ANSPDCP (Romanian DPA) — Entirely Shipping & Trading S.R.L.
ANSPDCP fined Entirely Shipping & Trading ~EUR 5,000 for unlawfully processing employees' biometric data (fingerprints) for access control under Article 9 GDPR when less-intrusive means were available.
Key takeaway — how to prevent this
Biometric data (faces, iris, fingerprints) needs an explicit lawful basis or consent. Scraping or capturing it without one is unlawful across the EU/UK and many US states (e.g. Illinois BIPA) — and draws the largest fines.
Case brief
Read from the authority's press release on 2026-09-19. Every holding carries a short verbatim quote from that text (in RO, the document's language).
- Decided by
- Autoritatea Naţională de Supraveghere a Prelucrării Datelor cu Caracter Personal
- Parties
- Autoritatea Naţională de Supraveghere a Prelucrării Datelor cu Caracter Personal v. Entirely Shipping & Trading S.R.L.
- Decision date
- December 13, 2019
- Remedy
- The authority imposed two fines of 23,893 lei (5,000 EUR each), issued two warnings, and ordered corrective measures to ensure compliance with GDPR transparency, data minimization, and security requirements.
- Appeal
- Appeal status not stated
Key holdings
The authority fined the company 5,000 EUR for excessively monitoring employees via video surveillance cameras installed in offices and changing rooms.
“operatorul a prelucrat în mod excesiv datele cu caracter personal (imaginea) ale angajaților săi prin intermediul camerelor video instalate în birourile în care aceștia își desfășoară activitatea”
The company was fined 5,000 EUR for collecting employee fingerprint biometric data when less intrusive access control alternatives were available.
“operatorul a prelucrat date biometrice (amprente) ale angajaților putând fi utilizate şi alte mijloace pentru atingerea acestui scop, mai puţin intruzive pentru viața privată a persoanelor vizate”
The controller received a warning for continuing to process a former employee's personal data by sending email correspondence under their identity post-employment.
“operatorul a prelucrat ilegal datele cu caracter personal ale unui fost angajat prin utilizarea acestora în cadrul corespondenței prin poșta electronică, în scopul desfăşurării activităţii societăţii”
In plain English
Following a complaint, the National Supervisory Authority for Personal Data Processing completed an investigation into Entirely Shipping & Trading S.R.L. on December 13, 2019. The complainant alleged that the company installed audio-video monitoring cameras in employee offices, changing rooms, and dining areas, restricted access to certain areas using fingerprint biometrics, and used a former employee's identity to send work emails after their employment ended without prior notification. The authority found multiple violations of the General Data Protection Regulation. Entirely Shipping & Trading S.R.L. failed to provide transparent information under Articles 12 and 13, excessively processed image data, collected biometric fingerprint data when less intrusive options existed, and unlawfully used a former employee's personal data. Furthermore, the company failed to demonstrate legitimate interests override employee rights, did not consult employee representatives, failed to perform a data protection impact assessment, and lacked adequate technical and organizational security measures. As a consequence, the authority issued two warnings and two separate fines of 23,893 lei, each equivalent to 5,000 EUR. The authority also ordered corrective measures requiring the controller to update its transparency information, align video surveillance and access control with the principle of data minimization, and implement an adequate security policy.
Inclusion does not imply wrongdoing or liability. Status reflects the latest information we have — always check the official source for current status.