ICO orders Serco Leisure to stop biometric monitoring of staff

'Prioritising business interests over its employees’ privacy'

UK data protection regulator the Information Commissioner's Office (ICO) has ordered Serco Leisure to stop using facial recognition and fingerprint scanning to monitor employee attendance.

In a blog post, the regulator said it had warned Serco Leisure, Serco Jersey and seven associated community leisure trusts to cease using the technology to track employees.

Staff have no clear way to opt out of the monitoring system, which increases the power imbalance in the workplace, the ICO said. Employees were not offered other less intrusive options to verify their attendance, such as ID cards.

The ICO has issued an enforcement notice telling Serco Leisure, a subsidiary of the services giant Serco, and related entities to cease using facial recognition for this purpose and to destroy all existing biometric data, other than that they are required to retain by law.

As a unique identifier of an individual, biometric data represents a unique security risk.

"Serco Leisure did not fully consider the risks before introducing biometric technology to monitor staff attendance, prioritising business interests over its employees' privacy," said information commissioner John Edwards.

"Biometric data is wholly unique to a person so the risks of harm in the event of inaccuracies or a security breach are much greater - you can't reset someone's face or fingerprint like you can reset a password."

Serco Leisure has been unlawfully processing biometric data of more than 2,000 employees across 38 facilities, the ICO said, and had failed to justify why the use of this technology was necessary and proportional.

The ICO has also published new guidance on the legitimate use of biometric data by for organisations using biometric recognition systems and for vendors and developers of such systems, which include facial recognition, fingerprint, iris scanning, voice, ear and behavioural recognition technologies.

The action against Serco Leisure should "put industry on notice that biometric technologies cannot be deployed lightly", said Edwards.

"We will intervene and demand accountability, and evidence that they are proportional to the problem organisations are seeking to solve."

Recently Edwards warned that for companies to play fast and loose with data protection measures would be "not be profitable."

A Serco Leisure spokesperson said the company will "fully comply" with the enforcement notice.

The spokesperson added: "This technology was introduced at the leisure centres we manage nearly five years ago to make clocking-in and out easier and simpler for colleagues. We engaged with our team members in advance of its roll-out and its introduction was well-received by colleagues. The introduction also followed external legal advice which said use of the technology was permitted.

"Despite being aware of Serco Leisure's use of this technology for some years, the ICO have only this week issued an enforcement notice and requested that we take action. We now understand this coincides with the publication of new guidance for organisations on processing of biometric data which we anticipate will provide greater clarity in this area."

Bryony Long, partner and co-head of the data, privacy and cyber group at law firm Lewis Silkin, commented: "The ICO's decision doesn't come as a surprise. The issue of forcing consent - in this case, forcing employees to subject to scanning as a requirement for getting paid - is one of the many reasons using biometrics data is always challenging in a workplace environment."

However she added: "It is interesting, though, that the ICO has chosen not to fine Serco, which shows that while its key aim is to drive good behaviour, it is following through on its promise to consider and use the full range of powers in its enforcement toolkit."

This article was amended to add comments from Serco Leisure and Lewis Silkin.