Natural HR’s Post

I give the Commissioner a lot of stick, so when he does something worth doing, it is incumbent on me to acknowledge it. Yesterday, Edwards announced a series of enforcement notices on Serco and multiple subsidiary companies, preventing the use of biometrics to clock staff in and out. I think the decision-making is sound – Serco has to clear two hurdles, establishing that they have a lawful basis to process the data and a justification to use special categories data (technically an exemption from the prohibition on processing SCD). Virtually every lawful basis and exemption has a vital qualification: the use of the data must be necessary. As the notices acknowledge, necessary doesn’t mean the only possible option, but you need compelling evidence that this option is the best. In a world where swipe cards and other methods of proving that you’re present exist, Serco has to show that using thumb-prints and facial recognition is the superior option. Serco’s representations assert that staff swap cards and indulge in other shenanigans, but they don’t offer evidence. Unable to pin down the alternatives to consent which would inevitably be undermined by the power imbalance, Serco are ordered to stop using the technology. A company with Serco’s resources can afford to appeal, but if they don’t or if they lose, this action should concentrate the minds of a lot of companies thoughtlessly using biometrics. It’s telling that the company didn’t carry out a DPIA until the Commissioner contacted them, and their claims about the data use being necessary for employment law have an improvised, post-deployment feel. Not to hammer my usual point home, but this action will have much greater impact than a reprimand because of the element of compulsion. Reprimands can be ignored, and don’t have the same ripple effect. In itself, it’s a decent decision, but in order to persuade his critics that he’s capable of competent regulation, Edwards has to allow a lot more action to take place. Two other wrinkles I haven’t quite wrapped my head around yet: the investigation was originally started after an ICO employee noticed what Serco were doing when visiting a leisure centre, and one of the notices is aimed at Serco Jersey, which the Commissioner says is subject to the UK GDPR because it is a joint controller with Serco in the UK. I will return to this when I’ve processed it a bit longer. UPDATE: Serco have confirmed in a slightly barbed response reported in the Guardian that they're not going to appeal (link in the comments). https://lnkd.in/euxUFKgS

The UK’s Data Protection Authority, Information Commissioner’s Office (ICO) has issued an enforcement notice ordering employer to put a stop to the use of fingerprint and facial recognition technology for monitoring employees’ attendance at work. The ICO found that the Public Service Provider, Serco Leisure, and its associated Trusts, unlawfully processed the Biometric data of more than 2,000 employees for the purported purpose of monitoring attendance and the subsequent processing of payment for time worked. It was found that, in processing workers’ biometric data in the manner it did, the controller's purpose failed the necessity and proportionality test. According to the ICO, there are less intrusive methods available to an employer in monitoring attendance and process payment for time worked. Alternative methods identified by the ICO include ID cards and fobs.   Another important point made by the ICO was failure of the Employer to proactively offer the employees alternatives to the processing of their fingerprints and facial recognition for attendance monitoring. Also, considering the imbalance of power between the employer and its employees, the employees could not have exercised their right of refusal to such processing.   The ICO ordered the employer to immediately cease further processing of fingerprints and facial recognition for monitoring employees’ attendance, while all biometric data not legally obliged to be retained should be destroyed within 3 months. This enforcement notice emphasizes the sensitive nature of biometric data and how special care should be taken in their processing. Any Controller seeking to process biometric data has the responsibility to show that the intended purpose passes the necessity and proportionality test. Therefore, where the intended purpose can be achieved using alternative methods, the processing of sensitive data in such circumstances might be inexcusable.  

Is your business using biometric attendance monitoring? It might be time for review! In a recent case, the Information Commissioner’s Office (ICO) issued enforcement notices to Serco Leisure and its associated trusts, halting the use of facial recognition and fingerprint scanning for attendance tracking across 38 leisure facilities. This move comes after over 2,000 employees were found to be subject to unlawful processing of biometric data without adequate alternatives. The software was installed five years ago after seeking legal advice. However, legal guidance has since evolved, introducing new requirements that must be adhered to. Why is this case important? Employers must remain vigilant about legal requirements when implementing new technologies, especially when privacy concerns arise. With changing legal landscapes, seeking legal advice ensures that you stay one step ahead. Stay compliant and safeguard your business with expert legal guidance - https://bit.ly/3Kn6HtY #Data #HR #directors #management #Privacy #Compliance

