United Kingdom: Issued ICO order requiring Serco Leisure and 7 associated community leisure trusts to stop the use of facial recognition technology for worker monitoring purposes

On 23 February 2024, the Information Commissioner's Office (ICO) issued enforcement notices to public service provider Serco Leisure, Serco Jersey, and seven associated community leisure trusts, ordering them to stop using facial recognition technology (FRT) and fingerprint scanning for employee attendance monitoring. The ICO's investigation determined that these entities had been unlawfully processing the biometric data of over 2'000 employees at 38 leisure facilities for attendance checks. The ICO found that the use of FRT and fingerprint scanning was neither necessary nor proportionate, given the availability of less intrusive means such as ID cards. The enforcement notices also instructed the entities to destroy all biometric data not legally required to be retained within three months.