← Back to the blog Blog · Practice

Proxy attendance: how to stop signing for a friend without biometrics

Published on By the ScolaSign team (Ad Cognita)Reading time ~6 min

In February 2024, the United Kingdom's data protection regulator ordered a leisure operator and several associated trusts to stop using facial recognition and fingerprint scanning to record the attendance of more than 2,000 employees across 38 sites. The employer had a reason, and it was the reason every training centre will recognise: the previous methods, it said, were open to abuse.

The regulator's answer is the interesting part. The employer "has not been able to provide evidence of widespread abuse", it wrote, nor explained why other responses, "such as disciplinary action against employees found to be abusing the system", had not been considered. And it named the less intrusive means that were available: "radio-frequency identification cards or fobs, or manual sign-in and sign-out sheets".

The case concerned employees, not learners, and it was decided under the UK GDPR rather than the European regulation. But the reasoning is the one any training centre or school will meet if it answers proxy attendance with a fingerprint reader, and it is worth understanding why, before looking at what does work.

How proxy attendance actually happens

On paper, the mechanism is almost too simple to describe. The sheet goes round the room while the trainer teaches. A learner signs her own box and, two lines below, the box of a friend who is still in bed. Nobody compares signatures. A group of 20 learners signing morning and afternoon over a five-day week fills 200 boxes; a trainer who checked each one against a reference would spend more time on the sheet than on the course, and so nobody does.

Screens have not abolished the practice; they have changed its routes. A fixed QR code printed on the door can be photographed once and sent to a group chat, where it can remain valid for the rest of the year. A sign-in link sent by email can be forwarded. A numeric code written on the board can be read out over the phone. And a learner who knows a friend's password, or holds the friend's phone, can sign in the friend's name from the room itself.

Looked at closely, all of these fall into two kinds. In the first, the absent learner signs from somewhere else, using something that should have stayed in the room. In the second, someone who is in the room signs in the name of someone who is not. The measures that work are not the same for both, and treating them as one problem is a reliable way to be disappointed.

Why biometrics are the wrong answer

A fingerprint or a face appears to settle both at once: the person who signs must be the person enrolled, and must be in front of the reader. The difficulty is not technical. It is that the law of most European countries treats this as one of the most sensitive things an organisation can do with personal data.

Under Article 9(1) of the GDPR, the processing of "biometric data for the purpose of uniquely identifying a natural person" is prohibited unless an exception applies. Consent, the exception that comes to mind first, is fragile where one party depends on the other; in 2019 the Swedish data protection authority refused to accept it from a school whose students were, in its words, "in a position of dependence", and found that "attendance monitoring can be carried out in other ways which involve less infringement of the students' integrity". The UK regulator, in the case above, added a test of necessity: "must be more than just 'useful' and be a targeted and proportionate way of achieving the purpose".

It also recalled why the data are so sensitive: biometric data are "inherently sensitive due to its uniqueness to the person to whom it relates, and the increased potential for harm if that data is compromised". A password that leaks can be changed. A fingerprint cannot.

So the centre that installs a reader to stop a handful of learners signing for each other takes on a prohibition to overcome, an impact assessment to carry out, and the fingerprints of every learner to protect, in order to solve a problem that duller means solve almost as well.

Two kinds of proxy, two kinds of measure Route A: the absent learner signs from elsewhere; narrowed by codes that expire and an NFC tag in the room. Route B: someone in the room signs for an absent learner; caught by the trainer head count and cross-checks. Biometrics are marked as disproportionate. Route A Absent learner signs from elsewhere How it happens • Photo of a fixed QR code sent to a chat • Sign-in link forwarded • Code read out over the phone What works against it Code renewed every few seconds A forwarded picture expires on the way NFC tag fixed in the room The phone must be held to the tag Route B Someone present signs for them How it happens • Friend’s box signed on the sheet • Friend’s password or phone used • Both phone and signer are in the room What works against it Trainer head count 18 heads, 19 signatures: one question Cross-checks Work handed in, activity during the day Biometrics: disproportionate when less intrusive means exist (GDPR Art. 9)
Proxy attendance takes two routes: the absent learner signs from elsewhere, or someone in the room signs in the absent learner's name. Codes that expire and a tag in the room narrow the first route; only the trainer's count and the cross-checks catch the second.

Two kinds of proxy, two kinds of measure

Against the first kind, the remote signature, the answer is to make what is shown in the room useless outside it.

A code that changes every few seconds does this. If the QR code on the screen is renewed every five seconds, a photograph sent to a friend at home must travel through a messaging application, be opened and be scanned before it expires, and it will usually lose the race. Combined with a personal account, it also changes the nature of the cheat: the friend in the room can no longer simply forward a picture, and must instead hand over a password or a phone, which is a different and more serious thing to ask of someone.

An NFC tag fixed in the room works differently. The phone has to be held against it, so the normal route to a signature runs through a phone that is physically there. The tag proves nothing about whose phone it is, and a tag that carries a fixed address can be read once and that address passed on, so it narrows the remote route rather than closing it. It costs a few euros.

Against the second kind, a person in the room signing for someone who is not, no code or tag helps, because the phone and the person signing are both genuinely present. What works is a human count and a comparison. A trainer who counts heads at the start of the session and records the number has produced a figure that can be set against the number of signatures in a second: eighteen people, nineteen signatures, one question. This is also why the trainer's own sign-in matters. A trainer who has signed the session has attested that it took place, and implicitly, who was in it.

The cross-checks that follow cost nothing to run. Who submitted the exercise set at the end of the morning? Who spoke in the group work? Which learner signed at 9:01 but has no trace of activity for the rest of the day? Each of these is weak alone, and together they make a pattern that a proxy signer does not think to imitate.

What none of this does

No measure described here prevents a determined learner from lending his unlocked phone to a friend in the room, any more than a lock prevents someone from handing over the key. What these measures do is change the cost: a forwarded photograph costs nothing, a lent phone costs trust, and a head count that does not match costs a conversation with the trainer. The UK regulator's reference to disciplinary action was not a throwaway line. Rules, known to learners and actually applied, remain part of the answer, and no technology replaces them.

The cheapest check

At the end of next week, take the sessions of one group and compare, for each, the number of signatures with the number of learners the trainer saw. If the two never diverge, proxy attendance is not your problem. If they diverge often, you now know which sessions to look at, and none of it required a single fingerprint.

The tool we publish uses QR codes that change every few seconds, optional NFC tags fixed in the room, sign-in by personal link and the trainer's own signature, and it does not use biometrics.

Sources

Every feature,
from the very first plan

Try the complete platform for 14 days, free of charge and with no credit card.

14-day free trial