The Italian Data Protection Authority’s newsletter number 520 of March 28, 2024 reports the issuance of five decisions by the authority against as many companies involving the implementation and operation of a facial recognition system to detect workplace attendance by employees at waste disposal sites.
Following the establishment of a number of violations with regard to data protection regulation, each of the companies involved was fined along with a ban on the use of the data thus acquired (Art. 2-decies, Privacy Code), with the accessory penalty of publication of the relevant decision on the authority’s institutional website.
These decisions, all of which have as a central aspect the assessment of the lawfulness of facial recognition processing for the purpose of attendance monitoring, contain a number of insights into some of the main GDPR compliances, which are also deemed worthy of analysis in subsequent articles.
Decisions of the authority
The mentioned decisions, all bearing the date of February 22, 2024, are identified by the following codes: web doc nos. 9995680, 9995701, 9995741, 9995762 and 9995785.
The major of these is web doc No. 9995680 in which the main issues under complaint and assessment are addressed in relation to the lead company of the temporary business association to which the companies involved belonged.
The remaining four decisions substantially follow the one referred to here although, some of them contain additional highlights that we will comment below.
Summary of the facts
Employee recognition devices based on facial biometrics are installed at waste disposal sites and used for attendance tracking.
Based on statements made by some of the companies involved it would appear that the biometric devices were installed mainly as a result of numerous incidents of absenteeism and disputes initiated by workers against companies over claims of overtime compensation.
These disputes would have been unsuccessful for companies because of the impossibility of verifying with certainty the actual hours worked, as paper time sheets were previously used.
Moreover, the ordinary tools of enforcement adopted for this purpose, again according to company statements, would prove ineffective.
As a result of the inspection investigation, the companies involved ordered the precautionary suspension of processing using the facial recognition system.
