Information Commissioner's Office (ICO) — Serco Leisure Operating Limited
The ICO issued enforcement notices ordering Serco Leisure and associated trusts to stop using facial recognition and fingerprint scanning to monitor the attendance of more than 2,000 employees across 38 leisure facilities, finding the biometric processing unlawful, and to delete the data.
Key takeaway — how to prevent this
Biometric data (faces, iris, fingerprints) needs an explicit lawful basis or consent. Scraping or capturing it without one is unlawful across the EU/UK and many US states (e.g. Illinois BIPA) — and draws the largest fines.
Case brief
Read from the order on 2026-09-19. Every holding carries a short verbatim quote from that text.
- Decided by
- Information Commissioner's Office
- Parties
- Information Commissioner's Office v. Serco Leisure Operating Limited
- Decision date
- February 23, 2024
- Remedy
- Serco Leisure, Serco Jersey, and seven associated community leisure trusts were ordered to stop using facial recognition technology and fingerprint scanning to monitor employee attendance.
- Appeal
- Appeal status not stated
Key holdings
Serco Leisure and associated trusts were ordered to cease using facial recognition technology and fingerprint scanning to track employee attendance.
“issued enforcement notices ordering them to stop using facial recognition technology and fingerprint scanning to monitor employee attendance.”
The ICO found that the entities unlawfully processed the biometric data of over 2,000 employees across 38 facilities.
“unlawfully processing the biometric data of more than 2,000 employees at 38 leisure facilities for the purpose of monitoring attendance.”
In plain English
The Information Commissioner's Office (ICO) issued enforcement notices against Serco Leisure Operating Limited, Serco Jersey, and seven associated community leisure trusts. The action followed an investigation by the regulator into how these entities monitored staff attendance across 38 leisure facilities. The ICO found that Serco Leisure and the trusts were unlawfully processing the biometric data of more than 2,000 employees. Specifically, the organizations used facial recognition technology and fingerprint scanning to monitor employee attendance. Processing biometric data for workplace attendance tracking in this context was found to be unlawful under data protection laws. As a consequence of these findings, the ICO issued enforcement notices ordering Serco Leisure, Serco Jersey, and the seven associated community leisure trusts to stop using facial recognition technology and fingerprint scanning for employee monitoring. The text does not report any financial penalties imposed alongside the notices. This case demonstrates the strict limitations placed on employers regarding the use of biometric tracking systems and facial recognition in workplace attendance monitoring.
Inclusion does not imply wrongdoing or liability. Status reflects the latest information we have — always check the official source for current status.