ANSPDCP (Romania) - TIP TOP FOOD INDUSTRY SRL
Romania's ANSPDCP fines TIP TOP FOOD INDUSTRY SRL €5,000 for unlawful biometric data processing.
Romania's data protection authority (ANSPDCP) has fined TIP TOP FOOD INDUSTRY SRL €5,000 (RON 26,236) for violating GDPR principles. The company used a fingerprint-based system for employee attendance and access control, which the DPA found to be unlawful and a violation of data minimization principles. The DPA also ordered the company to replace the system with a less intrusive alternative.
AI summary of the linked source. Not reviewed by an editor. How this works
Run ANSPDCP?
Get an email when a new story names ANSPDCP, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonTIP TOP FOOD INDUSTRY SRL deployed a fingerprint-based attendance and access control system without a lawful basis under GDPR, violating the data minimization principle by collecting biometric data — a special category requiring strict justification — when less intrusive alternatives were available. Biometric data is inherently sensitive and irreversible; unlike passwords, a compromised fingerprint cannot be changed. The DPA's intervention highlights that organizations must conduct a proportionality assessment before processing special category data and must demonstrate necessity, not just convenience. This case underscores that operational efficiency goals do not override employees' fundamental rights to data protection.