[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fteQfrexVGaeW7gsJPrPNfDd-iUXP8Il1MBNjH91vqhI":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":22,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":49,"controls":50},"cba8824f-71c4-4af9-bcbe-16fb44604e2e","romanian-firm-fined-5000-for-unlawful-biometric-time-tracking-without-legal-basis","330b558c-f290-441f-ab1d-5a41e2ddccf0","Romanian Firm Fined €5,000 for Unlawful Biometric Time-Tracking Without Legal Basis","TIP TOP FOOD INDUSTRY SRL collected and processed employee fingerprints for attendance and access control without establishing a valid legal basis under GDPR, violating Articles 5 and 6. Biometric data is classified as 'special category' data under GDPR Article 9, requiring explicit consent or another qualifying legal ground — none of which the company demonstrated. The core failure was deploying an intrusive biometric system without first conducting a legal and proportionality review, ignoring the data minimization principle. This case illustrates that convenience-driven technology adoption can carry significant legal and financial consequences when privacy-by-design principles are ignored from the outset.","**Immediate actions:**\n- Audit all existing systems that collect biometric or special category data and verify a documented lawful basis exists for each.\n- Replace or suspend any biometric processing system that lacks a compliant legal justification until proper grounds are established.\n\n**Policy & Governance improvements:**\n- Conduct a Data Protection Impact Assessment (DPIA) before deploying any system processing biometric, health, or other special category data.\n- Implement a privacy-by-design review process so that less intrusive alternatives (e.g., PIN cards, RFID badges) are evaluated before biometric solutions are selected.\n- Establish a formal data minimization policy requiring business justification for all personal data collected.\n\n**Training & Awareness measures:**\n- Train HR, IT, and procurement teams on GDPR special category data obligations before they evaluate or purchase new workforce management tools.\n- Assign a Data Protection Officer (DPO) or privacy lead with authority to approve or reject data collection systems prior to deployment.",[12,13,14,15,16,17,18,19,20,21],"GDPR Article 5(1)(a) – Lawfulness, fairness, and transparency","GDPR Article 5(1)(c) – Data minimization","GDPR Article 6 – Lawfulness of processing","GDPR Article 9 – Processing of special categories of personal data","GDPR Article 25 – Data protection by design and by default","GDPR Article 35 – Data Protection Impact Assessment (DPIA)","NIST Privacy Framework PR.DS-P1 – Data processing transparency","NIST SP 800-122 – Guide to Protecting PII","CIS Control 3 – Data Protection","ISO 27001 Annex A.18.1 – Compliance with legal and contractual requirements",{},"published","2026-09-29T10:21:42.164313+00:00","2026-09-29T10:21:42.061+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=ANSPDCP_(Romania)_-_TIP_TOP_FOOD_INDUSTRY_SRL&diff=53205&oldid=53204","anspdcp-romania-tip-top-food-industry-srl-f57427","ANSPDCP (Romania) - TIP TOP FOOD INDUSTRY SRL",[31,37,43],{"id":32,"name":33,"slug":34,"description":35,"color":36},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":38,"name":39,"slug":40,"description":41,"color":42},"c0dcc566-3654-4d70-8ede-262a198e732f","Regulatory Compliance","regulatory-compliance","GDPR, NIS2, DORA, sector-specific violations","#ec4899",{"id":44,"name":45,"slug":46,"description":47,"color":48},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",[],[]]