Sportitalia (the controller) – €20,000 Fine (Italy, 2022)
Sportitalia, a sports club in Milan, was fined for collecting employee fingerprints without proper consent. This matters because it shows that companies must get clear permission before using biometric data. Businesses should ensure they have valid consent processes in place to avoid similar penalties.
What happened
Sportitalia collected biometric data from its employees to track attendance without obtaining valid consent.
Who was affected
Employees at Sportitalia's fitness clubs whose fingerprints were collected for attendance tracking were affected.
What the authority found
The Italian DPA ruled that Sportitalia violated GDPR rules by not having valid consent for processing biometric data.
Why this matters
This case highlights the importance of obtaining clear consent for biometric data collection. Other businesses should review their data collection practices to ensure compliance.
GDPR Articles Cited
View original scraped data
Original data from scraper before AI verification against source document.
National Law Articles
Sportitalia, an amateur sports club (the controller) manages several fitness clubs in Milan. The controller installed a system that collected biometric data (fingerprints) of its employees (the data subjects) to record their attendance at the sports clubs, and make it easier for them to record the entry and exit times from work as well as to adopt a simple and faster system than the badge-based system previously in use. This biometric system was installed in the registered office of the controller and its seven clubs with a total of 132 data subjects concerned. In October 2018, a trade union organisation lodged a complaint with the Italian DPA against the controller claiming that the system was illegal. The DPA initiated an investigation followed by a sanctioning procedure. During the procedure, the controller submitted that the processing of the data subjects' data was based on free and express consent. The controller emphasised that the data subjects could refuse to the use of the biometric system in favour of the badge, although no data subject requested the use of this alternative method. In its defence, the controller stated that this system had the sole purpose of detecting the attendance of employees in order to facilitate the registration of entry and exit times. The controller also argued to have acted in good faith and transparency with the data subjects by informing them that they could refuse to grant consent to the use of this biometric system or that they could withdraw their consent anytime. The controller indicated that, as of 2 May 2022, it would discontinue using the biometric system and erase all acquired data, returning to the traditional badge registration system. For this reason, the controller instructed its processor to erase the biometric data collected and processed during the use of the fingerprint scanning device. The Italian DPA noted that biometric data constitute sensitive data under Article 9(1) GDPR. Additionally, any processing
Violations (1)
Non-essential cookies (tracking, advertising) are placed on the user's device before obtaining valid consent.
Art. 6(1) GDPR
Related Enforcement Actions (0)
No other enforcement actions found for Sportitalia (the controller) in IT
This is the only recorded action for this entity in this jurisdiction.
Similar Cases
Enforcement actions with similar violations
Details
Fine Date
10 November 2022
Authority
Garante per la protezione dei dati personali
Fine Amount
€20,000
GDPRhub ID
gdprhub-5572About this data
Cite as: Cookie Fines. Sportitalia (the controller) - Italy (2022). Retrieved from cookiefines.eu
Last updated: