fineConcluded€20,000
State Data Protection Inspectorate (VDAI) — UAB VS FITNESS
June 21, 2021 · Lithuania
The VDAI fined fitness operator VS FITNESS EUR 20,000 for unlawfully processing customers' and employees' fingerprint (biometric) data, finding that consent collected via a mandatory self-service fingerprint terminal with no alternative access method was not freely given under GDPR Article 9.
Key takeaway — how to prevent this
Biometric data (faces, iris, fingerprints) needs an explicit lawful basis or consent. Scraping or capturing it without one is unlawful across the EU/UK and many US states (e.g. Illinois BIPA) — and draws the largest fines.
Inclusion does not imply wrongdoing or liability. Status reflects the latest information we have — always check the official source for current status.