Serco Made Workers Scan Their Faces to Get Paid, and the UK Regulator Called That Coercion

What happened

At 38 leisure facilities across the UK and Jersey, more than 2,000 employees found that clocking in meant submitting to a facial recognition scan or a fingerprint read. The system was deployed by Serco Leisure, the public service and outsourcing company, along with Serco Jersey and seven associated community leisure trusts. The stated purpose was attendance monitoring and payroll verification. For the workers on the other side of the scanner, the arrangement had been framed as a condition of getting paid at all.

The UK's Information Commissioner's Office launched an investigation and found the processing unlawful. Serco and the associated trusts had been collecting biometric data without demonstrating that it was necessary or proportionate, given that less intrusive alternatives existed. An employee ID card or a fob achieves the same attendance check without capturing a permanent biometric record tied to someone's face or fingerprint. The ICO concluded that Serco had not shown why those alternatives were inadequate, and that the decision to use biometric scanning instead had never been properly justified against the lower-impact options available.

The consent question was where the case became most pointed. Workers had not been proactively offered an alternative to the biometric scan before it became part of their routine. The ICO was direct about the structural problem: the power imbalance between an employer and the staff it pays means employees are unlikely to feel they can refuse. When a biometric scan is built into the payroll process and no alternative is actively offered, the regulator argued, whatever agreement exists cannot be treated as freely given.

The ICO ordered Serco Leisure and the associated trusts to stop processing biometric data for attendance purposes across all 38 sites. The order named both Serco entities and every community leisure trust operating alongside them. It did not issue a financial penalty at this stage but required the organizations to move to a lawful, less intrusive alternative. The finding added to a growing body of regulatory action against employers who use biometric monitoring in workplace settings where the employment relationship itself limits the practical ability to opt out.

What Serco's system lacked was not just legal justification but an auditable record. There was no documented trail showing that individual employees had been informed of alternatives, offered a genuine choice, and made an active decision to participate. The compliance failure accumulated across two years of operation before a regulator identified it. A provable record of what a system did, which individuals it processed, and on what legal basis each collection rested would have made that gap visible far earlier, and removed any ambiguity about whether the processing was justified before it ran for years across thousands of workers.

Reported impact

Affected parties

Not publicly disclosed

Harm type

Not publicly disclosed

Scale

Not publicly disclosed

Financial impact

Not publicly disclosed

Regulatory action

Not publicly disclosed

Classification

Organization

Not publicly disclosed

AI system

Not publicly disclosed

Industry

Not publicly disclosed

Country

Not publicly disclosed

Provider

Not publicly disclosed

Incident type

Not publicly disclosed

Relevant governance controls

Governance control mapping is not available for this record.

• No controls mappedNot publicly disclosed

Control mapping is analytical. It does not state that any control would have prevented the incident.

Sources and evidence

This record was researched and written by the Index. The event is also catalogued in the following database, which is listed for cross-reference.