[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fBYXRDgbOlvJ_F0kRdRUaFxSHg3uaYoDhFBixa5lZ1Go":3},{"article":4,"iocs":46,"watch_terms":47,"solutions":48,"lesson":51},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"b4dbb56a-5e58-4702-b902-30deb6f6fc73","ANSPDCP (Romania) - TIP TOP FOOD INDUSTRY SRL","anspdcp-romania-tip-top-food-industry-srl-308f45","← Older revision Revision as of 14:58, 29 September 2026 Line 84: Line 84: }} }} The DPA fined a company €5,000 (RON 26,236) for using a system to monitor its employees’ attendance and access to its premises that relies on the processing of personal data in the form of fingerprints. The DPA fined an employer RON 26,236 (€5,000) for using a system to monitor its employees’ attendance and access to its premises that relies on the processing of personal data in the form of fingerprints. == English Summary == == English Summary ==","Romania's National Supervisory Authority for Personal Data Processing (ANSPDCP) fined TIP TOP FOOD INDUSTRY SRL €5,000 (RON 26,236) for violating GDPR. The company used employee fingerprints for attendance and access control, which the DPA deemed unlawful due to a lack of legal basis and violation of data minimization principles. The company was also ordered to replace the system with a less intrusive alternative.","Romania's DPA fines TIP TOP FOOD INDUSTRY SRL €5,000 for unlawful fingerprint data processing.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=ANSPDCP_(Romania)_-_TIP_TOP_FOOD_INDUSTRY_SRL&diff=53221&oldid=53218","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002Fc\u002Fc2\u002FLogoRO.jpg","2026-09-29T14:58:25+00:00","2026-09-29T16:00:40.447705+00:00",7,[17,20],{"name":18,"type":19},"ANSPDCP","vendor",{"name":21,"type":22},"TIP TOP FOOD INDUSTRY SRL","product","d95477d7-eb04-4fad-a2dc-be1428040ce7",{"id":23,"icon":25,"name":26,"slug":27},null,"Privacy Fines","privacy-fines",[29,34,39,44],{"category":30},{"id":31,"icon":25,"name":32,"slug":33},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":35},{"id":36,"icon":25,"name":37,"slug":38},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":40},{"id":41,"icon":25,"name":42,"slug":43},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",{"category":45},{"id":23,"icon":25,"name":26,"slug":27},[],[18,21],{"controls":49,"vendors":50},[],[],{"slug":52,"title":53,"body":54,"framework_refs":55,"framework_notes":65},"romanian-dpa-fines-employer-5000-for-unlawful-biometric-attendance-system","Romanian DPA Fines Employer €5,000 for Unlawful Biometric Attendance System","TIP TOP FOOD INDUSTRY SRL collected and processed employee fingerprints for attendance and access control without a valid legal basis under GDPR, violating both Article 9 (special category data) and the data minimization principle. Biometric data is afforded heightened protection under GDPR because it is uniquely personal, immutable, and carries severe risks if misused or breached. The company failed to assess whether less intrusive alternatives — such as PIN codes or ID cards — could achieve the same operational goal, which is a fundamental requirement before processing special category data. This case illustrates that operational convenience does not constitute legal justification for processing sensitive biometric data, and organizations must conduct proper legal basis assessments before deploying such systems.",[56,57,58,59,60,61,62,63,64],"GDPR Article 5(1)(c) – Data Minimization Principle","GDPR Article 9 – Processing of Special Categories of Personal Data","GDPR Article 25 – Data Protection by Design and by Default","GDPR Article 35 – Data Protection Impact Assessment (DPIA)","NIST Privacy Framework PR.DS-P1 – Data Minimization","NIST SP 800-122 – Protection of Personally Identifiable Information","CIS Control 3 – Data Protection","ISO\u002FIEC 27001:2022 Annex A 5.34 – Privacy and Protection of PII","ITIL Service Design – Information Security Management",{"CIS Control 3 – Data Protection":66,"GDPR Article 5(1)(c) – Data Minimization Principle":67,"NIST Privacy Framework PR.DS-P1 – Data Minimization":68,"ITIL Service Design – Information Security Management":69,"GDPR Article 25 – Data Protection by Design and by Default":70,"GDPR Article 35 – Data Protection Impact Assessment (DPIA)":71,"ISO\u002FIEC 27001:2022 Annex A 5.34 – Privacy and Protection of PII":72,"GDPR Article 9 – Processing of Special Categories of Personal Data":73,"NIST SP 800-122 – Protection of Personally Identifiable Information":74},"Data protection includes classifying biometric data as highly sensitive and limiting its collection.","Data minimisation means using less intrusive attendance methods, such as badges, rather than collecting employee fingerprints.","Minimisation principles would have challenged the need for biometric data for attendance tracking.","Information security management in service design would assess privacy risks before deploying biometric systems.","Data protection by design would have chosen an attendance system that did not need biometrics.","A DPIA before deploying fingerprint attendance would have exposed the lack of legal basis and less intrusive options.","Protecting PII requires a lawful basis and safeguards, which the fingerprint system lacked.","Fingerprints used for identification are special category data, needing a valid exception that TIP TOP FOOD lacked.","PII protection guidance stresses minimising collection of sensitive identifiers like fingerprints."]