Romanian Firm Fined €5,000 for Unlawful Biometric Time-Tracking Without Legal Basis

Written by AI from the linked story. Not reviewed by an editor. How this works

TIP TOP FOOD INDUSTRY SRL collected and processed employee fingerprints for attendance and access control without establishing a valid legal basis under GDPR, violating Articles 5 and 6. Biometric data is classified as 'special category' data under GDPR Article 9, requiring explicit consent or another qualifying legal ground — none of which the company demonstrated. The core failure was deploying an intrusive biometric system without first conducting a legal and proportionality review, ignoring the data minimization principle. This case illustrates that convenience-driven technology adoption can carry significant legal and financial consequences when privacy-by-design principles are ignored from the outset.

Tactical Insight

Immediate actions

Audit all existing systems that collect biometric or special category data and verify a documented lawful basis exists for each.
Replace or suspend any biometric processing system that lacks a compliant legal justification until proper grounds are established.

Policy & Governance improvements

Conduct a Data Protection Impact Assessment (DPIA) before deploying any system processing biometric, health, or other special category data.
Implement a privacy-by-design review process so that less intrusive alternatives (e.g., PIN cards, RFID badges) are evaluated before biometric solutions are selected.
Establish a formal data minimization policy requiring business justification for all personal data collected.

Training & Awareness measures

Train HR, IT, and procurement teams on GDPR special category data obligations before they evaluate or purchase new workforce management tools.
Assign a Data Protection Officer (DPO) or privacy lead with authority to approve or reject data collection systems prior to deployment.