometric fingerprint-based employee monitoring without lawful basis","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=ANSPDCP_(Romania)_-_TIP_TOP_FOOD_INDUSTRY_SRL&diff=53204&oldid=0","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002Fc\u002Fc2\u002FLogoRO.jpg","2026-09-29T08:23:12+00:00","2026-09-29T10:00:17.645822+00:00",7,[17,20],{"name":18,"type":19},"ANSPDCP (National Supervisory Authority for Personal Data Processing)","vendor",{"name":21,"type":22},"TIP TOP FOOD INDUSTRY SRL","product","3f0f8451-91df-4b6c-9a73-ef3b2509b7f1",{"id":23,"icon":25,"name":26,"slug":27},null,"GDPR","gdpr",[29,34,39],{"category":30},{"id":31,"icon":25,"name":32,"slug":33},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":35},{"id":36,"icon":25,"name":37,"slug":38},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",{"category":40},{"id":41,"icon":25,"name":42,"slug":43},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[],[21],{"controls":47,"vendors":48},[],[],{"slug":50,"title":51,"body":52,"framework_refs":53,"framework_notes":64},"romanian-firm-fined-5000-for-unlawful-biometric-fingerprint-system","Romanian Firm Fined €5,000 for Unlawful Biometric Fingerprint System","TIP TOP FOOD INDUSTRY SRL deployed a biometric fingerprint-based time-and-attendance system without establishing a valid legal basis under GDPR, violating both the data minimization principle (Article 5(1)(c)) and the strict rules governing special category data (Article 9). Biometric data is inherently sensitive because it is immutable — unlike passwords, fingerprints cannot be changed if compromised — making unlawful processing a severe and lasting privacy risk for employees. The company failed to evaluate whether less intrusive alternatives (e.g., PIN cards or RFID badges) could achieve the same operational goal, breaching the proportionality requirement. This case underscores that organizations must conduct a thorough legal basis assessment and a Data Protection Impact Assessment (DPIA) before deploying any biometric system, not after a regulatory complaint.",[54,55,56,57,58,59,60,61,62,63],"GDPR Article 5(1)(c) — Data Minimization","GDPR Article 9 — Processing of Special Categories of Personal Data","GDPR Article 25 — Data Protection by Design and by Default","GDPR Article 35 — Data Protection Impact Assessment (DPIA)","GDPR Article 30 — Records of Processing Activities","NIST Privacy Framework PR.DS-P1 — Data minimization","NIST SP 800-122 — Guide to Protecting the Confidentiality of PII","ISO\u002FIEC 27701:2019 — Privacy Information Management","CIS Control 3 — Data Protection","ITIL Service Design — Information Security Management",{}]