# Istituto di Istruzione Superiore 'P. Galluppi' Tropea: Insufficient legal basis for data processing

- Type: Enforcement
- Source: Italian Data Protection Authority (Garante)
- Date: 2025-03-27
- Original: https://www.enforcementtracker.com/ETid-2670
- Canonical: https://overview.legal/posts/48785
- Topics: Employees, Fairness & Transparency, Biometric Data, Special Categories of Data, Controllers, IP Address, Types of Special Categories of Personal Data, Personal Data, Biometric Data, Processing

## Summary

The Italian DPA has imposed a fine of EUR 2,500 on the Istituto di Istruzione Superiore 'P. Galluppi' Tropea. The controller processed biometric data of its employees to control their work hours. The processing was designed in a way that, according to the DPA, did not comply with the principles of lawfulness, fairness and transparency and lacked a sufficient legal basis.

## Full text

The Italian DPA has imposed a fine of EUR 2,500 on the Istituto di Istruzione Superiore 'P. Galluppi' Tropea. The controller processed biometric data of its employees to control their work hours. The processing was designed in a way that, according to the DPA, did not comply with the principles of lawfulness, fairness and transparency and lacked a sufficient legal basis.

GDPR Articles: Art. 5 (1) a) GDPR, Art. 6 GDPR, Art. 9 GDPR
Industry: Employment

---
Generated by overview.legal · https://overview.legal/posts/48785 · 2026-08-22