Clocking in with fingerprints or facial recognition: why the Italian DPA keeps fining employers (and what the AI Act says)

The terminal with a fingerprint reader, or the camera that "recognises" employees at the entrance, is sold as the cure for lent badges and buddy punching. The question we hear most often is: can I use it if the workers agree? The short answer, in Italy and today, is no. Not because of the AI Act, but because of the GDPR and a line from the Italian data protection authority (the Garante) that has not moved in years.

What the Garante says, decision after decision

Recent cases all follow the same pattern.

The reasoning is always the same, in four steps.

1. Biometric data is a special category. Article 9 of Regulation (EU) 2016/679 prohibits its processing save for exceptions. The one relevant to employers is point (b) of paragraph 2: processing necessary for employment-law obligations, but only where authorised by law with appropriate safeguards.
2. In Italy that law, for attendance, does not exist. Article 2-septies of the Italian Privacy Code allows biometric processing only in compliance with the safeguard measures adopted by the Garante. In its decision of 26 February 2026 the Garante restated that Italian law does not currently allow employers to process employees' biometric data to record attendance.
3. Consent does not rescue the processing. In employment, the imbalance between the parties means consent is rarely free: it is not a valid legal basis.
4. A badge is enough. Legal basis aside, the same purpose can be achieved with less intrusive means: the minimisation principle (Art. 5(1)(c)) rules out biometrics for ordinary timekeeping.

On top of these core breaches, the decisions almost always add the "surrounding" ones: no impact assessment (Art. 35), inadequate privacy notice (Art. 13), no record of processing (Art. 30), missing processor appointments (Art. 28).

The template is not a way out

Many vendors argue the system does not store the fingerprint, only a mathematical template. It makes no difference: under Art. 4(14) GDPR, the output of specific technical processing that allows or confirms unique identification is itself biometric data. Storing it only on a non-networked terminal does not help either: in the 2026 case the data sat on the devices.

The Workers' Statute is not the problem (nor the solution)

Article 4(2) of Law 300/1970 exempts tools recording access and attendance from the union-agreement or labour-inspectorate authorisation procedure. That is an exemption from a procedure, not a licence: the processing must still comply with the GDPR, and biometrics is exactly where it fails. And if the device does more than log entry and exit — for instance, tracking movements inside the premises — the exemption no longer applies.

And the AI Act?

Regulation (EU) 2024/1689 comes into the picture at three points, and it pays to keep them apart.

• Verification is not high-risk. Annex III, point 1(a) classifies remote biometric identification systems as high-risk, but expressly excludes biometric verification systems whose sole purpose is to confirm that a person is who they claim to be. A terminal comparing an employee's face with their enrolled template (a "one-to-one" comparison, Art. 3(36)) normally falls within that exclusion.
• Emotions are banned. Since 2 February 2025, Article 5(1)(f) prohibits systems that infer emotions in the workplace, except for medical or safety reasons. If the entrance camera also promises to detect "fatigue" or "mood", it is no longer just a GDPR problem.
• Sensitive biometric categorisation is banned. Article 5(1)(g) prohibits systems that categorise people on the basis of biometric data to deduce, among other things, their political opinions, trade union membership, religious beliefs or sexual orientation.

The practical point: the AI Act not banning biometric verification does not mean it is permitted. The two regimes stack, and for attendance the limit that bites is the GDPR.

If the system is already installed: what to do now

1. Inventory every biometric device, including "pilot" units or ones installed by a contractor at a remote site: in the 2026 case the readers were at a client's premises.
2. Suspend collection and switch to badges or another non-biometric solution. Every additional day of processing weighs on how a fine is assessed.
3. Delete templates and collected data, on the terminals and on any vendor server or cloud, and get written confirmation.
4. Document the decommissioning: date, devices, who performed the deletion. That is the file you will show at an inspection.
5. Update the record of processing, the employee privacy notice and vendor contracts (Art. 28).
6. Check the "smart" modules of cameras and terminals: face, emotion or behaviour analytics that software can switch on must be disabled, and the deactivation documented.

If you are still evaluating a purchase, the question for the vendor is not "is it GDPR compliant?" but: which law does the processing of my employees' biometric data rely on? If the answer is "consent", you have your answer.

Where to start

The biometric terminal is one of the ways AI enters a company through facilities management, bypassing whoever handles compliance. An independent gap assessment of devices, cameras and monitoring tools — what they collect, on which legal basis, with which AI features switched on — costs far less than a Garante fine and returns the exact list of what to switch off, what to document and what can stay.