TIP TOP FOOD INDUSTRY SRL

September 25, 2026 Fine for Violation of the GDPR The National Supervisory Authority for Personal Data Processing has concluded an investigation into TIP TOP FOOD INDUSTRY SRL and found a violation of the provisions of Article 5(1)(c) (1)(c) in conjunction with Article 9 of Regulation (EU) 2016/679. As such, TIP TOP FOOD INDUSTRY SRL was assessed an administrative fine of 26,236 lei (equivalent to 5,000 euros). The investigation was conducted following a complaint submitted by an individual alleging the use of a time-and-attendance and access control system based on the processing of employees’ fingerprints at the premises owned by the controller. The investigation found that the operator processed the biometric data of its own employees for the purposes of access control and work time tracking without a legal basis, in violation of the legal requirements established by the provisions of Article 9 of Regulation (EU) 2016/679, in conjunction with a violation of the principle of data minimization, as provided for in Article 5(1)(c) of the same European regulation. At the same time, it was noted that the purposes pursued by the controller could have been achieved through the use of alternative means that were less intrusive to the employees’ privacy. In order to remedy the situation identified and ensure that the processing operations comply with the provisions of Regulation (EU) 2016/679, the Authority also ordered a corrective measure, requiring the controller to ensure compliance with the principle of data minimization, by replacing the access control and time-keeping system based on the processing of employees’ biometric data with an alternative solution that achieves the same objectives without processing biometric data. We emphasize that, when using biometric data, special attention must be paid to compliance with the principles of lawfulness, necessity, proportionality, and data minimization. At the same time, any compromise or unauthorized access to biometric data can pose significant risks to the rights and freedoms of individuals, given the specific nature of such data and the possibility of directly linking it to a person’s identity. Therefore, the use of biometric data must be carried out with particular caution, and data controllers must be able to demonstrate the existence of an applicable legal basis, as well as the fact that the processing is necessary and proportionate to the purposes pursued. In this context, the Authority reminds controllers of their obligation to carefully assess the necessity of using biometric technologies and to opt for solutions that involve alternative, less intrusive means, so as to ensure that risks to privacy and other fundamental rights and freedoms of individuals are minimized. Legal and Communications Department A.N.S.P.D.C.P.