orderConcluded
Information Commissioner's Office (ICO) — Serco Leisure Operating Limited
February 23, 2024 · United Kingdom
The ICO issued enforcement notices ordering Serco Leisure and associated trusts to stop using facial recognition and fingerprint scanning to monitor the attendance of more than 2,000 employees across 38 leisure facilities, finding the biometric processing unlawful, and to delete the data.
Key takeaway — how to prevent this
Biometric data (faces, iris, fingerprints) needs an explicit lawful basis or consent. Scraping or capturing it without one is unlawful across the EU/UK and many US states (e.g. Illinois BIPA) — and draws the largest fines.
Inclusion does not imply wrongdoing or liability. Status reflects the latest information we have — always check the official source for current status.