Privacy Authority fine for facial recognition in the workplace

1. The facts

   According to reports from Agenda Digitale and the Privacy Authority's Newsletter, the case stems from inspection of the company L.S. S.r.l. active in logistics and services. The company had installed a tablet at warehouse entrances that, through a face scan and comparison with a biometric template stored in the cloud, recorded employees' entry and exit times. The legal stage involves an administrative sanctioning order issued by the Authority (injunction order), which rejected defense arguments based on the need to prevent badge swapping among employees. The company had neither conducted an impact assessment nor consulted union representatives, rendering the monitoring intrusive and lacking the necessary guarantees required by Italian law.

2. 

   The legal framework

   The central provisions are Art. 9 of the GDPR, which establishes a prohibition on processing biometric data except under rare exceptions not applicable in this context, and Art. 4 of the Workers' Statute. The latter allows remote monitoring only for organizational, operational, or safety needs, following a union agreement or administrative authorization. Violating these rules leads to the nullity of processing, the inadmissibility of collected data for disciplinary purposes, and administrative fines that can reach 4% of global annual turnover. The obligation to conduct a data protection impact assessment (DPIA) represents another mandatory requirement whose absence worsens the employer's position.

3. What the case law says

   Supreme Court jurisprudence and the established guidance of the Privacy Authority clarify that in an employment relationship, employee consent is never a valid legal basis. This is due to the so-called power imbalance between the parties, which deprives consent of its voluntary nature. Furthermore, it has been established that the principle of proportionality prevents the use of biometrics when the goal of certifying attendance can be achieved with less invasive tools, such as the traditional magnetic badge. Courts have repeatedly confirmed that non-compliance with the union procedures set by the Workers' Statute makes any form of technological monitoring unlawful, regardless of the purpose declared by the employer.

5. Analysis drafted and verified with edit.legal

   To verify the provisions cited in this article, we used edit.legal. Test our legal AI on official sources and apply it to your own matters.

   Try edit.legal AI

8. What it teaches professionals

   1. The data protection impact assessment (DPIA) must precede the purchase of any innovative monitoring technology to avoid investments at risk of sanctions.
   2. Employee consent must never be used as the legal basis for processing special categories of data.
   3. Union agreements or Labor Inspectorate authorizations are mandatory conditions of lawfulness for any tool that could even potentially monitor workers remotely.
   4. The distinction between biometric data and simple identifying data is sharp: any transformation of physical characteristics into algorithmic models falls under the prohibition of Art. 9 GDPR.

References: Art. 9 GDPRArt. 5 GDPRArt. 4 Legge 300/1970Art. 114 D.Lgs. 196/2003Provvedimento n. 353/2024 Garante Privacy (L.S. S.r.l.)

Editorial oversight: Avv. Federico Papa·ICAMUpdated 14 October 2026Content drafted with AI support and subject to editorial source checks. Despite these controls, inaccuracies may remain: reports and rectification requests are welcome. Report a correction