Biometric timekeeping back in the spotlight: ANSPDCP fines an employer over its fingerprint clock-in system

1 What the Authority found
The investigation started with a complaint from an individual. ANSPDCP concluded that the company had processed biometric data of its own staff for access control and working-time records without meeting any of the conditions in Article 9 GDPR, and that it had breached the data minimisation principle in Article 5(1)(c) GDPR. In the Authority's view, the company could have achieved the same purposes with less intrusive tools.
On top of the fine, the company has to replace the system with one that records attendance and controls access without biometric data. In practice this is the part of the decision that hurts: new hardware, changes to HR processes and new information notices for staff.
The press release closes with a reminder that is clearly aimed at the market rather than at this one controller. Biometric data is tied directly to a person's identity, so a leak or unauthorised access creates serious risks. Controllers using it must be able to show both a legal condition for the processing and that the processing is necessary and proportionate and should look first at less intrusive alternatives.
The decision is in line with earlier practice. In December 2019 ANSPDCP fined another company EUR 5,000 for using employees' fingerprints to control access to restricted areas, relying on Articles 5(1)(c), 7 and 9 GDPR. In March 2026 it issued a warning to a company that was only planning to introduce facial recognition for staff access. No data had been collected yet, but the Authority took the view that the project would likely breach the minimisation principle and recommended a less intrusive approach. Employers should note that the Authority is prepared to step in before a system goes live.
2 Article 3 of Law 190/2018 is narrower than it looks
Law 190/2018 contains only one provision dealing expressly with biometric data. Article 3(1), adopted under the margin Article 9(4) GDPR leaves to Member States, reads (our translation):
The processing of genetic data, biometric data or health data for the purpose of automated decision-making or profiling is permitted with the explicit consent of the data subject or where the processing is carried out under express legal provisions, with the implementation of appropriate measures to protect the rights, freedoms and legitimate interests of the data subject.
The provision often comes up in discussions about workplace biometrics, but its reach is limited. It applies only where biometric data is processed for the purpose of automated decision-making or profiling. A fingerprint reader at the entrance identifies a person and logs a time stamp; that is not, in itself, automated decision-making or profiling. Most clock-in and access systems therefore sit outside Article 3 and are assessed directly under Article 9 GDPR.
Where Article 3 does apply, it restricts rather than expands the options: processing is allowed only based on explicit consent or express legal provisions. Neither is easy to use in an employment relationship. Employee consent is generally not regarded as freely given, given the imbalance between the parties (Recital 43 GDPR and EDPB Guidelines 05/2020 on consent). And no Romanian law requires or authorises biometric timekeeping. The Labour Code obliges employers to keep a record of hours worked, but says nothing about how, and certainly does not call for fingerprints.
So Article 3 is not a gateway for employers. If anything, it shows that the Romanian legislator wanted extra caution where biometric data feeds automated systems.
3 Why ANSPDCP relies on the GDPR directly
This is why the 2019 and 2026 sanctions are grounded in Articles 9 and 5(1)(c) GDPR rather than in Law 190/2018.
The starting point is Article 9. Biometric data processed to uniquely identify a person is a special category of data (Articles 4(14) and 9(1) GDPR), and its processing is prohibited unless one of the exceptions in Article 9(2) applies. For employers, only two are realistically available. Explicit consent under Article 9(2)(a) runs into the problem described above. Article 9(2)(b), which covers obligations in the field of employment law, needs a basis in Union or Member State law, and Romanian law provides none for this purpose. The employer's legitimate interest does not help either: Article 6(1)(f) GDPR is a ground for lawful processing in general, not an exception to the prohibition in Article 9.
The second element is data minimisation. Even if a legal condition could be found, the processing must be limited to what is necessary. The Authority has been consistent here: attendance and access can be managed with badges, cards, PIN codes or mobile credentials, and where such alternatives exist, biometric processing goes beyond what is necessary. That explains why the September 2026 decision refers to Article 5(1)(c) "in relation to" Article 9, and why the corrective measure is so specific. If the problem is that the system is not necessary, the only fix is to take it out.
4 Biometric processing is not workplace monitoring
Employers sometimes assume that a biometric clock-in system can be covered by the employee monitoring rules in Article 5 of Law 190/2018. It cannot. Article 5 deals with monitoring through electronic communications and/or video surveillance, carried out based on the employer's legitimate interest, and allows it only if all of the following conditions are met:
• the employer's legitimate interest is duly justified and prevails over the interests or rights and freedoms of employees;
• employees have been informed in advance, completely and explicitly;
• the trade union or employee representatives have been consulted before the systems are introduced;
• other, less intrusive ways of achieving the employer's purpose have previously proved ineffective; and
• the data is kept for no longer than 30 days, except where the law provides otherwise or in duly justified cases.
These conditions govern how intrusive monitoring may be. They do not supply a condition for processing special categories of data. An employer may consult the union, inform its staff in detail and delete everything after 30 days, and still have no Article 9(2) exception for scanning fingerprints.
The line can also be crossed from the other side. Ordinary CCTV footage is not biometric data. It becomes biometric data once it is processed with specific technical means to identify individuals, for example through facial recognition (Recital 51 GDPR). From that point, compliance with Article 5 of Law 190/2018 is no longer enough and the full Article 9 analysis applies, which is exactly the situation addressed in the March 2026 warning. If the system is also used to take automated decisions about employees, Article 3 of Law 190/2018 becomes relevant as well. Employers looking at more advanced tools should also bear in mind that, since 2 February 2025, the AI Act prohibits AI systems that infer the emotions of people in the workplace, except for medical or safety reasons.
The two regimes do have one thing in common: the less intrusive means test. Article 5 of Law 190/2018 makes it an express condition for monitoring, and ANSPDCP applies the same logic to biometrics through Article 5(1)(c) GDPR. Either way, it is for the employer to show that alternatives were considered and why they were not adequate.
5 Conclusion
Romanian law does not offer a specific legal basis for using employees' biometric data for timekeeping or access control. Article 3 of Law 190/2018 covers only automated decision-making and profiling, and even there it narrows the available grounds. Article 5 deals with monitoring, not biometrics. Employee consent will rarely hold up.
ANSPDCP's practice reflects this. The fines are still relatively low, but an order to replace the system carries a real operational cost, and these investigations tend to start with a single employee complaint.
In practical terms, we recommend that employers:
• map any systems that use fingerprints, facial recognition, palm or iris scans, including readers built into turnstiles, doors, time clocks or mobile apps;
• move to non-biometric solutions for attendance and access wherever possible, since this is what the Authority will require in any case;
• keep biometric solutions, if at all, for genuinely high-security areas, backed by a documented necessity and proportionality assessment, a DPIA under Article 35 GDPR and an identified Article 9(2) exception;
• review CCTV systems before adding facial recognition or other analytics; and
• not rely on consent forms, or on compliance with the Article 5 monitoring conditions, to justify biometric processing.

Article provided by INPLP members: Flavius Adrian Florea and Adelina Iftime-Blagean (Wolf Theiss, Romania)