[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fVxHl7W4y_8MEocSkptIpi-KGeoI5sCot_7cKd2GuJYE":3},{"article":4,"iocs":46,"watch_terms":47,"solutions":48,"lesson":51},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"26a44aa0-6995-4dc6-ab98-8ea15f587da0","ANSPDCP (Romania) - TIP TOP FOOD INDUSTRY SRL","anspdcp-romania-tip-top-food-industry-srl-ed7d53","Holding ← Older revision Revision as of 14:08, 29 September 2026 Line 103: Line 103: The DPA stressed that when processing biometric data, the controller must pay specific attention to the principles of lawfulness, necessity, data minimisation and proportionality. This is because of the significant risks arising from the processing of biometric data in case of unauthorized access and the possibility to link biometric data to the identity of the data subject. The DPA stressed that when processing biometric data, the controller must pay specific attention to the principles of lawfulness, necessity, data minimisation and proportionality. This is because of the significant risks arising from the processing of biometric data in case of unauthorized access and the possibility to link biometric data to the identity of the data subject. The DPA fined the controller Romanian RON 26,236 (€5,000). Additionally, the DPA ordered the controller to replace the access control and time-keeping system with an alternative system that is less intrusive and does not rely on the processing of biometric data, and thus complies with the principle of data minimisation. The DPA fined the controller RON 26,236 (€5,000). Additionally, the DPA ordered the controller to replace the access control and time-keeping system with an alternative system that is less intrusive and does not rely on the processing of biometric data, and thus complies with the principle of data minimisation.","Romania's data protection authority (ANSPDCP) has fined TIP TOP FOOD INDUSTRY SRL €5,000 (RON 26,236) for violating GDPR principles. The company used a fingerprint-based system for employee attendance and access control, which the DPA found to be unlawful and a violation of data minimization principles. The DPA also ordered the company to replace the system with a less intrusive alternative.","Romania's ANSPDCP fines TIP TOP FOOD INDUSTRY SRL €5,000 for unlawful biometric data processing.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=ANSPDCP_(Romania)_-_TIP_TOP_FOOD_INDUSTRY_SRL&diff=53218&oldid=53205","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002Fc\u002Fc2\u002FLogoRO.jpg","2026-09-29T14:08:12+00:00","2026-09-29T16:00:40.447705+00:00",7,[17,20],{"name":18,"type":19},"ANSPDCP","vendor",{"name":21,"type":22},"TIP TOP FOOD INDUSTRY SRL","product","d95477d7-eb04-4fad-a2dc-be1428040ce7",{"id":23,"icon":25,"name":26,"slug":27},null,"Privacy Fines","privacy-fines",[29,34,39,44],{"category":30},{"id":31,"icon":25,"name":32,"slug":33},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":35},{"id":36,"icon":25,"name":37,"slug":38},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":40},{"id":41,"icon":25,"name":42,"slug":43},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",{"category":45},{"id":23,"icon":25,"name":26,"slug":27},[],[18,21],{"controls":49,"vendors":50},[],[],{"slug":52,"title":53,"body":54,"framework_refs":55,"framework_notes":65},"romanian-firm-fined-5000-for-unlawful-biometric-employee-tracking","Romanian Firm Fined €5,000 for Unlawful Biometric Employee Tracking","TIP TOP FOOD INDUSTRY SRL deployed a fingerprint-based attendance and access control system without a lawful basis under GDPR, violating the data minimization principle by collecting biometric data — a special category requiring strict justification — when less intrusive alternatives were available. Biometric data is inherently sensitive and irreversible; unlike passwords, a compromised fingerprint cannot be changed. The DPA's intervention highlights that organizations must conduct a proportionality assessment before processing special category data and must demonstrate necessity, not just convenience. This case underscores that operational efficiency goals do not override employees' fundamental rights to data protection.",[56,57,58,59,60,61,62,63,64],"GDPR Article 5(1)(c) – Data Minimisation","GDPR Article 9 – Processing of Special Categories of Personal Data","GDPR Article 35 – Data Protection Impact Assessment (DPIA)","GDPR Article 88 – Processing in the Context of Employment","NIST SP 800-122 – Guide to Protecting the Confidentiality of PII","NIST Privacy Framework PR.DS-P1 – Data minimization","CIS Control 3 – Data Protection","ISO\u002FIEC 27701 – Privacy Information Management System","EDPB Guidelines 05\u002F2022 on the use of facial recognition technology in the area of law enforcement",{"CIS Control 3 – Data Protection":66,"GDPR Article 5(1)(c) – Data Minimisation":67,"NIST Privacy Framework PR.DS-P1 – Data minimization":68,"ISO\u002FIEC 27701 – Privacy Information Management System":69,"GDPR Article 88 – Processing in the Context of Employment":70,"GDPR Article 35 – Data Protection Impact Assessment (DPIA)":71,"NIST SP 800-122 – Guide to Protecting the Confidentiality of PII":72,"GDPR Article 9 – Processing of Special Categories of Personal Data":73,"EDPB Guidelines 05\u002F2022 on the use of facial recognition technology in the area of law enforcement":74},"Data protection includes classifying biometric data as highly sensitive and restricting its collection.","Data minimisation required TIP TOP FOOD to use less intrusive attendance methods instead of collecting employee fingerprints.","Minimisation would have limited collection to what attendance tracking truly needs, which excludes biometrics.","A PIMS would have required privacy review before introducing biometric employee tracking.","Article 88 allows specific rules for employee data, but employer convenience does not justify biometric tracking.","A DPIA before deploying fingerprint tracking would have highlighted the missing legal basis and alternatives.","Protecting PII includes avoiding collection of highly sensitive identifiers like fingerprints when not necessary.","Fingerprints used to identify staff are special category data, and the employer had no valid exception to process them.","EDPB guidance on biometric technologies stresses necessity and proportionality, which the fingerprint system failed."]