Garante per la protezione dei dati personali — Depac Societa Cooperativa Sociale

Decided by

Garante per la protezione dei dati personali

Parties

Garante per la protezione dei dati personali v. Depac Società Cooperativa Sociale a r.l.

Decision date

February 26, 2026

Remedy

The Garante prohibited further processing of employees' biometric data, ordered the deletion of all collected fingerprint data within 60 days, and imposed an administrative fine of 15,000 euros.

Amount

€15,000

Appeal

Appeal status not stated

Key holdings

1. Italian law does not permit the processing of employee biometric data for workplace attendance tracking purposes.

   “l’ordinamento vigente non consente il trattamento di dati biometrici dei dipendenti per finalità di rilevazione della presenza in servizio.” — Section 3.3

2. Using biometric fingerprint data to track employee attendance violates data minimization and proportionality principles when less intrusive methods are available.

   “non è conforme ai principi di minimizzazione e proporzionalità del trattamento (art. 5 del Regolamento), tenuto conto che i medesimi obiettivi possono essere utilmente perseguiti con strumenti meno invasivi” — Section 3.3

3. Processing employee biometric data without providing an appropriate privacy notice violates transparency obligations.

   “Il trattamento predetto è avvenuto anche in assenza di un’informativa idonea a rappresentare agli interessati le principali caratteristiche del trattamento, in violazione dell’art. 13 del Regolamento” — Section 3.4

4. A data controller must conduct a data protection impact assessment prior to deploying biometric authentication systems on employees.

   “la Società non ha provveduto ad effettuare una valutazione di impatto prima dell’inizio dei trattamenti stessi.” — Section 3.5

5. Failure to maintain a record of processing activities violates GDPR requirements.

   “L’assenza della predisposizione di un registro delle attività di trattamento, da parte della Società, risulta in contrasto con quanto stabilito dall’art. 30 del Regolamento” — Section 3.6

In plain English

Following a report by local police in December 2024, the Italian Data Protection Authority investigated Depac Società Cooperativa Sociale a r.l. regarding the use of biometric fingerprint scanners to track employee working hours. Inspections conducted in June 2025 revealed that the cooperative had installed 2 fingerprint detection devices since September 2024—one at the local town hall and another at a municipal depot—to monitor 6 employees. The authority found multiple violations of data protection law. Under Italian and European rules, processing employee biometric data solely to record attendance is not permitted, as attendance can be tracked through less intrusive methods. Furthermore, the cooperative failed to respond to the authority's initial request for information, provided no written privacy notice to the affected workers, did not conduct a required data protection impact assessment, and failed to maintain a formal record of processing activities. As a consequence, the authority issued a decision on February 26, 2026, banning any further processing of the employees' biometric data and ordering the cooperative to delete all collected fingerprint data within 60 days. The authority also imposed a fine of 15,000 euros on the cooperative. This decision underscores that employers cannot use invasive biometric surveillance technologies for routine workplace attendance monitoring when traditional, less intrusive alternatives are available.