Security News > 2024 > February > Data watchdog tells off outsourcing giant for scanning staff biometrics despite 'power imbalance'

A data protection watchdog in the UK has issued an enforcement notice to stop Serco from using facial recognition tech and fingerprint scanning to monitor staff at 38 leisure centers it runs.

During an investigation, the Information Commissioner's Office, Britain's regulator set up to enforce data protection law, found Serco Leisure and several associated community leisure trusts had unlawfully processed the biometric data of more than 2,000 employees at all 38 of the leisure facilities to check attendance and calculate pay.

There is no clear way for staff to opt out of the system, increasing the power imbalance in the workplace and putting people in a position where they feel like they have to hand over their biometric data to work there.

The ICO has also instructed Serco Leisure and the trusts to destroy all biometric data that they are not legally obliged to retain within three months.

"Serco Leisure did not fully consider the risks before introducing biometric technology to monitor staff attendance, prioritizing business interests over its employees' privacy. There is no clear way for staff to opt out of the system, increasing the power imbalance in the workplace and putting people in a position where they feel like they have to hand over their biometric data to work there," he said in a statement.

As well as issuing the enforcement notice on Serco and the leisure trusts, the ICO has released new guidance designed to help organizations understand where they can and cannot use biometric data.

News URL

https://go.theregister.com/feed/www.theregister.com/2024/02/26/uk_data_protection_watchdog_halts/