← Back to the blog Blog · Compliance

Attendance data and the GDPR: what you may record, and what you may not

Published on By the ScolaSign team (Ad Cognita)Reading time ~6 min

In 2019, a secondary school in Sweden ran a three-week trial in which a camera recognised the faces of 22 students as they entered a classroom and registered them as present. The guardians had been informed and had given explicit consent, and any student could opt out and be registered the old way. The Swedish Data Protection Authority fined the municipal board responsible SEK 200,000.

The consent did not save the project. It was, in a sense, the first thing the authority set aside.

The decision says something that applies well beyond cameras: what you may record when you take attendance is not decided by what the learner agrees to, nor by what the technology can do. It is decided by the purpose, and by how little data that purpose actually needs.

Attendance is personal data, all of it

The General Data Protection Regulation defines personal data as "any information relating to an identified or identifiable natural person", and it lists among the identifiers "a name, an identification number, location data, an online identifier". An attendance record is therefore personal data from its first column.

What is less often noticed is that each additional column is a separate decision. A sign-in sheet that holds a name and a signature is one processing operation; the same sheet with the time of signing, the IP address of the phone, its GPS coordinates and a photograph is the same operation with four more things to justify. Article 5(1)(c) states the test that each of them must pass: personal data shall be "adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed". Recital 39 is blunter still: "Personal data should be processed only if the purpose of the processing could not reasonably be fulfilled by other means."

One purpose, a short list of columns Eight possible columns of an attendance record, each with the question it answers and a verdict: needed, justify and keep short, or avoid. Purpose: show that a given person attended a given session Each column must answer a question that purpose asks Column Question it answers Verdict Name or identifier Who attended? Needed Session and server time Which session, and when? Needed Signature Did the learner assert presence? Needed Trainer sign-in Did the session take place? Needed Method, device, IP (log) Can the record be defended? Justify, keep short GPS position of the phone Already in the timetable Avoid Photo at every sign-in Nothing the signature missed Avoid Biometric template Prohibited in principle (Art. 9) Avoid GDPR Art. 5(1)(c): adequate, relevant and limited to what is necessary
Each column of an attendance record should answer a question the purpose actually asks. Name, session, time and signature do; a one-off device log is defensible; continuous location, a photograph at every sign-in and biometric templates answer questions nobody needed to ask.

One purpose, a short list of columns

The purpose of an attendance record is to establish that a given person attended a given session, for a given length of time, so that the centre can show it to whoever funds, accredits or supervises the training, and act when someone stops coming. Article 5(1)(b) requires that purpose to be "specified, explicit and legitimate", and forbids further processing "in a manner that is incompatible with those purposes".

Written down in that form, the purpose sorts the columns almost by itself. The learner's name or identifier, the session and the time of signing answer the question directly; without them there is no record. The signature, whatever its form, is the act by which the learner asserts presence, and it is the piece that a funder or an auditor will look for. The trainer's own sign-in belongs here too, since a session without a trainer is not a session.

The technical details of the sign-in (the method used, the device, the network address) are a different case. They do not prove presence by themselves, but they make the record defensible if it is ever contested, and they serve the security of the system. They are justifiable if they stay in a log read only when a question arises.

Location is where it is easiest to overreach. The room in which a session takes place is already known: it is in the timetable. Recording the GPS position of each learner's phone at the moment of signing adds data about a person in order to prove something the timetable already states about a room. A code displayed in the room, or a tag fixed to its wall, ties the signature to the room without locating anyone. Continuous geolocation has no connection with the purpose at all.

Photographs and biometrics

Recital 51 makes a distinction that matters: "The processing of photographs should not systematically be considered to be processing of special categories of personal data as they are covered by the definition of biometric data only when processed through a specific technical means allowing the unique identification or authentication of a natural person."

A photograph taken at sign-in is therefore not automatically sensitive data. It is, however, a great deal of data. A group of 20 learners signing in twice a day over 180 days produces 7,200 photographs a year; a centre with fifteen such groups holds more than 100,000 images of faces, each tied to a date, a time and a place. The question under Article 5(1)(c) is not whether that is allowed in the abstract, but what those images add to the purpose that a signature and a code in the room did not already provide.

Once the photograph is compared with a reference image by software, it becomes biometric data, which Article 4(14) defines as "personal data resulting from specific technical processing relating to the physical, physiological or behavioural characteristics of a natural person, which allow or confirm the unique identification of that natural person, such as facial images or dactyloscopic data". Article 9(1) then applies: the processing of "biometric data for the purpose of uniquely identifying a natural person" shall be prohibited, unless one of the exceptions of Article 9(2) applies.

The first of those exceptions is explicit consent, and this is where the Swedish school stumbled. Recital 43 warns that consent "should not provide a valid legal ground" where "there is a clear imbalance between the data subject and the controller". The Swedish authority applied it directly: students are "in a position of dependence" towards the school, as regards grades and their future studies, and therefore "consent cannot constitute a legal basis" for the processing. It added, on proportionality, that "attendance monitoring can be carried out in other ways which involve less infringement of the students' integrity". The same reasoning transposes without effort to an apprentice and the centre that reports their attendance to their employer.

Biometric attendance also triggers Article 35, which requires an impact assessment before processing that is "likely to result in a high risk to the rights and freedoms of natural persons". The Swedish board had carried out a risk assessment, but one with no assessment of the risks to the students' rights or of proportionality, and the authority found a breach of that article as well.

How long to keep it

Article 5(1)(e) requires data to be kept "for no longer than is necessary for the purposes for which the personal data are processed", and recital 39 adds that "time limits should be established by the controller for erasure or for a periodic review". The regulation sets no figure, and that is deliberate: the right period is the one during which someone may legitimately ask you to prove attendance, which depends on your funders, your contracts and the law of your country.

In practice this means two clocks. The signed record is kept as long as it may be requested; the technical log around it has no reason to outlive the period in which a dispute is plausible. Photographs, if a centre takes them, are the first thing to go.

Outside the European Union

Switzerland is not in the European Union, and the GDPR does not apply there as such. Its Federal Act on Data Protection follows a similar logic: in the unofficial English translation published by the Confederation, "biometric data that uniquely identifies a natural person" is listed among sensitive personal data, and the principles require that processing be "proportionate" and that data be "destroyed or anonymised as soon as they are no longer required for the purpose of processing". The United Kingdom applies its own UK GDPR, whose wording is close to the European text. Whatever the country, few laws reward collecting more than the purpose needs.

A test for your own export

Open the attendance export of last month and, for each column, write the question it answers. Name, session, time, signature, trainer: each has its question. If a column has no question, or answers one nobody asked (where was this learner's phone at 9:02, what does her face look like on a Tuesday), it is not evidence. It is liability, kept at your expense.

For what it is worth, the tool we publish records a name, a session, a server time and a simple electronic signature, given by scanning a code that changes every few seconds, by tapping an optional NFC tag in the room, or through a personal link, and it does not use geolocation, photographs or biometrics.

Sources

Every feature,
from the very first plan

Try the complete platform for 14 days, free of charge and with no credit card.

14-day free trial