Garante per la protezione dei dati personali — Cappello Giovanni & Figli S.r.l.
The Garante fined a company EUR 120,000 and banned its X-Face 380 facial-recognition system for employee attendance control, holding there is no legal basis for biometric processing for this purpose and that it breached minimisation and proportionality.
Key takeaway — how to prevent this
Biometric data (faces, iris, fingerprints) needs an explicit lawful basis or consent. Scraping or capturing it without one is unlawful across the EU/UK and many US states (e.g. Illinois BIPA) — and draws the largest fines.
Case brief
Read from the decision on 2026-09-18. Every holding carries a short verbatim quote from that text (in IT, the document's language).
- Decided by
- Garante per la protezione dei dati personali
- Parties
- Garante per la protezione dei dati personali v. Cappello Giovanni & Figli s.r.l.
- Decision date
- June 6, 2024
- Remedy
- The authority imposed an administrative fine of 120,000 euros, prohibited the processing of employee biometric data via facial recognition, and ordered the company to bring its management software processing into compliance within 90 days.
- Amount
- €120,000
- Appeal
- Appeal status not stated
Key holdings
Italian law does not permit the processing of employee biometric data for attendance monitoring purposes.
“ad oggi, l’ordinamento vigente non consente il trattamento dei dati biometrici dei dipendenti, per finalità di rilevazione della presenza in servizio.” — Section 3.1
Employee consent cannot serve as a valid legal basis for processing biometric data because of the power imbalance inherent in the employment relationship.
“nell’ambito del rapporto di lavoro il consenso manifestato dai dipendenti non può essere considerato idoneo presupposto di liceità, ciò alla luce dell’asimmetria tra le rispettive parti del rapporto di lavoro” — Section 3.1
The authority ordered the company to pay an administrative fine of 120,000 euros for violating multiple provisions of the GDPR.
“ORDINA ai sensi dell’art. 58, par. 2, lett. i), del Regolamento a Cappello Giovanni & Figli s.r.l. di pagare la somma di euro 120.000,00” — Section 5
In plain English
Following a complaint lodged in 2021 by an employee, the Italian Data Protection Authority investigated Cappello Giovanni & Figli s.r.l., an auto dealership company employing around 40 staff across two units in Modica and Ragusa. The investigation revealed that starting in 2018, the company used a facial recognition hardware device named X-Face 380 to monitor employee attendance for payroll preparation. Additionally, the company utilized a management software named Infinity DMS to log daily employee tasks, including specific downtime reasons and breaks. The Garante found that processing employees' biometric facial data for attendance tracking lacked a legal basis under European and national law. The authority noted that employee consent cannot be considered freely given due to the inherent power imbalance in employment relationships. Furthermore, storing biometric template data until contract termination breached principles of data minimization and storage limitation. The company also failed to provide adequate information notices regarding both the facial recognition device and the software system. Consequently, the Garante declared the processing unlawful, issued a prohibition on processing employee biometric data through facial recognition, ordered the company to bring its Infinity DMS software processing into compliance within 90 days, and imposed an administrative fine of 120,000 euros.
Inclusion does not imply wrongdoing or liability. Status reflects the latest information we have — always check the official source for current status.