Is your business using biometric attendance monitoring? It might be time for review! In a recent case, the Information Commissioner’s Office (ICO) issued enforcement notices to Serco Leisure and its associated trusts, halting the use of facial recognition and fingerprint scanning for attendance tracking across 38 leisure facilities. This move comes after over 2,000 employees were found to be subject to unlawful processing of biometric data without adequate alternatives. The software was installed five years ago after seeking legal advice. However, legal guidance has since evolved, introducing new requirements that must be adhered to. Why is this case important? Employers must remain vigilant about legal requirements when implementing new technologies, especially when privacy concerns arise. With changing legal landscapes, seeking legal advice ensures that you stay one step ahead. Stay compliant and safeguard your business with expert legal guidance - https://bit.ly/3Kn6HtY #Data #HR #directors #management #Privacy #Compliance

SENSIVIC has been confronted to the rise of violence since its beginning but witnesses a global worsening since the covid19 pandemic of as described in this article by Josie Hannett reporting 4 088 attacks in railway stations across Great Britain in 2023. After years of training in real conditions, our #GDPR compliant Smart audio detection has become the most efficient smart system to automatically detect in #realtime an outburst of rage in a human voice. #Verbalviolence as detected by SENSIVIC solutions is a combo of physical signals indicating a high risk of escalation to #physicalviolence. The voice is only the vector that conveys this anonymous data. SENSIVIC does not understand, record or transmit any words : every data is immediatly destroyed and our solutions alert in #realtime regardless of the spoken language. Detection is fully automatic and requires no action from the user. We know from experience that non automatic detections are hardly used when necessary or that when they need to be physically activated, these actions can lead to an immediate and desastrous escalation. Staff most often feels like they are left alone to face these situations, which impacts the victims mental health, generating sick leaves and resignations, thus causing also massive disruptions and costs for companies' human ressources. SENSIVIC smart audio detection for verbal violence can be operated in hardware detectors installed in buildings or vehicles (#KIETO). It is also available as a mobile app system (#QiLPi) or as a module to integrate with an existing mobile app such as the one developped by Southeastern Railway where staff can report incidents. SENSIVIC can take it further and enable immediate solidarity from nearby teammates. No one should ever be left alone in the face to verbal violence, contact me and I shall come personally to demonstrate our realtime smart audio detection solutions. DVS Ltd, Nimans Security, Amulet Security, Network Rail, British Transport Police

𝐌𝐎𝐍𝐓𝐇𝐋𝐘 𝐑𝐎𝐔𝐍𝐃𝐔𝐏 | June has been an interesting month, employment law-wise. Here is a list of the most relevant updates, in occasion of our last virtual meeting before the summer break: - Italian Supreme Court, order no. 17430/2024: proving part-time employment through conclusive actions. - Italian Data Privacy Authority (IDPA) on using employees’ biometric data. - Virtual reality as an educational tool in mandatory training. You may read more about the above topics by accessing the PDF below, where you will also find our monthly HR Tip and the rest of our articles published over the course of last June. #morrirossetti #labour #mru

Labour Monthly Roundup | June 2024 ⬇️ Discover some of the major clarifications of practice and case law rendered in the past month ⬇️ Labour Observatory | Morri Rossetti #labour #morrirossetti

Workers shouldn't have to choose between a blood test and a job. The latest report from the Centre for Future Work explores the gaps in privacy and workplace relations laws that companies are exploiting to collect workers' sensitive information. The report calls for reforms that restrict what information organisations can collect, require organisations to make a case for why this sensitive information is necessary before collecting it, and regulate how the information can be used. It also calls for greater worker involvement in decision making about when and how their sensitive information can be collected and used: https://lnkd.in/gEuqpcep

Serco ordered to stop facial recognition software to record employee attendance. ICO website states: " The ICO has now issued enforcement notices instructing Serco Leisure and the trusts to stop all processing of biometric data for monitoring employees’ attendance at work, as well as to destroy all biometric data that they are not legally obliged to retain. This must be done within three months of the enforcement notices being issued." Whilst facial recognition software can be used there are easier and more proportionate ways to record attendance such as ID cards or fobs. https://lnkd.in/eKZxn7DD

While these laws do not prohibit use of biometric screening technology, employers should set clear policies with regard to the collection and preservation of such data. Information gathered should be narrowly tailored to the specific purpose sought by the company. Preservation and disposal of such information should be carefully determined, with access limited to specific authorized persons within the organization. Employees asked to provide biometric information should be provided details about how their information will and will not be used by the employer.