ANSPDCP (Romania) - TIP TOP FOOD INDUSTRY SRL
Romania's DPA fines TIP TOP FOOD INDUSTRY SRL €5,000 for unlawful fingerprint data processing.
Romania's National Supervisory Authority for Personal Data Processing (ANSPDCP) fined TIP TOP FOOD INDUSTRY SRL €5,000 (RON 26,236) for violating GDPR. The company used employee fingerprints for attendance and access control, which the DPA deemed unlawful due to a lack of legal basis and violation of data minimization principles. The company was also ordered to replace the system with a less intrusive alternative.
AI summary of the linked source. Not reviewed by an editor. How this works
Run ANSPDCP?
Get an email when a new story names ANSPDCP, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonTIP TOP FOOD INDUSTRY SRL collected and processed employee fingerprints for attendance and access control without a valid legal basis under GDPR, violating both Article 9 (special category data) and the data minimization principle. Biometric data is afforded heightened protection under GDPR because it is uniquely personal, immutable, and carries severe risks if misused or breached. The company failed to assess whether less intrusive alternatives — such as PIN codes or ID cards — could achieve the same operational goal, which is a fundamental requirement before processing special category data. This case illustrates that operational convenience does not constitute legal justification for processing sensitive biometric data, and organizations must conduct proper legal basis assessments before deploying such systems.