Limits on the processing of biometric data for commercial and employment purposes

1. The facts

   The matter arises from a series of administrative sanctioning proceedings and fact-finding investigations. According to specialized media reports, the Data Protection Authority focused its attention on international projects, such as Sam Altman's Worldcoin, which involved collecting iris scans in exchange for financial incentives.

   Concurrently, in February 2024, the Authority sanctioned two logistics and environmental services companies for introducing facial recognition systems for attendance tracking. While the administrative sanctions regarding attendance tracking are now final, investigations into emotion recognition systems (Emotion AI) in call centers remain under scrutiny ahead of the full implementation of the AI Act. The primary allegations concern violations of transparency and the invalidity of free consent where there is a structural power imbalance or a financial incentive.

2. 

   The rules in play

   The regulatory framework relies on EU Regulation 2016/679 (GDPR), specifically Article 9, which prohibits the processing of special categories of data (including biometric data) except under narrow exceptions, and Article 22, which guarantees the right not to be subject to decisions based solely on automated processing.

   This is complemented by EU Regulation 2024/1689 (AI Act): Article 5(1)(f) explicitly prohibits AI systems designed to infer emotions in the workplace and educational institutions. Article 26 establishes human oversight obligations for high-risk AI systems. Domestically, Article 2-septies of the Italian Privacy Code regulates specific safeguard measures for biometric data processing in compliance with general authorizations issued by the Data Protection Authority.

3. What the case law says

   The established stance of the courts of legitimacy and supervisory authorities places fundamental weight on the principles of proportionality and necessity. The Authority has repeatedly clarified that processing biometric data for mere attendance tracking is unlawful where less intrusive alternatives, such as traditional keycards, are available.

   With respect to employment relationships, case law confirms that employee consent does not constitute a valid legal basis owing to the inherent subordination link, which vitiates genuine freedom of choice. Furthermore, administrative jurisprudence has reaffirmed the principle of algorithmic transparency, holding that any automated decision-making process must be transparent and subject to human review to prevent discriminatory outcomes.

5. Analysis drafted and verified with edit.legal

   To verify the provisions cited in this article, we used edit.legal. Test our legal AI on official sources and apply it to your own matters.

   Try edit.legal AI

8. Lessons for professionals

   The key operational takeaways for legal practitioners are:

   1. Always perform a thorough DPIA (Data Protection Impact Assessment) prior to deploying computer vision technologies.
   2. Avoid utilizing algorithms to monitor the psychophysical or emotional states of employees, given the strict prohibition imposed by the AI Act.
   3. Ensure that processing operations in employment contexts do not rely solely on consent as their legal basis.
   4. Continuously monitor guidance issued by supervisory authorities, as technological developments frequently outpace statutory frameworks.

References: Regolamento UE 2016/679 (GDPR) Art. 9, 22Regolamento UE 2024/1689 (AI Act) Art. 5, 26D.Lgs. 196/2003 (Codice Privacy) Art. 2-septiesOrientamenti del Garante sul divieto di riconoscimento facciale per la rilevazione delle presenze

Editorial oversight: Avv. Federico Papa·ICAMUpdated 14 May 2026Content drafted with AI support and subject to editorial source checks. Despite these controls, inaccuracies may remain: reports and rectification requests are welcome. Report a correction