The Information Commissioner’s Office (ICO) has ordered the public service provider Serco Leisure to stop using biometric data to track employees’ attendance.