fineConcluded€120,000
Garante per la protezione dei dati personali — Cappello Giovanni & Figli S.r.l.
June 6, 2024 · Italy
The Garante fined a company EUR 120,000 and banned its X-Face 380 facial-recognition system for employee attendance control, holding there is no legal basis for biometric processing for this purpose and that it breached minimisation and proportionality.
Key takeaway — how to prevent this
Biometric data (faces, iris, fingerprints) needs an explicit lawful basis or consent. Scraping or capturing it without one is unlawful across the EU/UK and many US states (e.g. Illinois BIPA) — and draws the largest fines.
Inclusion does not imply wrongdoing or liability. Status reflects the latest information we have — always check the official source for current status.