[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fFMKiXB97sLyiKYnWBg3uLvv-eWzyjwRLxLzmnCsG5GM":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":21,"status":31,"created_at":32,"published_at":33,"article":34,"tags":38,"podcasts":57,"controls":58},"873e8446-aed7-4bfa-87c6-ddb440c40f9c","romanian-dpa-fines-employer-5000-for-unlawful-biometric-attendance-system","b4dbb56a-5e58-4702-b902-30deb6f6fc73","Romanian DPA Fines Employer €5,000 for Unlawful Biometric Attendance System","TIP TOP FOOD INDUSTRY SRL collected and processed employee fingerprints for attendance and access control without a valid legal basis under GDPR, violating both Article 9 (special category data) and the data minimization principle. Biometric data is afforded heightened protection under GDPR because it is uniquely personal, immutable, and carries severe risks if misused or breached. The company failed to assess whether less intrusive alternatives — such as PIN codes or ID cards — could achieve the same operational goal, which is a fundamental requirement before processing special category data. This case illustrates that operational convenience does not constitute legal justification for processing sensitive biometric data, and organizations must conduct proper legal basis assessments before deploying such systems.","**Immediate actions:**\n- Audit all existing data processing activities involving biometric or special category data to verify a documented legal basis exists under GDPR Article 9.\n- Suspend any biometric data processing systems where a valid legal basis or Data Protection Impact Assessment (DPIA) cannot be produced.\n\n**Long-term improvements:**\n- Replace biometric attendance and access control systems with less intrusive alternatives (e.g., RFID cards, PIN codes) where biometrics are not strictly necessary.\n- Embed a formal Privacy by Design review process into all new system procurement decisions to evaluate necessity and proportionality before deployment.\n- Establish a GDPR compliance calendar to periodically reassess all data processing activities against current legal requirements.\n\n**Governance & awareness measures:**\n- Train HR and operations management on the legal requirements for processing employee biometric data, including when explicit consent or another Article 9 condition must be met.\n- Assign a Data Protection Officer (DPO) or equivalent role to review high-risk processing activities and liaise with the supervisory authority proactively.",[12,13,14,15,16,17,18,19,20],"GDPR Article 5(1)(c) – Data Minimization Principle","GDPR Article 9 – Processing of Special Categories of Personal Data","GDPR Article 25 – Data Protection by Design and by Default","GDPR Article 35 – Data Protection Impact Assessment (DPIA)","NIST Privacy Framework PR.DS-P1 – Data Minimization","NIST SP 800-122 – Protection of Personally Identifiable Information","CIS Control 3 – Data Protection","ISO\u002FIEC 27001:2022 Annex A 5.34 – Privacy and Protection of PII","ITIL Service Design – Information Security Management",{"CIS Control 3 – Data Protection":22,"GDPR Article 5(1)(c) – Data Minimization Principle":23,"NIST Privacy Framework PR.DS-P1 – Data Minimization":24,"ITIL Service Design – Information Security Management":25,"GDPR Article 25 – Data Protection by Design and by Default":26,"GDPR Article 35 – Data Protection Impact Assessment (DPIA)":27,"ISO\u002FIEC 27001:2022 Annex A 5.34 – Privacy and Protection of PII":28,"GDPR Article 9 – Processing of Special Categories of Personal Data":29,"NIST SP 800-122 – Protection of Personally Identifiable Information":30},"Data protection includes classifying biometric data as highly sensitive and limiting its collection.","Data minimisation means using less intrusive attendance methods, such as badges, rather than collecting employee fingerprints.","Minimisation principles would have challenged the need for biometric data for attendance tracking.","Information security management in service design would assess privacy risks before deploying biometric systems.","Data protection by design would have chosen an attendance system that did not need biometrics.","A DPIA before deploying fingerprint attendance would have exposed the lack of legal basis and less intrusive options.","Protecting PII requires a lawful basis and safeguards, which the fingerprint system lacked.","Fingerprints used for identification are special category data, needing a valid exception that TIP TOP FOOD lacked.","PII protection guidance stresses minimising collection of sensitive identifiers like fingerprints.","published","2026-09-29T16:22:18.009823+00:00","2026-09-29T16:22:17.469+00:00",{"id":7,"url":35,"slug":36,"title":37},"https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=ANSPDCP_(Romania)_-_TIP_TOP_FOOD_INDUSTRY_SRL&diff=53221&oldid=53218","anspdcp-romania-tip-top-food-industry-srl-308f45","ANSPDCP (Romania) - TIP TOP FOOD INDUSTRY SRL",[39,45,51],{"id":40,"name":41,"slug":42,"description":43,"color":44},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":46,"name":47,"slug":48,"description":49,"color":50},"c0dcc566-3654-4d70-8ede-262a198e732f","Regulatory Compliance","regulatory-compliance","GDPR, NIS2, DORA, sector-specific violations","#ec4899",{"id":52,"name":53,"slug":54,"description":55,"color":56},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",[],[]]