In the examined decision, the Authority found that the use of both biometric recognition hardware and work activity tracking software was unlawful. Specifically, the Authority focused on two distinct applications used by the fined employer: first, the biometric recognition hardware called “X FACE 360” and second, the tracking software called “INFINITY DMS”.

A) The X Face 360 Biometric Tracking Hardware: Violations of Lawfulness, Data Minimization, and Storage Limitation Principles (Articles 5, 9, and 13 of the GDPR). Issues with Informed Consent from Employees.

The investigation revealed that the fined company used a facial recognition system to record employee attendance starting from December 2018. This processing—affecting 40 employees at the Modica and Ragusa sites—was intended solely to process attendance data for payroll purposes and to provide a monthly report to the CDL.

According to the GDPR, biometric data is considered a special category of data, processing of which is permitted only if necessary for specific labor-related obligations and rights, and authorized by laws or collective agreements, to ensure adequate protection for workers’ rights (Article 9(2)(b) of the GDPR; also Articles 88(1) and Recitals 51-53 of the GDPR).

The Authority found that the collection and processing of biometric data violated the principles of lawfulness, data minimization, and storage limitation because:

1.The legal basis for data collection and processing was not demonstrated: Informed consent from employees was not deemed an adequate legal basis due to the imbalance in the contractual relationship between workers and employer. This principle is essential, as it sets precise limits on the validity of employee consent, often compromised by the need to accept contractual terms that may include more or less evident restrictions on their rights.

2.The necessity of processing was not specified: That is, the specific purposes guiding data collection and processing were not clarified.

3.The retention period for biometric data was considered excessive, extending unreasonably until the end of the employment relationship.

The Authority concluded that the company’s processing of biometric data violated Articles 5(1)(a), (c), (e), 9(2)(b), and 13 of the Regulation.

B) The Infinity DMS Monitoring Software: Violations of Lawfulness, Fairness, and Transparency in Data Management (Articles 5, 6, and 13 of the GDPR).

The second issue addressed by the Authority concerned the lawfulness, fairness, and transparency of data collected through the “Infinity DMS” software. The investigation showed that the software was used to record various stages of work activity, including breaks, with specific reasons (e.g., rest, waiting for replacements).

The software was also used to collect and process personal data related to workshop clients (who were provided with information) and details about the types of interventions performed on vehicles, which were entered by employees.

The investigation revealed that while the company had prepared a record of processing activities in accordance with Article 30 of the Regulation, it had not provided sufficient details about the software, making it difficult to assess the nature and type of processed data, the methods and retention periods, and the necessity and proportionality of the data processing relative to the purposes.

The employee information provided was also incomplete, failing to give a full account of data processing.

To sum up, even in this case the company did not provide an adequate legal basis for processing, merely stating that the software was necessary to improve quality standards imposed by the parent company.

Consequently, the Authority found that the processing violated the principles of lawfulness, fairness, and transparency outlined in Articles 5(1)(a), 6, and 13 of the GDPR.