RFID badges: what are the employer's GDPR obligations?

RFID badges: what are the employer's GDPR obligations?

An RFID badge that records your employees' movements processes personal data. The GDPR therefore applies from the very first door you equip, even if the chip holds nothing but a number. You are the controller, with three formalities to complete before go-live (record of processing, employee information, works council), two retention periods not to be confused (3 months for access logs, up to 5 years for time and attendance) and a security obligation that covers the chip itself.

This guide sets out the applicable CNIL framework, text by text, with the decisions, the articles and the figures. It does not replace the opinion of your DPO or your legal adviser.

In brief

  • →A badge that identifies a person, or makes it possible to re-identify them, processes personal data: the GDPR applies even with no name engraved on the chip.
  • →Three formalities before go-live: the record of processing activities (art. 30), employee information (L1222-4), information and consultation of the works council (L2312-38, companies with at least 50 employees).
  • →Access logs: 3 months. Time and attendance follows its own period, up to 5 years in intermediate archiving: two processing operations, not one.
  • →A DPIA (art. 35) as soon as the system constantly monitors activity or locates people; biometrics add the CNIL's model regulation on top.
  • →Chip security falls under article 32: encryption, diversified keys, immediate deactivation of a lost badge. A MIFARE Classic has been clonable since 2008.

Why an RFID badge falls under the GDPR

The reasoning fits into a single sentence: the badge is not an innocuous object, it is an identifier linked to a person, and every read produces a timestamp. As soon as that link exists, you are processing personal data - and GDPR-compliant access control does not stop at the door: it covers the reader, the software, the logs and the service providers.

Personal data: the badge identifies a person, not a door

A chip number on its own is pseudonymous, not anonymous. The lookup table stored in the access control software is enough to re-identify its holder in a single query. It is that table which brings the whole system within the scope of article 4.1 of the GDPR.

The timestamp follows from it. Date, time, door used: each passage constitutes an "element relating to the movements of persons", to use the wording of the CNIL's former simplified standard no. 42. Multiply the readers, and those passage points trace a route. That is precisely what the CNIL rules out in principle inside the premises.

The practical consequence: the principles of article 5 apply (specified purpose, minimisation, limited retention, security). If you are first looking to understand what a badge is for within an organisation, our article on the purpose of a company badge sets out the functional picture; here, we deal with the legal framework.

What a badge chip actually contains

Two families coexist in physical access control, and they do not offer the same level of protection.

At 125 kHz the badge broadcasts its identifier in clear and any reader copies it. At 13.56 MHz the reader has to present the right key to reach the memory.

125 kHz (LF), EM4100 family. The chip is read-only: it repeats a fixed 64-bit frame containing a 40-bit identifier, with no encryption and no authentication. Any off-the-shelf reader picks up that identifier in clear, from a few centimetres away. Being read-only prevents the card from being rewritten; it does not prove that the badge presented is genuine.

13.56 MHz (HF), MIFARE family. The chip has a memory organised into sectors, which can be protected by keys. The first generations (MIFARE Classic) rely on the proprietary Crypto-1 algorithm, publicly broken in 2008. Later generations use modern cryptography (AES) with mutual authentication.

This technical content has a direct legal bearing. An identifier transmitted in clear is an identifier that can be stolen: the security required by article 32 does not cover only the software, it also covers what travels between the chip and the reader.

Who is responsible: employer, service provider, landlord

Roles are shared out before the order is placed, not after the first inspection. The table below sets out the usual positions.

Party Role under the GDPR What you have to organise
Employer (or site manager)ControllerPurposes, record of processing, information, retention, DPIA, security, responding to data subject requests
Badge supplier (encoding, personalisation)Processor as soon as it handles the file of names, photos and numbersContract compliant with article 28, written instructions, return then documented erasure of the file after production
Access control software vendor, installerProcessor for hosting, maintenance and supervisionArticle 28, data location, logging of administrator access, reversibility clauses
Landlord or building managerJoint controller where the purposes are shared, separate controller where it manages its own access pointsWrite down who informs, who purges, who answers requests; a written agreement avoids conflicting instructions
Employees, works councilData subjects and staff representative bodyPrior information, exercise of rights, consultation before the decision
Visitors and contractorsData subjectsShort, legible information at reception, before the badge is handed over

One point is often missed: the employer remains the controller even when everything is outsourced. The provider carries out instructions; it decides neither the purposes nor the retention periods.

