Serco and others told to stop using facial recognition

The UK’s data watchdog has ordered Serco Leisure, Serco Jersey and seven associated community leisure trusts to stop using facial recognition technology (FRT) and fingerprint scanning to monitor employee attendance.

An investigation by the Information Commissioner’s Office (ICO) found that Serco Leisure and the trusts have been “unlawfully processing” the biometric data of more than 2,000 employees at 38 leisure facilities for the purpose of attendance checks and subsequent payment for their time. According to the ICO, they failed to show why it is “necessary or proportionate” to use FRT and fingerprint scanning for this purpose, when there are “less intrusive” means available, such as ID cards or fobs.

ICO also said employees have not been proactively offered an alternative to having their faces and fingers scanned to clock in and out of their place of work, and it has been presented as a requirement in order to get paid.

The ICO has now issued enforcement notices instructing Serco and the trusts to stop all processing of biometric data for monitoring employees’ attendance at work, as well as to destroy all biometric data they are not legally obliged to retain. This must be done within three months.

John Edwards, UK Information Commissioner, said: “Biometric data is wholly unique to a person so the risks of harm in the event of inaccuracies or a security breach are much greater – you can’t reset someone’s face or fingerprint like you can reset a password.”