On March 28, 2024, the Italian data protection authority (Garante) published its decision in case No. 105 as issued on February 22, 2024, in which it imposed a fine of €70,000 on L'igiene Urbana Evolution srl. (L'igiene Urbana Evolution) for violations of the General Data Protection Regulation (GDPR) following several complaints. 

Background to the decision

The Garante stated that it began an investigation after receiving complaints from employees of L'igiene Urbana Evolution stating that they were subject to facial recognition to access the construction site where they worked and to confirm their presence in the workplace. The Garante stated that its investigation determined two other companies in addition to L'igiene Urbana Evolution were operating at the construction site and the facial recognition system was used to record the attendance of the employees, seasonal, and substitute workers.  

The Garante stated that L'igiene Urbana Evolution confirmed during the investigation that it did not designate data controllers, carry out impact assessments, or provide specific information on the processing of biometric data to data subjects. 

Findings of the Garante

Following its investigation, the Garante determined that the processing of biometric data by L'igiene Urbana Evolution for the ordinary management of the employment relationship, dealing with disciplinary offenses, determining proper compensation of overtime work, and verification of personnel presence at the construction site was not compliant with the principles of minimization and proportionality under Article 5(1)(c) of the GDPR. The Garante stated the biometric data collected also included the data subjects of all three companies operating at the construction site and therefore the absence of a legal basis for the processing of biometric data constituted violations of Articles 5(1)(a), 5(1)(c), and 9 of the GPDR.

The Garante highlighted that the failure by L'igiene Urbana Evolution to provide information to employees regarding the characteristics of biometric data processed through facial recognition resulted in a violation of Articles 5(1)(a) and 13 of the GDPR. Also, the Garante mentioned that L'igiene Urbana Evolution used a separate company to manage the system that captured biometric data but failed to designate the company as a data controller where the company had access to the employee data in violation of Article 28 of the GDPR.

The Garante stated that a violation of Article 30 of the GDPR occurred where the record of processing activities did not indicate biometric data was processed. Also, the Garante found that login credentials for accessing the system which contained personal data were not modified from first access, allowing anyone with access to the user manual to login to the system. The Garante stated that this conduct included a violation of Article 32 of the GDPR as a result of a failure to maintain adequate technical and organizational measures. 

Lastly, the Garante stated that L'igiene Urbana Evolution did not carry out an impact assessment as required by Article 35 of the GDPR where processing involves the use of new technologies which present a high risk to the rights and freedoms of data subjects.

Outcomes

The Garante imposed a fine of €70,000 against L'igiene Urbana Evolution to be paid within 30 days of notification of the decision. L'igiene Urbana Evolution must also communicate initiatives that have been taken to delete the biometric data and provide adequate feedback to the Garante. 

You can read the newsletter here and the decision here, both only available in Italian.