Quarterly BAS Due (July–September)
Form 1099-NEC & Contractor Payment Reporting Check
Why this matters.
Biometric data used to uniquely identify a person — facial recognition templates, fingerprints, iris scans, voice patterns — is classed as special category data under Article 9 of UK GDPR, alongside health and ethnicity data. This means it can only be processed with explicit consent or another narrow legal condition, and businesses must be able to justify why less intrusive alternatives weren’t used instead. The Information Commissioner’s Office has published detailed guidance on biometric data and, separately, on live facial recognition technology aimed squarely at retailers and employers who have rapidly adopted these tools for staff attendance, building access, and loss prevention.
Enforcement is no longer theoretical. In February 2024 the ICO issued a formal reprimand to Serco Leisure over its use of facial recognition and fingerprint scanning to monitor staff attendance across leisure centres, finding the company had failed to properly assess whether a less intrusive method could achieve the same purpose. Retailers deploying facial recognition for shoplifting and loss prevention have also faced complaints and regulatory scrutiny over inadequate signage, consent, and data retention practices. Any UK business using biometric technology — however small the deployment — needs a documented lawful basis, a Data Protection Impact Assessment, and a genuine alternative for people who don’t want to take part.
