Context
Serco Leisure, Serco Jersey and seven associated community leisure trusts have been issued enforcement notices ordering them to stop using facial recognition technology (FRT) and fingerprint scanning to monitor employee attendance.
Key points to note and next actions
The ICO’s investigation found that Serco and the trusts have been unlawfully processing the biometric data of more than 2,000 employees at 38 leisure facilities for the purpose of monitoring attendance.
- Serco failed to show why it is necessary or proportionate to use FRT and fingerprint scanning for this purpose, when there are less intrusive means available such as ID cards or fobs.
- Employees were not offered a clear alternative to having their faces and fingerprints scanned to clock in and out of the workplace.
- The warning comes as the ICO publishes new guidance for organisations on processing biometric data lawfully