L’Igiene Urbana Evolution S.r.l. – €70,000 Fine (Italy, 2024)

On 24 October 2022, some employees with the Italian DPA (‘Garante’). They raised concerns that since February 2022, a biometric facial recognition system, specifically identified as the 'Face Deep 3 - Smart Face Recognition System' produced by Anviz Global, was being utilized for accessing the worksite in Ardea where they conducted their work tasks and for monitoring their attendance. This system was also employed for employees of L'Igiene Urbana Evolution s.r.l., Blue Work s.r.l., Unica s.r.l., and DM Technology s.r.l. The case at hand focused on the alleged data processing violations by L'Igiene Urbana Evolution s.r.l., ('the controller'). The complaint included photographic documentation indicating concerns regarding the handling of sensitive biometric data, as well as the potential for unauthorized access or misuse of this data, which could compromise the privacy and personal information of the employees involved. L'Igiene Urbana Evolution s.r.l. used the services provided by DM Technology s.r.l. It was noted by the controller that the manufacturer and supplier of the facial recognition devices had issued a "declaration and certification of conformity" for the biometric device, asserting its full compliance with GDPR regulations. Based on the complaints and defence statement by the companies concerned, the DPA initiated its own investigation. The Garante found that there were two rounds of processing. First, a processing of biometric data in the registration phase to learn the biometric features of the employees and, second, processing in the biometric recognition phase, at the time of attendance on the site. Although in the employment context the purposes of recording employee attendance and verifying compliance with working time may fall within the scope of Article 9(2)(b) GDPR the processing of biometric data is permitted only 'in so far as it is authorised by Union or Member State law [...] subject to appropriate safeguards for the fundamental rights and