Data watchdog tells off outsourcing giant for scanning staff biometrics despite 'power imbalance'