Use of biometrics to monitor attendance of employees
It was the case for the company that:
- the collection and processing of fingerprints of employees are necessary for the performance of their contract of employment; and
- the use of the fingerprint-based electronic attendance system is required for the "proper and effective running of the group with a view to optimise monitoring of the attendance of the employees".
The Tribunal found that:
- the company has failed to justify that for the non-consenting employees, the collection of the fingerprint data by the electronic attendance system was necessary for the performance of their contract of employment; and
- the company had caused the employees to use the fingerprint-based electronic attendance system without their consent.
It is arguable as to whether the fingerprint electronic attendance system is not disproportionate and excessive to the objectives to be achieved, i.e., to optimise the monitoring of employees attendance. Unlike premises where high security and restricted access are required onsite to ensure the proper carrying out of activities, it can hardly be said that such level of security is required on the premises of the company.
Disproportionate means
It is submitted that the use of biometrics to record and monitor the attendance of employees is a disproportionate means to do so unless, having regard to the activities of the company, access to the premises must be strictly controlled. Furthermore, the use of such a fingerprint electronic attendance system may negatively impact on the relation of trust which must exist between an employer and its employees. It is important that the express consent of the employee is obtained and more importantly, all information pertaining to the fingerprint electronic attendance system is given to the employee.
The decision of the Tribunal must not be read as suggesting that a fingerprint electronic attendance system cannot, in all circumstances, be implemented. Before an employer envisages the implementation of such a system, the following points which are not exhaustive must be addressed:
a. the objective being sought when implementing the system;
b. the existence of effective alternative means of achieving the same purpose;
c. the existence of safeguards in place to protect the privacy of the employee; and
d. the access by the employee to any personal information stored and the retention period of such information.