Automatic photo taking is excessive as a way to monitor employee working hours and a less invasive method should be used, French data privacy regulator CNIL told a number of employers.
In its opinion, CNIL said that:
- Any system for controlling working hours must comply with the principle of minimization (Article 5 (1.c)) of the General Data Protection Regulation (GDPR). Data collected in this context must be adequate, relevant and limited to what is necessary.
- Per previous decisions by the Cour de Cassation and the Conseil d’etat, a geolocation system to ensure the control of employee working hours is only lawful when it cannot be done by other means, however less effective.
- The use of photo badgers by organizations violate the principle of minimization. The compulsory and systematic collection, two to four times a day, of the employee’s photograph appears excessive.
- Tools for managing schedules without taking a photograph, such as conventional badge clockers, appear sufficient to fulfill the purpose of controlling working schedules.
- The companies were put on formal notice to make their time control systems compliant with the GDPR within three months.