Before go-live: the mandatory formalities

You no longer have a prior declaration to file with the CNIL. Instead, you have four obligations to document - and they are dealt with in this order, whether you are equipping a 15-person site or a head office of 1,500 with named company badges.

Does a badge system still have to be declared to the CNIL?

No. The declaration regime disappeared when the GDPR came into application, and simplified standard no. 42 (NS 42) has had no legal force since 25 May 2018. To place it in context: NS 42 corresponded to decision no. 02-001 of 8 January 2002, which covered access control to premises, working hours and staff catering. The CNIL keeps it online as a historical marker, with an explicit warning.

What replaces the declaration:

  • →entry in the record of processing activities;
  • →information of the people concerned and consultation of the works council;
  • →the DPIA where the risk is high;
  • →the security measures required by article 32;
  • →the model regulation on biometrics if you use a fingerprint.

Beware of the opposite reflex: "no more declaration" does not mean "no more formalities". A CNIL inspection now starts by asking for the record of processing.

The record of processing activities (art. 30)

A multi-purpose badge does not make a single processing operation. Count one line per purpose: access to premises, time and attendance, catering, car park management. Each line carries its purpose, its legal basis, the categories of data, the recipients, the retention period and the security measures.

The legal basis deserves to be written down in black and white:

  • →access to premises: the employer's legitimate interest in protecting its assets and its people (art. 6.1.f);
  • →time and attendance: legal obligation or performance of the contract, depending on how working time is counted;
  • →catering: management of the service, billing of meals.

Your GDPR record must also identify the processor that encodes the badges and the one that hosts the software. An incomplete record of processing is easy to spot: the retention period is missing, or the legal basis, or the recipients. All three together is the bare minimum.

Informing employees and consulting the works council (L1222-4, L2312-38)

Article L1222-4 of the French Labour Code is short and leaves no way out: no information concerning an employee personally may be collected by a device that has not been brought to their attention beforehand. Information therefore comes before installation, not before the first payslip.

The CNIL sets out the expected content: purposes, legal basis, recipients, retention period, how to exercise rights and the possibility of lodging a complaint with the CNIL. An IT charter, an internal memo or a notice board are enough, provided they are accessible and dated.

On the staff representation side, article L2312-38 requires the works council to be informed and consulted before the decision to implement any means of monitoring employee activity. The same article provides for prior information on automated personnel management processing. Below 50 employees there is no works council; the individual information obligation, however, does not change.

Then there is article L1121-1: no restriction on individual rights and freedoms that is not justified by the nature of the task and proportionate to the aim pursued. It is for the courts to apply it, and that is often where such systems fall.

Is a DPIA mandatory?

Article 35 of the GDPR requires a data protection impact assessment where processing is likely to result in a high risk to rights and freedoms, in particular in the case of systematic and extensive monitoring, sensitive data or large-scale processing. The CNIL adds an operational criterion: a DPIA is required where the system is likely to result in a high risk, particularly in the case of biometrics.

Two lists frame the reasoning: decision no. 2018-327 of 11 October 2018 sets out the 14 types of operation for which a DPIA is required; decision no. 2019-118 of 12 September 2019 sets out the 12 types for which it is not. A badge that falls within the first case does not need to fit a box labelled "badge": it is the purpose that counts.

Configuration DPIA required? Why
Badge + readers at the doors, logs purged at 3 months, no other useIn principle noNo systematic monitoring: record of processing, information and security are enough
The same logs reused for payrollYes, or failing that to be documented seriouslyPurposes crossed and working time monitored: risk of use incompatible with the original purpose
Readers multiplied inside (corridors, break rooms, intermediate doors)YesThe CNIL targets constant monitoring of employee activity
Biometric badge (fingerprint, hand geometry)YesSensitive data, high risk, model regulation no. 2019-001 to be complied with
UHF or RTLS badge with real-time locationYesLocation, and "large-scale location data" in the 2018 list
Badge + video, or named badge with a photo checked remotelyTo be assessedData crossed and potential profiling

Where a DPIA is required, the DPO is involved in the exercise (art. 35.2). The assessment is redone if you add readers, a purpose or a technology - not only at first deployment.

