Romanian Firm Fined €5,000 for Unlawful Biometric Employee Tracking
Written by AI from the linked story. Not reviewed by an editor. How this works
TIP TOP FOOD INDUSTRY SRL deployed a fingerprint-based attendance and access control system without a lawful basis under GDPR, violating the data minimization principle by collecting biometric data — a special category requiring strict justification — when less intrusive alternatives were available. Biometric data is inherently sensitive and irreversible; unlike passwords, a compromised fingerprint cannot be changed. The DPA's intervention highlights that organizations must conduct a proportionality assessment before processing special category data and must demonstrate necessity, not just convenience. This case underscores that operational efficiency goals do not override employees' fundamental rights to data protection.
Tactical Insight
Immediate actions
- Conduct a Data Protection Impact Assessment (DPIA) before deploying any biometric or special-category data processing system.
- Replace biometric attendance systems with less intrusive alternatives (e.g., PIN cards, RFID badges) where no clear legal necessity exists.
Policy & Compliance measures
- Establish an internal review process requiring DPO sign-off and documented lawful basis before any new personal data processing system is introduced.
- Map all existing data processing activities involving special-category data and validate each against GDPR Article 9 lawful bases.
- Train HR and operations teams on GDPR obligations specific to employee data, including biometrics and consent requirements.
Long-term improvements
- Embed data minimization and privacy-by-design principles into procurement and system design workflows.
- Schedule annual audits of all access control and workforce management systems to ensure ongoing compliance with data protection regulations.
- Develop a vendor assessment checklist to evaluate the privacy implications of any third-party attendance or HR technology before adoption.