Facial-Recognition Turnstiles in Warehouses: DPIA and Prior Consultation
TransEuropa Logistics operates 14 warehouses and employs 3,100 staff in three EU countries. It plans a 90-day pilot of facial-recognition turnstiles at two warehouses to replace badge entry, citing time theft costing EUR 410,000 last year. The vendor hosts templates in a US cloud region and claims '99.2% accuracy'; internal tests show a 12% false-reject rate for workers wearing safety glasses and a higher false-accept rate for workers over 55. The works council has objected, 38% of affected staff are agency workers, and the DPO has been asked to sign off the pilot next week. HR proposes keeping templates for 24 months and using the system to flag late arrivals for disciplinary action. No DPIA has been done; a generic IT security risk assessment exists and rates the project 'low risk'.
1. Determine whether a DPIA is required and explain what makes the existing IT security risk assessment inadequate.
Read the worked answer
DPIA is required. The processing is systematic monitoring of employees, uses biometric data for unique identification, is large-scale across two warehouses, involves vulnerable agency workers, and applies new technology. Those are Art 35(3) triggers and almost certainly appear on the supervisory authority's list. The purpose of replacing badges does not remove the monitoring character.
Why the IT assessment fails: it addresses confidentiality, integrity, and project risk, not the rights and freedoms of workers. A valid DPIA must describe the processing, assess necessity and proportionality, identify risks with likelihood and severity, propose mitigations, consult the DPO, and seek the views of data subjects or their representatives (Art 35(9)). It also needs an explicit assessment of the disciplinary use, the 24-month retention, the US hosting, and the demographic error rates. The existing 'low risk' rating is not a DPIA and cannot justify sign-off.
Conclusion: stop the sign-off; complete a DPIA with works council input and DPO advice. If residual risk remains high after mitigation, Art 36 prior consultation is required. The IT assessment can be an input, but it cannot be the DPIA.
2. Assess the risk to rights and freedoms, including likelihood and severity, and decide whether prior consultation is needed.
Read the worked answer
Risks: false rejects (12% with safety glasses) cause access denial, lost pay, and safety risk; false accepts create impersonation and time-theft disputes; differential error by age indicates discriminatory impact, which is a high-severity rights risk. Agency workers are economically dependent, so consent is unlikely to be freely given (Art 7(4) and Art 9(2)(a)); biometric identification needs an Art 9 condition. Disciplinary use converts an access-control tool into a monitoring and sanction system, raising severity. A 24-month template retention is excessive and irreversible if breached; US hosting adds a transfer risk.
Likelihood: high, given the measured error rates and the planned use. Severity: high for discrimination, discipline, and security. Residual risk after basic mitigations is likely high because the core purpose (disciplinary time theft) and the retention remain. If the purpose is narrowed to access only and templates are deleted at the end of the pilot, residual risk could fall, but not to low while biometric identification and a US host remain.
Conclusion: Art 36 prior consultation is likely required if they proceed as designed; a no-go on the current design is defensible. The DPO should state that in writing.
3. Recommend conditions and mitigations, and give a defensible go/no-go recommendation.
Read the worked answer
Conditions if any pilot proceeds: replace facial recognition with badge/PIN or RFID; if biometrics are retained, narrow to access only, never discipline, retain templates no longer than the pilot and delete on withdrawal, store in the EU, require a DPA and transfer assessment, test accuracy by demographic, provide an alternative for workers who fail, ensure human review, and obtain works council agreement. Transparency must be specific, and the legal basis must be identified, not assumed.
Go/no-go: no-go on the current proposal because the purpose, retention, and disciplinary use create high residual risk. A limited pilot is only arguable if less intrusive alternatives have been tested and failed, and even then the DPIA must show residual risk is acceptable. The business case of EUR 410,000 in time theft does not, by itself, justify biometric monitoring; the controller must show necessity and proportionality.
Accountability: the controller must document the decision, the DPO's advice, and the works council consultation. If the business overrides the DPO, record the reasons and the accepted risk at board level; the DPO's advice should not be edited. If the pilot proceeds, set stop criteria in advance and report results to the board.