What data should you collect, encode and print?

The right question is not "what can the card hold?" but "what do I need in order to open this door for this person?". The answer comes down to two elements, and everything else has to be justified one by one.

Identifier, name, photo: strictly what is needed

To open a door, a badge number and a list of access rights are enough. The name becomes useful at reception or where a human check takes place. A photo is justified for a named badge checked visually by a guard; it is not justified for a machine read.

NS 42, used as a marker, listed: identity (surname, first name, internal payroll number), department, zones usually authorised, badge number and expiry date, vehicle registration for a car park. Nothing more.

A photo on the card is justified when a guard checks it by eye. For a machine read, it opens no additional door.

To be avoided without compelling necessity: date of birth, social security number, health data, reason for absence, a photo taken at every clock-in. These items open no door and increase exposure in the event of a breach.

Encoding and printing: what travels on the chip

Encoding writes a number into the chip's memory; printing produces what is visible on the card. The two are often conflated in quotations, but not in risk terms.

At SBE Direct, encoding is an option: RFID badges and cards are available blank, with 7 chips to choose from, and personalisation starts once the proof is approved, for delivery in 2 to 3 weeks; blank cards ship within 24 to 48 hours.

Two distinctions to keep in mind before signing:

  • →the factory serial number, unique and immutable, serves as the technical identifier;
  • →the number encoded by the site, often sequential, is predictable: 1042, 1043, 1044. A lost badge can be guessed.

A non-meaningful internal identifier, with no payroll number and no initials, is better than a "readable" number written into the memory. Access rights stay on the server side: the chip must not carry the map of your sensitive zones.

Minimisation: the data not to encode

Article 5.1.c requires data that is adequate, relevant and limited. On a chip, that translates into a simple rule: write nothing that would serve an attacker, and nothing that outlives the employee's departure.

Three safeguards:

  1. No HR data in the memory (payroll number, department, start dates): the badge-to-person link lives in the software, protected by access rights.
  2. No data in clear on an unencrypted carrier: on an LF chip, everything written is readable by anyone.
  3. A controlled encoding file: the file sent to the provider contains names, sometimes photos and numbers. It falls under article 28, with return and documented erasure after production.

Minimisation is not a theoretical precaution: it is what the CNIL held against several employers in its formal notices on photo time clocks.

Access badge and time clock: two processing operations, two purposes

A door badge and a time clock look alike: same carrier, sometimes the same reader. They are nonetheless two distinct processing operations, and conflating them is the first compliance mistake.

Two purposes, two legal bases, two retention periods

The door badge pursues a security purpose: checking that a person is authorised to enter, and investigating an intrusion using the log. The time clock pursues a working time purpose: recording arrival and departure times for payroll. Each has its legal basis, its scope of data and its retention period.

Use Purpose to enter in the record Retention period
Access to premisesSecurity of assets and people: controlling who comes in and out, investigating an intrusionAccess logs: 3 months
Time and attendanceCounting working time and producing the payrollThe period specific to payroll processing and accounting obligations; attendance data is not retained on security grounds
CanteenManaging meals and billing the catering serviceThe period specific to staff catering, distinct from the previous two

Three uses, three lines in the record, three retention periods, three sets of access rights. A single badge never justifies a single processing operation. An access card that also serves as a canteen card is a classic multi-purpose access card case: it calls for three separate lines of reasoning.

Can access logs be used to check working hours?

No. The CNIL is explicit in its guidance on access to premises and the monitoring of working hours: a record from a badge reader intended to monitor entries to and exits from a building for security purposes cannot be used to check employees' working hours. That is a use incompatible with the original purpose, contrary to article 5.1.b.

A GDPR-compliant time clock is therefore not a mere setting in the software. If you want both uses, you need two systems or two clearly separated configurations:

  • →two distinct purposes in the record, with two legal bases;
  • →information telling employees that the door read serves security, and the clock-in serves payroll;
  • →different access rights: the security team does not consult hours, payroll does not go through the doors;
  • →a 3-month period for access logs, a separate period for time and attendance.

