Automatic photo taking is excessive as a way to monitor employee working hours and a less invasive method should be used,  French data privacy regulator CNIL told a number of employers.

In its opinion, CNIL said that:

• Any system for controlling working hours must comply with the principle of minimization (Article 5 (1.c)) of the General Data Protection Regulation (GDPR). Data collected in this context must be adequate, relevant and limited to what is necessary.
• Per previous decisions by the Cour de Cassation and the Conseil d’etat, a geolocation system to ensure the control of employee working hours is only lawful when it cannot be done by other means, however less effective.
• The use of photo badgers by organizations violate the principle of minimization. The compulsory and systematic collection,  two to four times a day, of the employee’s photograph appears excessive.
• Tools for managing schedules without taking a photograph, such as conventional badge clockers, appear sufficient to fulfill the purpose of controlling working schedules.
• The companies were put on formal notice to make their time control systems compliant with the GDPR within three months.

Read the full text of CNIL’s Opinion.

[View source.]