Data watchdog tells off outsourcing giant for scanning staff biometrics despite 'power imbalance'
- Reference: 1708951300
- News link: https://www.theregister.co.uk/2024/02/26/uk_data_protection_watchdog_halts/
- Source link:
During an investigation, the Information Commissioner's Office, Britain's regulator set up to enforce data protection law, found Serco Leisure and several associated community leisure trusts had unlawfully processed the biometric data of more than 2,000 employees at all 38 of the leisure facilities to check attendance and calculate pay.
There is no clear way for staff to opt out of the system, increasing the power imbalance in the workplace and putting people in a position where they feel like they have to hand over their biometric data to work there
The ICO has also instructed Serco Leisure and the trusts to destroy all biometric data that they are not legally obliged to retain within three months.
UK Information Commissioner John Edwards said biometric data represents a risk to individuals in the event of inaccuracies or security breaches. "You can't reset someone's face or fingerprint like you can reset a password," he said.
"Serco Leisure did not fully consider the risks before introducing biometric technology to monitor staff attendance, prioritizing business interests over its employees' privacy. There is no clear way for staff to opt out of the system, increasing the power imbalance in the workplace and putting people in a position where they feel like they have to hand over their biometric data to work there," he said in a statement.
[1]
Edwards added that in the context in which Serco and the trusts were using it, facial recognition was neither fair nor proportionate under data protection law. "We will closely scrutinize organizations and act decisively if we believe biometric data is being used unlawfully," he said.
[2]
[3]
Affected by the enforcement are Serco Leisure — national operators of leisure centers including swimming pools — and Serco Jersey, a separate company running similar facilities on the Channel Islands. Seven other trusts were hit by the enforcement including those in Birmingham, Bolton, Maidstone, More (Mansfield), Towcester, Shropshire and Swale. They all used Serco as a service partner.
Serco is a well-known tech and business process outsourcer. It has won contracts including for the pandemic response Test and Trace system ( [4]£212 million , [5]£322 million ) and the [6]Ministry of Justice .
[7]Activists gatecrash Capita's AGM to protest GPS tracking contract
[8]Outsourcing firm Serco wins £212m UK Test and Trace deal
[9]Serco bags £322m contract extension for Test and Trace, is still struggling to share data with local authorities
[10]Just when everyone thought things might be looking up, Dido Harding admits interest in top job at NHS England
In 2019, the UK outsourcing and services company was fined nearly £23 million in [11]a settlement with the Serious Fraud Office over contracts to electronically tag criminals. The issue was first reported by Serco, and it later apologized.
As well as issuing the enforcement notice on Serco and the leisure trusts, the ICO has released new guidance designed to help organizations understand where they can and cannot use biometric data.
[12]
"Our latest guidance is clear that organizations must mitigate any potential risks that come with using biometric data, such as errors identifying people accurately and bias if a system detects some physical characteristics better than others," Edwards said. ®
Get our [13]Tech Resources
[1] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2ZdzDumW47fMNOW@9pnRbXgAAAAs&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZdzDumW47fMNOW@9pnRbXgAAAAs&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33ZdzDumW47fMNOW@9pnRbXgAAAAs&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[4] https://www.theregister.com/2022/03/22/serco_win_212m_deal_to/
[5] https://www.theregister.com/2021/06/28/serco_bags_a_322m_contract/
[6] https://www.theregister.com/2019/10/31/serco_handed_800m_ministry_of_justice_deal/
[7] https://www.theregister.com/2023/05/12/activists_gatecrash_capitas_agm_to/
[8] https://www.theregister.com/2022/03/22/serco_win_212m_deal_to/
[9] https://www.theregister.com/2021/06/28/serco_bags_a_322m_contract/
[10] https://www.theregister.com/2021/06/07/dido_harding_nhs_ceo/
[11] https://www.theguardian.com/business/2019/jul/03/serco-fined-229m-over-electronic-tagging-scandal#:~:text=It%20said%20its%20UK%20subsidiary,%C2%A33.7m%20in%20costs
[12] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZdzDumW47fMNOW@9pnRbXgAAAAs&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[13] https://whitepapers.theregister.com/
Re: Pull your finger out
Serco's spin is a little rich... not getting caught/charged doesn't make it was OK and it was already obvious that what they did was wrong. The updated guidance is a nice to have but not an excuse for screwing over their employees until now.
Nice try though.....
As for the authorities letting them off with a sternly worded letter... I'm at a loss for words!
Pathetic response from the ICO
It's a useless quango led by the limpest of limp-wristed nonentities. It has no credibility. The ICO would win the 'waggiest finger' medal for the so-called work it does.
Re: Pathetic response from the ICO
I think Ofcom would probably edge this one. How many years has it taken them to think mid term hyper inflationary price rises were acceptable. Still out for consultation?
TPS has been outsourced so as to have deniability - that is now a 100% waste of time. Every complaint has the same response. We "cannot be sure this is the company you are complaining about". Even when you have a verified email from the spamming fuckers.
Despite the lack of published guidance the ICO's position on biometrics has been clear since I worked there in the early 2000's - dont use it if there are more proportionate or reasonable options.
In this case its clearly disproportionate
The Real Problem.......
.....is not the law, or the ICO.......................
Remember the word "enforcement"?
When I see MANY C-level excutives in jail....when I see MANY million pound or million euro fines....then I might start to believe that GDPR is more than a bad joke!!!!!
Pull your finger out
Much as I hate these huge outsourcing companies, I think the ICO has to share some blame here. Not issuing clear guidance around the use of biometrics until 2024 is a dereliction of duty (In my not so humble opinion). The ICO have chosen not to fine Serco in this case because "the Commissioner considers that the resulting infringements are negligent [rather than deliberate]. Serco appears to have sought to comply with data protection legislation in its deployment of biometric technology, but its failure to meet these requirements indicates a lack of understanding of the UK GDPR" - https://ico.org.uk/media/action-weve-taken/enforcement-notices/4028590/20240219-serco-leisure-operating-limited-en.pdf
Serco stated: “Despite being aware of Serco Leisure’s use of this technology for some years, the ICO have only this week issued an enforcement notice and requested that we take action. We now understand this coincides with the publication of new guidance for organisations on processing of biometric data which we anticipate will provide greater clarity in this area."
I'd be curious if the ICO had been nudged to not issue guidance beforehand. Use of facial recognition in the UK seems to be on the basis that the government will look the other way for as long as it possibly can.