- Enforcing jurisdiction
- Italy · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
Cappello Giovanni & Figli s.r.l. – €120,000 Fine (Italy, 2024)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
Cappello Giovanni & Figli s.r.l. was fined EUR 120,000 for using facial recognition technology to monitor employee attendance without proper consent. The Italian data protection authority ruled that the company could not rely on employee consent due to the power imbalance in employer-employee relationships. This case highlights the risks of using biometric data without clear legal grounds.
What happened
The company was fined for unlawfully using facial recognition technology to monitor employee attendance.
Who was affected
Employees whose biometric data was recorded for attendance monitoring were affected.
What the authority found
The authority determined that the company lacked a valid legal basis for processing biometric data, violating data protection rules.
Why this matters
This ruling emphasizes that companies must have a strong legal basis for processing sensitive data like biometric information. It serves as a warning to businesses about the potential consequences of misusing such technology.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Automated check recorded — 10 March 2026.
Processing notes: national law identified, scope corrected.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The Italian DPA has imposed a fine of EUR 120,000 on Cappello Giovanni & Figli s.r.l.. The controller had used facial recognition technology to monitor the attendance of employees. During its investigation, the DPA found that such extensive recording of biometric data to monitor attendance was not permitted. The controller referred to the consent given by the employees as the legal basis for the data processing. However, the DPA concluded that the controller could not rely on consent, as voluntary consent is questionable in an employee-employer relationship. In addition, the DPA found that the recordings were stored for an excessively long time.
Related Enforcement Actions (0)
No other enforcement actions found for Cappello Giovanni & Figli s.r.l. in IT
This is the only recorded action for this entity in this jurisdiction.
Details
Fine Date
6 June 2024
Authority
Garante per la protezione dei dati personali
Fine Amount
€120,000
About this data
Cite as: Cookie Fines. Cappello Giovanni & Figli s.r.l. - Italy (2024). Retrieved from cookiefines.eu
Last updated: