Facial recognition, done compliantly

Yes, when it is done correctly. A face template used to identify someone is special category data, so you need a lawful basis, an Article 9 condition, a clear notice, a data protection impact assessment (DPIA) and a genuine alternative. TempClock shows workers a versioned notice before any camera use, records their answer, and lets anyone who says no clock in with a badge and PIN or through a supervisor.

You, the agency, are the controller and choose it: an Article 6 basis plus an Article 9 condition, most often explicit consent with a real alternative. You document the decision in your DPIA before you switch face clock-in on. A pre-filled DPIA template is available on request, as part of our compliance pack.

Consent has to be freely given, so nobody has to use their face to be paid. A worker who declines clocks in with their badge and a PIN, or a supervisor clocks them in. If a worker withdraws consent later, their face template, stored face data and reference photo are deleted straight away and they move to PIN. Their time records stay, under a separate basis.

The face template is held in the face-matching service (Amazon Web Services Rekognition, Ireland). TempClock stores the enrolment reference photo and a photo taken when someone clocks in by PIN (or from their phone, if you allow phone clock-in), in your instance in the UK, visible only to users with access to that worker or site. The photo taken at a face clock-in is sent for matching and then discarded. The template and reference photo are deleted within 4 hours of a worker being made inactive. Other retention periods (for example 90 days for PIN clock photos) are set by you in Data retention.

The TempClock application, database and uploaded files are hosted in a UK data centre. Face matching and the enrolment liveness check run at Amazon Web Services in Ireland (eu-west-1), which the UK treats as adequate. Optional services (the SMS add-on and AI features, both off unless you choose them) use providers in the United States under UK transfer safeguards. The full sub-processor list is in our privacy policy and DPA.

At enrolment, AWS Face Liveness checks that a live person is present. At clock-in, the face is matched against the worker whose badge was entered, so it only succeeds for that worker. You can also switch on an anti-photo movement check per site. No system makes buddy clocking impossible: PIN clocks are photographed and flagged for review, and an identity mismatch can raise an alert.