SpainPublic sector2023–2024Gestió Iniciatives Cabrera SA (GICSA)
Facial recognition for municipal-service staff attendance
GICSA withdrew facial attendance tracking and was sanctioned for processing staff biometrics without a legal basis
Problem
GICSA, a municipal-services company in Cabrera de Mar, used facial recognition to record employees' working time.
Approach
The system operated from January 2023 to November 2024. Following an employee complaint, the Catalan data protection authority found that the processing lacked a legal basis and that the required impact assessment had followed deployment. Reporting in July 2025 described an initial €31,000 sanction. The municipality acknowledged an error, said it had stopped the system after the authority's warning, and announced a review of staff attendance and access controls.
Results
Takeaway
GICSA completed its impact assessment after deployment. By the time the municipality reviewed its attendance controls, the facial recognition system had already been withdrawn.
Categories
- Size
- Small business
- Industry
- Public sector
- Business function
- Human resources
- Innovation type
- Process innovation
- AI technology
- Computer vision
- Adoption
- Vendor solution
- Evidence
- Press reporting
Sources
Source summaries
The report cited decision PS 113/2024 and gave the January 2023 to November 2024 operating period. It described the initial €31,000 sanction and the missing legal basis and prior impact assessment.
The report carried the municipality's response. It acknowledged an error, said the system had been stopped after the regulator's warning, and announced a review of attendance and access controls.
Full details are in the original sources.
