Limits on the processing of biometric data for commercial and employment purposes

1. The facts

   The matter arises from a series of administrative sanctioning proceedings and fact-finding investigations. According to specialized media outlets, the Privacy Authority focused on international initiatives, such as Worldcoin founded by Sam Altman, which involved collecting iris scans in exchange for financial compensation.

   Concurrently, in February 2024, the Authority penalized two companies in the logistics and environmental services sectors for deploying facial recognition systems for attendance tracking. At present, these administrative sanctions have become final, while investigations into emotion recognition systems (Emotion AI) in call centers remain under scrutiny ahead of full AI Act implementation. The core allegations involve violations of transparency duties and the impossibility of providing freely given consent in the presence of a power imbalance or monetary compensation.

2. The rules in play

   The regulatory framework centers on EU Regulation 2016/679 (GDPR), particularly Article 9, which prohibits the processing of special categories of personal data (including biometric data) barring strict exceptions, and Article 22 regarding automated decision-making.

   This framework is integrated by EU Regulation 2024/1689 (AI Act): Article 5(1)(f) explicitly prohibits AI systems intended to infer emotions of natural persons in workplace and educational environments. Furthermore, Article 26 prescribes human oversight obligations for high-risk AI systems. Domestically, Article 2-septies of the Italian Privacy Code requires biometric data processing to comply with specific safeguards approved by the Privacy Authority.

3. What the case law says

   The established orientation of case law and supervisory authorities emphasizes the principles of proportionality, relevance, and data minimization. The Authority has repeatedly affirmed that processing biometric data purely for attendance tracking is unlawful when less intrusive alternatives, such as traditional badge systems, are available.

   In employment relationships, it is settled law that employee consent cannot constitute a valid legal basis due to the structural subordination link, which impairs genuine freedom of choice. Furthermore, administrative courts have reinforced the principle of algorithmic transparency, holding that automated processing must be fully knowable, intelligible, and subject to direct human oversight to prevent discriminatory outcomes.

5. Analysis drafted and verified with edit.legal

   To verify the provisions cited in this article, we used edit.legal. Test our legal AI on official sources and apply it to your own matters.

   Try edit.legal AI

8. Lessons for professionals

   From an operational perspective, the analysis yields key recommendations for legal practitioners:

   1. Conduct a comprehensive DPIA (Data Protection Impact Assessment) prior to deploying any computer vision or biometric processing systems.
   2. Refrain from implementing algorithms aimed at monitoring employees' psychophysical or emotional states, given the strict prohibitions under the AI Act.
   3. Ensure that processing does not rely solely on consent within subordinate employment contexts.
   4. Continuously monitor guidelines issued by supervisory authorities and European bodies, as technical standards evolve rapidly alongside the regulatory framework.

References: Regolamento UE 2016/679 (GDPR) Art. 9, 22Regolamento UE 2024/1689 (AI Act) Art. 5, 26D.Lgs. 196/2003 (Codice Privacy) Art. 2-septiesOrientamenti del Garante sul divieto di riconoscimento facciale per la rilevazione delle presenze

Editorial oversight: Avv. Federico Papa·ICAMUpdated 14 May 2026