School Fined for Unlawful Biometric Data Processing

An Italian high school was fined by the data protection authority for using a fingerprint-based attendance system for administrative staff. The authority found the system lacked a legal basis and that employee consent was not a valid justification due to the power imbalance between employer and employee.


Following a complaint, the Italian Supervisory Authority (SA) - Garante found out that a high school adopted a biometric recognition system that, in order to detect presence in office and prevent damage and vandalism, required the use of administrative staff's fingerprints. The workers involved were those who had given their consent and did not wish to use traditional methods of attesting their presence at the office.

The Italian SA recalled that, according to the GDPR and the Italian Data Protection Code, the use of biometric data in the workplace requires a clear legal provision and specific guarantees for the rights of the data subjects. But the national provisions that provided for the introduction of biometric presence detection systems in the public sector were repealed in 2020. 

Regarding the consent given by the workers to the school, the Italian SA considered that, in the light of the asymmetry between employees and employers, consent is not a valid legal basis for the lawfulness of the processing of personal data in the employment context, both in the public and private sector.

The Italian SA fined the high school 4 000 EUR.

(source: edpb.europa.eu/ photo freepik.com)

Comments

Post a Comment

Popular posts from this blog

Ombudsman inquiry on Commission President’s text messages is a wake-up call for EU

Image
The European Ombudsman inquiry into the Commission’s handling of a request for text messages between its President and the CEO of a pharmaceutical company is a wake-up call for all EU institutions about ensuring accountability in an era of instant messaging. One year after the initial request by a journalist, the Commission has still not clarified whether messages reported to concern major vaccine procurement deals exist and whether the public is entitled to see them. The Ombudsman had asked the Commission, in a finding of maladministration in January, to conduct a more thorough search for the text messages. The Commission’s recent response failed to say whether it had looked directly and correctly for the text messages and if not, why not. While the response recognised that work-related text messages can be EU documents, it reiterated that the Commission’s internal policy is, in effect, not to register text messages. The Ombudsman has closed  the inquiry  and upheld...
Read more

New President of the European Court of Human Rights

Image
The European Court of Human Rights has elected on 28.4.2025 Mattias Guyomar, Judge elected in respect of France, as its new President.  Mattias Guyomar succeeds Marko Bošnjak, Judge elected in respect of Slovenia. He will take up office on 30 May 2025. Read his bio here Furthermore, the Judge elected in respect of Armenia, Vahe Grigoryan, was formally sworn in in the Court's Main Hearing Room on 28.4.2025. Read as well:  Interventions in Justice System and the role of Artificial Intelligence / article by Giorgos Kazoleas, Lawyer in Cyprus
Read more

Access to documents: the Commission decision refusing a journalist of The New York Times access to the text messages exchanged between President von der Leyen and the CEO of Pfizer is annulled (CJEU)

Image
In its Judgment dated 14/5/2025 in Case T-36/23 (Stevi and The New York Times v Commission), the General Court ruled that the Commission decision refusing a journalist of The New York Times access to the text messages exchanged between President von der Leyen and the CEO of Pfizer is annulled. By an application based on the Access to Documents Regulation, [1], Matina Stevi, a journalist working for the daily newspaper The New York Times, requested the European Commission to provide access to all text messages exchanged between President Ursula von der Leyen and Albert Bourla, the chief executive officer of Pfizer, between 1 January 2021 and 11 May 2022.  The Commission rejected that application on the ground that it did not hold the documents covered by it. Ms Stevi and The New York Times requested the General Court of the European Union to annul the Commission’s decision.  In its judgment, the General Court upholds the action and annuls the Commission’s decision. The Court re...
Read more

An overview of the regulatory framework on Gambling Services in the European Union

Image
written by Efi Thoma * The European Union (EU) does not have a harmonized, single regulatory framework for betting companies. Instead, the regulation of gambling services, including betting, remains largely within the competence of individual Member States.  This results in a diverse and often fragmented legal framework across the EU. While the EU facilitates some level of cooperation and sets overarching principles, the specifics of licensing, operational requirements, and consumer protection measures vary significantly from country to country. Despite the lack of a unified framework, several key principles and EU-level instruments influence the national regulations of betting companies. More specifically, the Treaty on the Functioning of the European Union (TFEU) guarantees the freedom of establishment and the freedom to provide services within the EU. These fundamental freedoms mean that Member States cannot unjustifiably restrict betting companies legally established in ano...
Read more

Imposition of a fine on a bank in Greece for an incident of personal data breach

Image
The Greek Data Protection Supervisory Authority imposed on a Bank, as Data Controller, an administrative fine of EUR 100,000 for violating the principles of accuracy, integrity, and confidentiality of data, and the principles of data protection by design and by default, in conjunction with Articles 32, 33, and 34 of the GDPR, as well as an administrative fine of EUR 20,000 for violating the complainants' right of access. Complaints were submitted to the Supervisory Authority of Greece against the National Bank of Greece for the incorrect linking of a complainant's bank account with the mobile phone number of another complainant in the “i-bank Pay application”, which resulted in money transfers, via “IRIS online payments service”, which were made to the first complainant's account instead of the second's.  In the context of the administrative audit conducted by the Authority, the Bank eventually identified that the issue was due to incorrect configuration during the ...
Read more

Convention for the Protection of the Profession of Lawyer has been opened for signature

Image
The Council of Europe Convention for the Protection of the Profession of Lawyer has been opened for signature on the occasion of the meeting of Council of Europe Foreign Ministers organised in Luxembourg on 13-14 May. This is the first-ever international treaty aimed at protecting the profession of lawyer in a context of increasing reports of attacks on the practice of the profession, whether in the form of harassment, threats or attacks, or interference with the exercise of professional duties. The  Convention  has been signed by Andorra, Estonia, France, Greece, Ireland, Italy, Lithuania, Luxembourg, Netherlands, North Macedonia, Norway, Poland and Sweden. Belgium, Iceland, the Republic of Moldova and the United Kingdom will sign it on 14 May. Lawyers play a key role in upholding the rule of law and securing access to justice for all, including to defend victims of possible human rights violations. Therefore, public confidence in justice s...
Read more

Delays in national courts lead to violations of right to a fair trial (ECtHR)

Image
The European Court of Human Rights found that the delays of eight years and six months and seven years that applicants' cases had been pending before the Supreme Court had been excessive. In Chamber’s judgment in the case of ARB SHPK and Others v. Albania (applications nos. 39860/19, 38996/20, 6142/22 and 27370/22) the European Court of Human Rights held,unanimously, that there had been a violation of Article 6 § 1 (right to a fair trial) of the European Convention on Human Rights as regards ARB SHPK’s and Mr Gazidedja’s applications, and a violation of Article 13 (right to an effective remedy) as regards Mr Gazidedja’s application. The case concerned alleged excessive length of proceedings in cases taken before the Albanian courts. The Court found in particular that the delays of eight years and six months and seven years that ARB SHPK’s cases had been pending before the Supreme Court had been excessive. Regarding Mr Gazidedja’s case, the Court noted that he had not received c...
Read more