Britain’s data watchdog has ordered a Serco subsidary to stop using facial recognition technology and fingerprint scanning to monitor the attendance of staff at the leisure centres it operates.
The Information Commissioner’s Office (ICO) found that the biometric data of more than 2,000 employees had been unlawfully processed at 38 centres managed by Serco Leisure to check up on their attendance.
In its investigation, the ICO found facial recognition technology had been used at all 38 facilities, two of which also operated fingerprint scanning systems.
The watchdog has issued enforcement notices ordering Serco Leisure to stop processing biometric data for monitoring employees’ attendance and destroy all biometric data it is not legally obliged to retain within three months.
It is the first time the ICO has taken enforcement action against an employer to stop it processing the biometric data of staff.
The watchdog said Serco had failed to show why it was necessary or proportionate to use fingerprint scanning or facial recognition instead of ID cards or fobs to clock in and out of work. Staff had not proactively been offered an alternative to having their faces and fingerprints scanned, the ICO said.
There is growing concern about employers using facial recognition technology and other surveillance tools to monitor staff. The TUC warned in 2022 that the use of intrusive surveillance tech and artificial intelligence risked “spiralling out of control” without stronger regulation to protect workers.
In 2020, Barclays scrapped an employee-tracking system that monitored when bankers were at their desks and sent warnings to those on breaks.
The ICO has previously taken enforcement action in relation to biometric data and facial recognition. In May 2022, the watchdog fined the US-based Clearview AI £7.5m and ordered the data of UK residents be deleted from its systems after finding “serious breaches” of data protection law. Clearview AI successfully appealed against the ICO decision last year.
John Edwards, the UK information commissioner, said on Friday that Serco Leisure had not fully considered the risks before introducing biometric technology. “There is no clear way for staff to opt out of the system, increasing the power imbalance in the workplace and putting people in a position where they feel like they have to hand over their biometric data to work there,” he said.
Edwards said the ICO would intervene if it believed data was being used unlawfully. It has updated guidance for organisations considering using people’s biometric data.
Welcoming the enforcement notice, Madeleine Stone of the civil liberties group Big Brother Watch, said: “Banning Serco Leisure from using facial recognition to track their staff is a welcome intervention from the ICO, but this represents a drop in the ocean given how common biometric surveillance is becoming in both workplaces and in public spaces across the country.”
The ICO’s investigation covered Serco Leisure, Serco Jersey and seven associated community leisure trusts.
after newsletter promotion
Serco Leisure said: “This technology was introduced at the leisure centres we manage nearly five years ago to make clocking-in and out easier and simpler for colleagues.
“We engaged with our team members in advance of its rollout and its introduction was well received by colleagues. The introduction also followed external legal advice which said use of the technology was permitted.”
The company added: “Despite being aware of Serco Leisure’s use of this technology for some years, the ICO have only this week issued an enforcement notice and requested that we take action. We now understand this coincides with the publication of new guidance for organisations on processing of biometric data which we anticipate will provide greater clarity in this area.
“We take this matter seriously and confirm we will fully comply with the enforcement notice.”
The company is a subsidiary of Serco Group and manages 47 leisure centres, employing 2,500 staff.