Romanian DPA Fines Employer €5,000 for Unlawful Biometric Attendance System
Written by AI from the linked story. Not reviewed by an editor. How this works
TIP TOP FOOD INDUSTRY SRL collected and processed employee fingerprints for attendance and access control without a valid legal basis under GDPR, violating both Article 9 (special category data) and the data minimization principle. Biometric data is afforded heightened protection under GDPR because it is uniquely personal, immutable, and carries severe risks if misused or breached. The company failed to assess whether less intrusive alternatives — such as PIN codes or ID cards — could achieve the same operational goal, which is a fundamental requirement before processing special category data. This case illustrates that operational convenience does not constitute legal justification for processing sensitive biometric data, and organizations must conduct proper legal basis assessments before deploying such systems.
Tactical Insight
Immediate actions
- Audit all existing data processing activities involving biometric or special category data to verify a documented legal basis exists under GDPR Article 9.
- Suspend any biometric data processing systems where a valid legal basis or Data Protection Impact Assessment (DPIA) cannot be produced.
Long-term improvements
- Replace biometric attendance and access control systems with less intrusive alternatives (e.g., RFID cards, PIN codes) where biometrics are not strictly necessary.
- Embed a formal Privacy by Design review process into all new system procurement decisions to evaluate necessity and proportionality before deployment.
- Establish a GDPR compliance calendar to periodically reassess all data processing activities against current legal requirements.
Governance & awareness measures
- Train HR and operations management on the legal requirements for processing employee biometric data, including when explicit consent or another Article 9 condition must be met.
- Assign a Data Protection Officer (DPO) or equivalent role to review high-risk processing activities and liaise with the supervisory authority proactively.