What happened
According to the Garante, Italy’s data protection authority, Università Telematica e-Campus, an online university in Italy, used facial recognition from March 2024 to check whether students were attending online classes.
The decision records that the classes offered the 30 university credits needed for a teaching qualification. Each class had an average of 400 to 500 students.
The decision records that students had to photograph their face and identity document when registering. Teachers could also start webcam checks during lessons. The university’s privacy notice said that refusing consent “will not allow participation in the lessons”.
The Garante opened an inquiry after receiving a report. According to its decision, the university stopped using the system on 11 November 2024.
On 29 January 2026, the Garante found that the university had processed students’ biometric data unlawfully and fined it 50,000 euros. The decision says the university could settle the fine by paying half within 30 days.
No appeal had been reported as of September 2026.
What an auditable version would have shown
The decision records that the facial recognition results were sent to the university rather than the teacher. If the system repeatedly failed to recognise a student, the student could request an in-person check.
The university told the Garante in June 2024 that it had found no high risk and had therefore not completed a data protection impact assessment (DPIA), a review of the risks to people’s personal data.
The university later submitted an assessment, which the Garante described as a spreadsheet with no verifiable date or signature.
A record made before the system went live would have shown the legal basis for collecting students’ facial data, the assessment of risk, how long the data would be kept and who approved the process.
The decision does not report that any student was wrongly marked absent.
Where the gap was
According to the Garante, the university made consent to facial recognition a condition of attending class.
The Garante found that students could not freely consent when refusing meant losing access to their qualification. It also pointed to “an evident imbalance” between the university and its students.
It found that attendance guidelines issued by ANVUR, the national agency that evaluates universities, did not provide a legal basis for collecting students’ biometric data either.
A ConstraintGate is designed to check a proposed processing activity against declared rules, including its legal basis and impact assessment, before it starts.
A ConductRecord keeps the basis relied on, the assessment and the approval.
ConstraintGate and ConductRecord are Headlights designs.
What governance should have looked like
The Garante held that universities, whether public or private, process this type of data in the public interest. It said the legal basis must therefore be a legal obligation or a public task, rather than consent.
The Garante also found that keeping the data for 12 months was disproportionate and that a DPIA was required before processing began.
It recorded that the breach was negligent and resulted from an error of law about the legal basis. The decision also records that the university cooperated with the inquiry and ended the processing itself.
Where an educational institution needs to check attendance, best practice would be to establish a lawful basis before choosing facial recognition, complete and sign the impact assessment before enrolling students, and provide an alternative that does not cost students their place.
Failure Pattern: an online university made consent to facial recognition a condition of attending a teacher qualification course, and Italy’s data protection authority found it had no lawful basis and had not assessed the risks before starting.
Governance Principle: an institution should be able to show, before collecting biometric data, the legal basis it relies on, a dated and signed impact assessment, and an alternative for anyone who declines.
The reference implementation of ConstraintGate and ConductRecord is open source. It lives at github.com/saffronandindia/headlights-oss, Apache 2.0 licensed and free to install. The repository is public now.
Sources
- Garante per la protezione dei dati personali, decision of 29 January 2026, docweb 10221611 (Italian)