What happened
The High Court of Justice of Galicia reported in its judgment that Make Packing S.L. introduced facial recognition to record workers’ hours in 2023. The company did not consult its workers or obtain their consent. The installer billed Make Packing’s sole shareholder, Art & Graphic Packaging S.L., which helped install the system and paid for it. The court records that Art & Graphic Packaging’s own workers did not use it.
In 2024, workers’ representatives told the company that fingerprint and facial recognition clocking were not permitted, according to the meeting minutes quoted in the judgment. The company said it had asked the installer to change the system and would give workers personal cards instead. The facial recognition system remained in place until 2025.
One worker, who had been with the business since 2007 through a predecessor company, went to court. She wanted to end her employment contract because of the facial recognition system and repeated late payment of her wages. In 2025, the Social Court of Vigo awarded her damages but did not end her contract. Both sides appealed.
What an auditable version would have shown
The judgment records when the system was installed and removed. It also records when workers’ representatives objected and what the company said it would do.
It does not say whether the company assessed the system before installing it, what legal basis it relied on or how the biometric data were stored. On appeal, the companies argued that the data were not stored and that the terminal was protected. The court held that collecting or using the data was itself processing.
A record made before installation would have shown the legal basis the company relied on, the alternatives it considered and how it dealt with the workers’ objection.
Where the gap was
The court held that facial recognition uses biometric data. Under the EU’s General Data Protection Regulation, this is a special category of data that cannot be processed unless a legal exception applies. The court found that neither the worker’s consent nor another exception had been shown.
It also found that the processing was unnecessary, “since other means existed for recording working time and hours without interference with fundamental rights, such as control by a card, which the company itself mentioned in the meeting minutes”.
The court found that the company “persisted in that breach” after workers’ representatives raised the issue and asked for the system to be removed.
A ConstraintGate is designed to check a proposed use of data against declared rules, such as the need for a legal basis for biometric data, before the processing starts.
A ConductRecord keeps the decision, the basis relied on and any objection received.
ConstraintGate and ConductRecord are Headlights designs.
What governance should have looked like
The court upheld the findings that the worker’s rights to her own image and data protection had been breached. It kept the award of damages against both companies but set aside the finding that her right to privacy had been breached.
It also considered fourteen late wage payments between 2024 and 2025. The payments were between five and 29 days late, despite an agreement to pay by the fifth of each month. The court held that the late wages, together with the facial recognition system, justified ending the worker’s contract. It ordered her employer to pay compensation.
Before introducing biometric timekeeping, best practice would be to establish a legal basis, consider less intrusive ways to record working hours and consult workers’ representatives. Any objections should be recorded and addressed promptly.
Failure Pattern: an employer introduced facial recognition timekeeping without consulting workers or obtaining consent, when a card would have done the job, and kept it for more than a year after workers’ representatives said it was not permitted.
Governance Principle: an employer using biometric data should be able to show, before the system is switched on, the legal basis for the processing, why a less intrusive method would not do, and what it did when workers objected.
The reference implementation of ConstraintGate and ConductRecord is open source. It lives at github.com/saffronandindia/headlights-oss, Apache 2.0 licensed and free to install. The repository is public now.