[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f70VSCtMxcAAoTt-_BnvmM_l3lvE3pb6d86jiMRhu_lc":3},{"article":4,"iocs":49,"watch_terms":50,"solutions":51,"lesson":54},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"330b558c-f290-441f-ab1d-5a41e2ddccf0","ANSPDCP (Romania) - TIP TOP FOOD INDUSTRY SRL","anspdcp-romania-tip-top-food-industry-srl-f57427","← Older revision Revision as of 08:23, 29 September 2026 Line 90: Line 90: === Facts === === Facts === TIP TOP FOOD INDUSTRY SRL (controller) used a time-and-attendance and access-control system on its employees at its premise. This system was using personal data in the form of the employees’ fingerprints. TIP TOP FOOD INDUSTRY SRL (controller) used a time-and-attendance and access-control system on its employees at its premise. This system was using personal data in the form of the employees’ fingerprints. An individual lodged a complaint with the DPA. An individual lodged a complaint with the DPA. === Holding === === Holding === The DPA held that the system used by the controller violated the principles of data minimisation ([[Article 5 GDPR|Article 5(1)(c) GDPR]]) and lawfulness because the controller could not rely on a legal basis for processing biometric data pursuant to [[Article 9 GDPR|Article 9 GDPR]]. The DPA held that the system used by the controller violated the principles of data minimisation ([[Article 5 GDPR|Article 5(1)(c) GDPR]]) and lawfulness because the controller could not rely on a legal basis for processing biometric data pursuant to [[Article 9 GDPR]]. According to the DPA, the controller could have used less intrusive means for the objectives of access control and time tracking and therefore violated [[Article 5 GDPR|Article 5(1)(c) GDPR]]. The DPA stressed that when processing biometric data, the controller must pay specific attention to the principles of lawfulness, necessity, data minimisation and proportionality. This is because of the significant risks arising from the processing of biometric data in case of unauthorized access and the possibility to link biometric data to the identity of the data subject. According to the DPA, the controller could have used less intrusive means for the objectives of access control and time tracking and therefore violated [[Article 5 GDPR|Article 5(1)(c) GDPR]]. The DPA stressed that when processing biometric data, the controller must pay specific attention to the principles of lawfulness, necessity, data minimisation and proportionality. This is because of the significant risks arising from the processing of biometric data in case of unauthorized access and the possibility to link biometric data to the identity of the data subject. The DPA fined the controller Romanian RON 26,236 (€5,000). Additionally, the DPA ordered the controller to replace the access control and time-keeping system with an alternative system that is less intrusive and does not rely on the processing of biometric data, and thus complies with the principle of data minimisation. The DPA fined the controller Romanian RON 26,236 (€5,000). Additionally, the DPA ordered the controller to replace the access control and time-keeping system with an alternative system that is less intrusive and does not rely on the processing of biometric data, and thus complies with the principle of data minimisation.","The Romanian Data Protection Authority (ANSPDCP) fined TIP TOP FOOD INDUSTRY SRL €5,000 for violating GDPR principles. The company used employee fingerprints for time-and-attendance and access control without a proper legal basis, infringing on data minimization and lawfulness. The DPA ordered the company to replace the system with a less intrusive alternative.","Romania's DPA fines TIP TOP FOOD INDUSTRY SRL €5,000 for unlawful biometric data processing.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=ANSPDCP_(Romania)_-_TIP_TOP_FOOD_INDUSTRY_SRL&diff=53205&oldid=53204","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002Fc\u002Fc2\u002FLogoRO.jpg","2026-09-29T08:23:59+00:00","2026-09-29T10:00:17.645822+00:00",7,[17,20],{"name":18,"type":19},"ANSPDCP","vendor",{"name":21,"type":22},"time-and-attendance and access-control system","product","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":23,"icon":25,"name":26,"slug":27},null,"Policy","policy",[29,34,39,44],{"category":30},{"id":31,"icon":25,"name":32,"slug":33},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":35},{"id":36,"icon":25,"name":37,"slug":38},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":40},{"id":41,"icon":25,"name":42,"slug":43},"614132b8-5837-4952-b8b5-c6c9a32a1d85","Privacy","privacy",{"category":45},{"id":46,"icon":25,"name":47,"slug":48},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[],[18,21],{"controls":52,"vendors":53},[],[],{"slug":55,"title":56,"body":57,"framework_refs":58,"framework_notes":69},"romanian-firm-fined-5000-for-unlawful-biometric-time-tracking-without-legal-basis","Romanian Firm Fined €5,000 for Unlawful Biometric Time-Tracking Without Legal Basis","TIP TOP FOOD INDUSTRY SRL collected and processed employee fingerprints for attendance and access control without establishing a valid legal basis under GDPR, violating Articles 5 and 6. Biometric data is classified as 'special category' data under GDPR Article 9, requiring explicit consent or another qualifying legal ground — none of which the company demonstrated. The core failure was deploying an intrusive biometric system without first conducting a legal and proportionality review, ignoring the data minimization principle. This case illustrates that convenience-driven technology adoption can carry significant legal and financial consequences when privacy-by-design principles are ignored from the outset.",[59,60,61,62,63,64,65,66,67,68],"GDPR Article 5(1)(a) – Lawfulness, fairness, and transparency","GDPR Article 5(1)(c) – Data minimization","GDPR Article 6 – Lawfulness of processing","GDPR Article 9 – Processing of special categories of personal data","GDPR Article 25 – Data protection by design and by default","GDPR Article 35 – Data Protection Impact Assessment (DPIA)","NIST Privacy Framework PR.DS-P1 – Data processing transparency","NIST SP 800-122 – Guide to Protecting PII","CIS Control 3 – Data Protection","ISO 27001 Annex A.18.1 – Compliance with legal and contractual requirements",{}]