Serco, a prominent outsourcing company, has been directed to halt the use of facial recognition technology in monitoring its employees after the Information Commissioner’s Office (ICO) found the practice to violate privacy rights.
The ICO’s investigation revealed that Serco Leisure, along with community leisure trusts under its purview, had been unlawfully processing biometric data from over 2,000 staff members across 38 leisure facilities throughout the UK. Facial recognition and fingerprint scanning were utilized as routine methods to track employee attendance and facilitate payment for their time.
However, the ICO concluded that Serco failed to adequately justify the necessity of these intrusive methods over less invasive alternatives like ID cards. Moreover, employees were not provided with a clear alternative, exacerbating the imbalance of power in the workplace and compelling them to surrender their biometric data.
John Edwards, the UK Information Commissioner, emphasized the unique sensitivity of biometric data, stressing the heightened risks of harm in cases of inaccuracies or security breaches. He criticized Serco for prioritizing business interests over employee privacy and highlighted the absence of a transparent opt-out mechanism for staff.
In response, a spokesperson for Serco Leisure defended the technology’s implementation, citing its introduction nearly five years ago to streamline clocking-in and out procedures. They asserted that the decision was made in consultation with team members and based on external legal advice validating its use.
Despite the company’s assertion of compliance with legal guidance, the ICO issued an enforcement notice this week, coinciding with the publication of new guidance on biometric data processing. Serco pledged to fully adhere to the enforcement notice and expressed readiness to engage with the updated regulatory framework.
The clash between Serco and the ICO underscores growing concerns surrounding the use of biometric technologies in the workplace and the necessity for robust privacy safeguards. As organizations navigate the evolving regulatory landscape, ensuring the protection of employee privacy rights remains paramount.
