Biometric systems used to monitor staff data now under review after ICO clampdown
British leisure businesses are reviewing use of controversial biometric technology to monitor staff attendance after a clampdown from the UK’s data regulator.
Back in February, the Information Commissioner’s Office (ICO) ordered public service provider Serco Leisure and its trusts to stop using facial recognition technology and fingerprint scanning to monitor employee attendance.
The regulator investigated the company and found it was “unlawfully” processing the biometric data of more than 2,000 employees at 38 leisure facilities.
Speaking at the time, John Edwards, UK Information Commissioner as “wholly unique to a person so the risks of harm in the event of inaccuracies or a security breach are much greater – you can’t reset someone’s face or fingerprint like you can reset a password.”
Commenting at the time, senior data protection solicitor, Becky White at Harper James said the “ICO has a tough stance on unauthorised employee monitoring, and this enforcement notice sends a clear message.”
Now, other similar companies are starting to review the biometric systems used to monitor their own staff in light of the regulators clampdown on Serco.
Speaking to City A.M, leisure club operator Virgin Active said it has made the decision to remove biometric scanners from all its clubs. A spokesperson said: “We are working with Shopworks on an alternative solution and will roll this out ASAP. We are working on this as a priority and the change has been communicated to all clubs already.”
The risks of harm in the event of inaccuracies or a security breach are much greater – you can’t reset someone’s face or fingerprint like you can reset a password.
John Edwards, UK Information Commissioner
Now, this is not just a UK issue, earlier this year, Amazon France Logistique was fined €32m by the French Data Protection Authority for implementing an overly intrusive system to monitor employee activity and performance.
While the AI Act, which recently received approval from the European Parliament, prohibits controlled use of real-time biometric ID in public spaces.
Speaking to Morning Wire, Hannah Pettit, data associate at law firm Ashfords stated that “monitoring can be a useful tool for employers wanting to track employee activity… however, as monitoring will inherently involve the processing of the personal data of employees and workers, it is important to ensure that the methods used are compliant with data protection legislation.”
She explained that the law requires employers to carry out a data protection impact assessment (DPIA) to assess the necessity and proportionality of data processing activities they are planning to undertake in certain situations.
“This covers points such as whether monitoring is appropriate, why they are considering it, any impact it may have on employees and whether alternative methods have been considered,” she added.
Pettit noted that “workplace monitoring should be used with caution, and reasonable expectations of workers should be an important factor in any decision to implement workplace monitoring.” Her example is to provide staff with the option of a swipe card if they are not comfortable with having biometric data stored.
“Ultimately, it will only be appropriate where it is necessary and proportionate. If it is neither, or if there are less intrusive ways for an employer to achieve its aims or satisfy its business interests, then workplace monitoring should be avoided,” she concluded.