Romanian Firm Fined €5,000 for Unlawful Biometric Fingerprint System
Written by AI from the linked story. Not reviewed by an editor. How this works
TIP TOP FOOD INDUSTRY SRL deployed a biometric fingerprint-based time-and-attendance system without establishing a valid legal basis under GDPR, violating both the data minimization principle (Article 5(1)(c)) and the strict rules governing special category data (Article 9). Biometric data is inherently sensitive because it is immutable — unlike passwords, fingerprints cannot be changed if compromised — making unlawful processing a severe and lasting privacy risk for employees. The company failed to evaluate whether less intrusive alternatives (e.g., PIN cards or RFID badges) could achieve the same operational goal, breaching the proportionality requirement. This case underscores that organizations must conduct a thorough legal basis assessment and a Data Protection Impact Assessment (DPIA) before deploying any biometric system, not after a regulatory complaint.
Tactical Insight
Immediate actions
- Audit all existing biometric or special-category data processing activities to verify a documented, valid legal basis under GDPR Article 9.
- Suspend or replace any biometric system that lacks a completed Data Protection Impact Assessment (DPIA) until compliance is confirmed.
Long-term improvements
- Embed a 'privacy by design' review into procurement processes so that less intrusive alternatives are always evaluated before deploying biometric solutions.
- Establish a data classification policy that flags biometric and special-category data for mandatory DPO review and enhanced safeguards.
- Train HR, IT, and management teams on GDPR obligations specific to employee monitoring and biometric data handling.
Governance & compliance measures
- Appoint or engage a qualified Data Protection Officer (DPO) to review all new data processing activities involving sensitive personal data before go-live.
- Maintain a Record of Processing Activities (RoPA) under GDPR Article 30 that explicitly documents the legal basis, necessity, and proportionality justification for each processing operation.