DATA PROTECTION | Italian DPA fines online university for unlawful use of facial recognition systems

On 29 January 2026, the Italian Data Protection Authority (Italian DPA) imposed a fine on the online university eCampus for the unlawful processing of biometric data of its students through facial recognition systems.

The university had implemented a facial recognition system to identify participants to classes and monitor attendance. While participants were formally asked to provide consent, refusal resulted in the impossibility of attending the course. The university argued that individuals could alternatively enroll in similar courses offered by other institutions.

The Italian DPA recalled that biometric data fall within the special categories of personal data under Article 9 of GDPR and require a valid legal basis for their processing. In the case at hand, the university relied on the data subjects’ consent as the legal basis for the processing. However, the Italian DPA found that such consent could not be considered freely given. In reaching this conclusion, the Italian DPA referred to EDPB Guidelines 05/2020 on consent, according to which the mere availability of alternative service providers does not guarantee a genuine freedom of choice, as the validity of consent cannot depend on external market conditions.

The Italian DPA also emphasised that the processing took place in the context of a legally recognised training course, involving the performance of a task in the public interest and characterised by a clear imbalance between the parties. In such circumstances, consent was not an appropriate legal basis for the processing. In imposing a euro 50,000 fine, the Italian DPA further noted the absence of a data protection impact assessment (DPIA), as well as breaches of the principles of data minimisation and storage limitation.

Newsletter n. 116 – March 2026