ANSPDCP (Romania) - TIP TOP FOOD INDUSTRY SRL
Romania's DPA fines TIP TOP FOOD INDUSTRY SRL €5,000 for unlawful biometric data processing.
The Romanian Data Protection Authority (ANSPDCP) fined TIP TOP FOOD INDUSTRY SRL €5,000 for violating GDPR principles. The company used employee fingerprints for time-and-attendance and access control without a proper legal basis, infringing on data minimization and lawfulness. The DPA ordered the company to replace the system with a less intrusive alternative.
AI summary of the linked source. Not reviewed by an editor. How this works
Run ANSPDCP?
Get an email when a new story names ANSPDCP, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonTIP TOP FOOD INDUSTRY SRL collected and processed employee fingerprints for attendance and access control without establishing a valid legal basis under GDPR, violating Articles 5 and 6. Biometric data is classified as 'special category' data under GDPR Article 9, requiring explicit consent or another qualifying legal ground — none of which the company demonstrated. The core failure was deploying an intrusive biometric system without first conducting a legal and proportionality review, ignoring the data minimization principle. This case illustrates that convenience-driven technology adoption can carry significant legal and financial consequences when privacy-by-design principles are ignored from the outset.