United KingdomProfessional services2019–2024Serco Leisure
Facial recognition and fingerprint scanning to record staff attendance and pay
UK data regulator orders Serco Leisure to stop using facial recognition on more than 2,000 staff
Problem
Serco Leisure and associated trusts used facial recognition, and in two sites fingerprint scanning, at 38 leisure facilities to monitor attendance for more than 2,000 workers. The ICO found they had not shown the processing was necessary or proportionate.
Approach
On 23 February 2024 the ICO issued nine enforcement notices to Serco Leisure, Serco Jersey and seven community leisure trusts. They must stop using biometric data for attendance and destroy data they are not legally required to keep within three months.
Results
Takeaway
Staff are in a weak position to refuse, so employee consent carries little weight with the regulator. Cards or fobs were seen as an adequate alternative.
Categories
- Size
- Large enterprise
- Industry
- Professional services
- Business function
- Human resourcesProduction and quality
- Innovation type
- Process innovation
- AI technology
- Computer vision
- Adoption
- Vendor solution
- Evidence
- Regulator, audit or court
Sources
Source summaries
The ICO issued nine enforcement notices over the staff biometric attendance system. It set a three-month deadline to stop its use and destroy data that did not have to be retained by law.
Full details are in the original sources.
