School Fined for Unlawful Biometric Data Processing Summary

An Italian high school was fined by the data protection authority for using a fingerprint-based attendance system for administrative staff. The authority found the system lacked a legal basis and that employee consent was not a valid justification due to the power imbalance between employer and employee. Following a complaint, the Italian Supervisory Authority (SA) - Garante found out that a high school adopted a biometric recognition system that, in order to detect presence in office and prevent damage and vandalism, required the use of administrative staff's fingerprints. The workers involved were those who had given their consent and did not wish to use traditional methods of attesting their presence at the office. The Italian SA recalled that, according to the GDPR and the Italian Data Protection Code, the use of biometric data in the workplace requires a clear legal provision and specific guarantees for the rights of the data subjects. But the national provisions that prov...