Privacy & Information Security Law Blog

On February 23, 2024, the UK Information Commissioner’s Office (the “ICO”) reported that it had ordered public service providers Serco Leisure, Serco Jersey and associated community leisure trusts (jointly, “the Companies”) to stop using facial recognition technology (“FRT”) and fingerprint scanning (“FS”) to monitor employee attendance.

According to the ICO, the Companies, who process biometric data as controllers or joint controllers in 38 leisure facilities, failed to demonstrate the necessity and proportionality of using FRT and FS to monitor employee attendance, considering that less intrusive means such as ID cards and fobs were available.

This enforcement action follows the ICO’s recent guidance on monitoring in the workplace, and in reaching its decision, the ICO took into consideration the imbalance of power between employee and employer which, according to the regulator, made it unlikely that employees would be able to refuse the collection and use of their biometric data for monitoring attendance.

The Companies were ordered by the ICO to cease the processing of biometric data to monitor employee attendance and to delete all biometric data that they are not required to retain within three months.  Read the ICO’s decision and press release.