Dozens of companies including national leisure centre chains are reviewing or pulling facial recognition technology and fingerprint scanning used to monitor staff attendance after a clampdown by the UK’s data watchdog.

In February, the Information Commissioner’s Office (ICO) ordered a Serco subsidiary to stop using biometrics to monitor the attendance of staff at leisure centres it operates and also issued more stringent guidance on the use of facial recognition and fingerprint scanning.

The ICO found that the biometric data of more than 2,000 employees had been unlawfully processed at 38 centres managed by Serco Leisure to check their attendance using facial recognition technology and in two cases via fingerprint scanning systems.

Serco was given three months by the ICO to make its systems compliant and has said it will fully comply within that period.

In light of the ICO decision, a number of other leisure centre operators and companies are either reviewing or stopping use of similar biometric technology to monitor staff attendance.

Virgin Active, the leisure club operator, said it had pulled biometric scanners from 32 of its sites and was working on an alternative for staff. “We are working on this as a priority and the change has been communicated to all clubs already,” it said.

Several companies supply biometric technology to help monitor staff attendance. Ian Hogg, the chief executive of Shopworks, which supplied the technology to Serco and supplies biometrics to about 40 or 50 companies, said he had been contacting clients in retail, leisure, hospitality and care homes and factories after the ICO decision.

“The ICO has issued new guidance and upped the standards we have to help our customers meet those new standards and give them all the solutions to do this,” Hogg said.

He said the new ICO standard requires companies to consider every option “and if they can meet their statutory objectives another way then they should use that alternative rather than biometrics”.

1Life, which operates council leisure centres and is owned by the leisure company Parkwood, said its Shopworks system was not in use for biometric purposes and was in the process of being removed from all sites.

The ICO said in a statement: “As part of our ongoing work following the Serco enforcement and our new guidance, we continue to engage with different stakeholders about how facial recognition and biometric technology can be used appropriately.”

The ICO decision underscores wider growing concerns about employers using facial recognition technology and other surveillance tools to monitor staff.

The Trades Union Congress warned in 2022 that the use of intrusive surveillance technology and artificial intelligence risked “spiralling out of control” without stronger regulation to protect workers.

Mary Towers, an employment rights policy officer in the rights, international, social and economic department at the TUC, is leading a project looking at the use of artificial intelligence in the employment relationship. She said: “The Serco case highlights the dangers of excluding workers and trade unions from a genuine consultation process before the introduction of new technology at work.”

In March, an Uber Eats driver received a financial settlement, after allegations that facial recognition checks required to access his work app were racially discriminatory, which led to him being unable to access the Uber Eats app to secure work.

The Equality and Human Rights Commission (EHRC) and the App Drivers and Couriers Union backed the case of Pa Edrissa Manjang, who has worked as an Uber Eats driver in Oxfordshire since November 2019. It raised concerns about the use of artificial intelligence and automated processes in this case.

Manjang continually experienced difficulties with Uber Eats’s verification checks, which use facial detection and recognition software. In 2021, he was removed from the platform after a failed recognition check and subsequent automated process.

Manjang was told by Uber Eats that it had found “continued mismatches” in the photos of his face he had taken for the purpose of accessing the platform, according to the EHRC.

Uber Eats said that its checks involved facial verification rather than facial recognition. It said its real-time ID check compares two photos to confirm that the courier’s selfie matches the account photo it has on file.

Uber Eats said in a statement: “Our real-time ID check is designed to help keep everyone who uses our app safe, and includes robust human review to make sure that we’re not making decisions about someone’s livelihood in a vacuum, without oversight. Automated facial verification was not the reason for Mr Manjang’s temporary loss of access to his courier account.”