ICO orders Serco Leisure to halt unlawful facial-recognition and fingerprint attendance monitoring of 2,000+ staff (2024)

The problem

Serco Leisure Operating Limited, which runs leisure centres on behalf of community leisure trusts, used facial-recognition technology and fingerprint scanning to monitor when its staff clocked in and out. The ICO found the arrangement gave workers no real choice: employees “have not been proactively offered an alternative” to having their faces and fingers scanned to clock in, and it “has been presented as a requirement in order to get paid” (source). Because of the “imbalance of power between Serco Leisure and its employees,” the ICO said, “it is unlikely that they would feel able to say no to the collection and use of their biometric data for attendance checks” (source).

What was built

Facial-recognition technology (FRT) and fingerprint scanning were deployed for time-and-attendance monitoring across 38 Serco-operated leisure facilities. The ICO’s enforcement notice records that “This Notice concerns 38 Serco-operated leisure facilities where processing of biometric data (as defined at Article 4(14) of the UK GDPR) is taking place” (source), and that it “is in relation to contraventions of Articles 5(1)(a), 6 and 9 of the UK GDPR” (source).

The outcome (critical claim)

On 23 February 2024 the ICO announced that “Serco Leisure and the trusts have been unlawfully processing the biometric data of more than 2,000 employees at 38 leisure facilities for the purpose of attendance checks and subsequent payment for their time” (source). It had “issued enforcement notices instructing Serco Leisure and the trusts to stop all processing of biometric data for monitoring employees’ attendance at work, as well as to destroy all biometric data that they are not legally obliged to retain,” adding: “This must be done within three months of the enforcement notices being issued” (source). The notice’s own terms require Serco to “Cease all processing of biometric data for the purpose of employment attendance checks from all Relevant Facilities” and to “Destroy all biometric data and all other personal and special category data that Serco is not legally obliged to retain” (source).

Two independent newsrooms reported the same facts firsthand. Personnel Today: an “ICO investigation found that Serco Leisure, Serco Jersey and seven community leisure trusts have been unlawfully processing the biometric data of more than 2,000 employees at 38 leisure facilities to monitor attendance and subsequently calculate their pay” (source). Infosecurity Magazine: “the company unlawfully processed biometric data of more than 2000 employees across 38 sporting and leisure facilities under UK data protection law,” and was ordered to “destroy all biometric data they are not legally obliged to retain within three months of the enforcement notices being issued” (source).

A note on the weakest link

This record rests on Tier-1 primaries, not on a metric that any single weak source carries: the ICO’s own press release and its published enforcement notice are the origin, and the two load-bearing figures, the 2,000+ employees / 38 facilities scope and the three-month cessation-and-destruction order, are each independently restated by two Tier-2 trade newsrooms (Personnel Today and Infosecurity Magazine). The weakest link is therefore not a source but a boundary: this page documents the regulator’s finding and order as of 23 February 2024. It does not assert that Serco subsequently complied, destroyed the data, or exhausted its appeal rights; those facts are held open below, because the public record establishes the order, not its aftermath.

How this was verified

Method: regulator-origin adjudication, verified against the public record. The ICO press release (23 Feb 2024) and the enforcement notice to Serco Leisure Operating Limited (dated 19 Feb 2024) are Tier-1 independent-origin primaries; both are captured (press release Wayback 20260731121418; enforcement-notice PDF Wayback 20260810084634, CDX digest 4MXLVPPU263SCNMCV4VSJXYNFE4G2FCE) with local copies in sources/. The 2,000+/38 figure and the three-month order are each carried firsthand by two independent Tier-2 newsrooms, Personnel Today (Wayback 20250913141438) and Infosecurity Magazine (James Coker, Wayback 20251227185327), making corroboration two_independent on both critical claims. Every quoted fragment binds verbatim against the specific capture it is attributed to. Verified 2026-08-10. Green is human-only: a recorded confirmation of the enforcement-notice reference numbers, whether Serco ceased processing and destroyed the data within the three-month window, and whether any of the nine notices were appealed to the First-tier Tribunal under s.162 DPA 2018.

Re-checked live on 2026-09-04: the ICO primary (source 1) and the Wayback captures both block automated fetchers from this environment, so the two load-bearing figures were re-confirmed verbatim against Infosecurity Magazine (source 4), which still carries “more than 2000 employees” across “38 sporting and leisure facilities” and the “three months” destruction deadline, dated 23 February 2024. No figure changed.

Related case files

• Spain’s AEPD ordered Worldcoin / Tools for Humanity to halt biometric iris-scanning: a regulator ordering a live biometric system to stop and delete data, the direct sibling of this cessation order
• Spain’s AEPD fined Mercadona €2.52M for facial-recognition biometric processing: the same technology, the same GDPR fault line of biometric surveillance without a lawful basis
• X suspended EU user-data training for Grok after the Irish DPC took High Court action: another data-protection regulator forcing a live data-processing practice to stop

Sources

1. Tier 1, independent regulator. Information Commissioner’s Office · “ICO orders Serco Leisure to stop using facial recognition technology to monitor attendance of leisure centre employees” · 2024-02-23 · https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2024/02/ico-orders-serco-leisure-to-stop-using-facial-recognition-technology/
2. Tier 1, primary (enforcement notice). Information Commissioner’s Office · “Enforcement Notice: Serco Leisure Operating Limited” · 2024-02-19 · https://ico.org.uk/media2/woalogoc/20240219-serco-leisure-operating-limited-en.pdf
3. Tier 2. Personnel Today · “ICO forces Serco to stop biometric attendance monitoring” · 2024-02-23 · https://www.personneltoday.com/hr/ico-forces-serco-to-stop-biometric-attendance-monitoring/
4. Tier 2. Infosecurity Magazine (James Coker) · “ICO Bans Serco Leisure From Using Facial Recognition for Employee Monitoring” · 2024-02-23 · https://www.infosecurity-magazine.com/news/ico-bans-serco-facial-recognition/