ANSPDCP (Romanian DPA) — ARRISE LIVE SRL
ANSPDCP issued a warning to ARRISE LIVE over its plan to deploy a facial-recognition system for employee access control, finding the biometric processing would breach GDPR lawfulness, necessity and proportionality and recommending less-intrusive access methods.
Key takeaway — how to prevent this
Biometric data (faces, iris, fingerprints) needs an explicit lawful basis or consent. Scraping or capturing it without one is unlawful across the EU/UK and many US states (e.g. Illinois BIPA) — and draws the largest fines.
Case brief
Read from the authority's press release on 2026-09-06. Every holding carries a short verbatim quote from that text (in RO, the document's language).
- Decided by
- Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal
- Parties
- Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal v. ARRISE LIVE SRL
- Decision date
- March 12, 2026
- Remedy
- The authority issued a warning to ARRISE LIVE SRL and recommended using less intrusive access control methods that do not involve processing biometric data.
- Appeal
- Appeal status not stated
Key holdings
ANSPDCP initiated an investigation following reports that ARRISE LIVE SRL intended to implement a facial recognition security system for employee access.
“operatorul ARRISE LIVE SRL intenționează să implementeze un sistem de securitate bazat pe recunoaștere facială pentru accesul angajaților societății în sedii/puncte de lucru.”
The investigation determined that the planned processing of biometric data did not fulfill the requirements of lawfulness, necessity, and proportionality.
“situația prezentată de operator nu se subsuma cerințelor de legalitate, necesitate și proporționalitate a prelucrării datelor biometrice ale propriilor angajați/furnizori/vizitatori”
The authority recommended that the company adopt less intrusive alternatives for access control that do not require processing biometric data.
“operatorului i s-a recomandat să utilizeze mijloace mai puțin intruzive pentru atingerea scopului prelucrării care să nu implice prelucrarea datelor biometrice.”
The regulator issued an official warning because operating the facial recognition system could violate data protection principles.
“a emis o avertizare în temeiul art. 58 alin. (2) lit. a) din Regulamentul (UE) 2016/679.”
In plain English
The Romanian Data Protection Authority finalized an investigation into the company ARRISE LIVE SRL following reports that the company intended to install a facial recognition system for controlling access to its premises. At the time of the investigation, the company was using card-based access control and had not yet deployed the biometric system or processed biometric data of employees, suppliers, or visitors. Although the planned system was intended to enhance physical security and prevent unauthorized access or misuse of access cards, the authority determined that the proposed biometric data processing failed to meet statutory criteria for lawfulness, necessity, and proportionality. The regulator observed that using facial recognition for workplace access could infringe upon individuals privacy rights and personal data protections when less invasive alternatives exist. Consequently, the authority issued an official warning under European data protection regulations. The regulator advised ARRISE LIVE SRL to rely on less intrusive measures that do not involve processing biometric data to achieve its security objectives.
Inclusion does not imply wrongdoing or liability. Status reflects the latest information we have — always check the official source for current status.