Spanish regulator fines companies for mandatory facial-recognition work clocking
Spain's data protection regulator fined Cartonajes Bañeres and Osasuna for using facial recognition to clock workers in without offering alternative methods. The companies allegedly failed to provide workers with other options or respond to data access requests.
What happened
Cartonajes Bañeres, an Alicante company, used facial recognition as the only method for workers to clock in and record work hours. An employee requested an alternative less invasive method in 2022 and was denied.
In August 2022, the worker exercised his right to access and request data collected by the company, but did not receive a response, with the company later stating it had sent the response to a wrong address. The regulator found deficiencies in the data consent form, which mentioned only fingerprint use and offered no alternative to consent or revocation.
Reported impact
Workers were required to use mandatory facial recognition without alternatives, and their biometric data was collected for work-hour monitoring. One worker's data access request went unanswered due to incorrect delivery by the company.
Index analysis
A 2023 framework established by Spain's data protection authority made biometric and facial recognition systems for tracking work hours subject to stricter rules. The authority warned of 'high risks to fundamental rights and freedoms' from biometric technology.
Governance controls
After the company was acquired in 2023 by a larger firm, its Data Protection Committee recommended immediate replacement of the facial recognition clocking system due to suspected non-compliance with data protection rules.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.