Italian University Fined for Unlawful Use of Facial Recognition in Online Courses
Italy's data protection authority fined the online university eCampus €50,000 for unlawfully processing biometric data through facial recognition in its distance learning courses. The authority found the university lacked adequate legal basis for the system and had not conducted a required data protection impact assessment, affecting over 450 course participants per lesson.
What happened
Università eCampus used a facial recognition system to verify the identity and attendance of participants in online teaching qualification courses.
The Garante Privacy (Italian Data Protection Authority) found that the university lacked adequate legal basis to justify the use of biometric systems, which require reinforced safeguards under data protection law, and that less invasive alternatives were available.
The authority also determined that the university had not conducted a data protection impact assessment before implementing the facial recognition system.
Reported impact
The violations affected over 450 course participants per lesson.
During the investigation, the system continued to operate only partially with minor corrections that were deemed insufficient to address the identified issues, until it was permanently deactivated.
Governance controls
In determining the fine amount, the Garante Privacy considered the university's cooperation and voluntary cessation of the data processing.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.