evidoria

← Back to browse

Good practice Imported

Fingerprints for School Lunch — Gdańsk's Six-Year Legal Battle Over Children's Biometric Data

Poland · Gdańsk · See the Poland profile

Evidence: Descriptive / self-reported Top 95% 20/100 · Ask Evidence Copilot about this practice

Poland's data-protection authority fined a Gdańsk primary school for fingerprinting 680 children to pay for lunch. The school fought back and won twice in court, leaving a contested but influential precedent on biometric consent in schools.

680 pupils
Pupils enrolled in fingerprint system
20000 PLN
UODO fine imposed (March 2020)
~4,700 EUR
UODO fine (EUR equivalent) (March 2020)
~6 years
Duration of legal proceedings (2018-2024)

Details

Promoter
Primary School No. 2 in Gdańsk
Period
2018–2024
Region (NUTS)
PL63
Keywords
primary education, biometric data, data protection, canteen management

Context

Primary School No. 2 in Gdańsk introduced an opt-in fingerprint-identification system at its canteen till, letting 680 pupils with parental consent pay for meals without a card; a card-based alternative existed for those who did not enrol.

Results

In March 2020 Poland's Personal Data Protection Office (UODO) fined the school PLN 20,000 (about €4,700) for violating GDPR Article 9 and the data-minimisation principle, also finding that pupils without a fingerprint ID were routed to the back of the queue. The school appealed; the Provincial Administrative Court in Warsaw annulled the fine in 2020, and the Supreme Administrative Court upheld that reversal on 10 October 2024 on different legal grounds, closing a legal saga of almost six years.

Conclusions

For AI and biometric governance in education, the case is instructive precisely because it shows persistent legal uncertainty: a national data-protection authority and two courts reached opposite conclusions on the same facts — a reminder that schools deploying biometric identification need a genuine opt-out and a documented proportionality analysis, whichever way courts eventually rule.

Implementation
Indicative cost
Low (< €50k)
Time to results
Long (> 3 years)
Staffing & skills
Primary School No. 2 in Gdańsk (system operator), Poland's Personal Data Protection Office (UODO) as enforcement authority, Provincial (Voivodeship) Administrative Court in Warsaw and Supreme Administrative Court as adjudicators

Conditions for success

  • System was opt-in with parental consent and a card-based alternative for non-enrolled pupils
  • Documented proportionality/data-minimisation analysis needed to withstand regulatory and judicial scrutiny

Common failure modes

  • UODO found pupils without fingerprint IDs were routed to the back of the queue, a documented differential-treatment issue
  • National DPA and two courts reached opposite conclusions on the same facts, leaving persistent legal uncertainty for similar biometric systems

Where it fits

Governance type
single school + national data-protection authority + courts
Scale
single school (680 pupils)
Income level
high-income (EU)

Commonly funded by

Own resources / municipal budget

Indicative funding routes for practices of this type — always check each programme's current calls and eligibility rules.

Replication kit

Reusable artefacts from this practice — as published by their sources.

Do you run this practice? Claim it — verified implementers get a public contact pathway and can propose corrections.

Data sources

Where this practice's information was retrieved from, and when.

Similar practices you may find useful