Many organisations make do with a single technical flow for both uses. That is precisely what the CNIL characterises as an incompatible use.

How long should badge data be kept?

A single answer would be wrong: there are several periods, because there are several processing operations. The markers below come from NS 42 and from the current CNIL guidance - and they do not say exactly the same thing, which explains a good many errors.

The 5 years in NS 42, and what they still cover

NS 42 (decision no. 02-001 of 8 January 2002) set precise periods:

  • →identification data: 5 years after the employee leaves;
  • →elements relating to the movements of persons: 3 months;
  • →working time monitoring processing: 5 years;
  • →reasons for absence: 5 years, unless legislation provides otherwise;
  • →payment for meals: 3 months for payment data, 5 years where a deduction is made from salary.

The text has had no legal force since 25 May 2018. But the CNIL guidance on access to premises follows comparable logic: identification data stays in the active database for as long as the authorisation lasts; logging data is deleted 3 months after it is recorded; working time monitoring data may be kept in intermediate archiving for up to 5 years.

In other words, the 5 years are not an acquired right for everything: they concern time and attendance and identification, not the trace of your door passages. Confusing the two means keeping movement data three years too long.

Automating the purge, and spotting the blind spots

A period written in a document deletes nothing. The purge has to be technical, scheduled and provable.

The blind spots we come across most often:

  • →backups: a database restored without a filter re-injects expired logs;
  • →exports: a CSV saved "to analyse the flows" on a workstation escapes the purge;
  • →application and directory logs: authenticating to the software produces its own traces, with a different period;
  • →the service provider: the vendor sometimes keeps a supervision copy without anyone having written it down;
  • →visitor badges: the reception register outlives the visit, sometimes for years;
  • →mobile terminals: a handheld reader that stores reads locally creates a second file.

The remedy comes down to four moves: an automatic purge configured on a rolling 90 days (not at quarter end), a purge log kept as evidence, an annual review of the periods in the record, and a deletion clause at contract end with every processor.

Intermediate archiving: a separate zone, not an extension of the database

Intermediate archiving is not a trick for keeping everything. It is a distinct zone, with three rules: restricted access, no day-to-day use, written justification.

In practice, attendance data moved into intermediate archiving must no longer feed HR dashboards or appraisals. It serves to establish a fact in the event of a dispute over working time. If someone consults it for another reason, you are back in the active database - with no legal basis.

HF, UHF or RTLS badge: the technology changes your obligations

The frequency determines the read range. The range determines the level of risk. That is why a technical choice is also discussed with the DPO; our comparison of the differences between RFID HF, UHF and NFC helps set out the uses before the product references.

HF (13.56 MHz): the access control standard

A range of a few centimetres, a deliberate read: the person presents their badge to the reader. It is the easiest case to justify, because the gesture is intentional and localised.

HF covers most building access control and named badges. Two points to check: the chip generation (a Classic does not offer the security of a chip with modern encryption) and the way the keys are managed.

UHF: long range, logistics uses

Count one to several metres, sometimes more with a dedicated antenna. A badge is read through a windscreen, at a car park entrance, or a pallet in a warehouse. The benefit is operational; so is the risk.

A UHF badge is read without its holder having to take it out of their pocket. You no longer control the moment of the read, and a badly placed antenna can pick up passages nearby. If the badge becomes an automatic read point in a corridor, you are sliding towards presence detection - and so towards a monitoring system, with a DPIA to follow.

RTLS: real-time location, the most sensitive case

An RTLS system does not say "went through this door", it says "is in this zone, at this moment", continuously. Active tags, wall anchors, positioning to within a few metres: this is location, not access control.

The CNIL sets a clear limit: the system put in place must not be used to monitor movements inside the premises. RTLS on people therefore calls for a strong business justification (high-risk site, restricted zones, lone working), enhanced information, a DPIA, and alternatives examined seriously. The list in decision no. 2018-327 does in fact target the processing of large-scale location data.

Which technology for which use?

Need Technology Typical range GDPR demands
Open a door, identify a holderHF 13.56 MHzA few centimetresStandard: record of processing, information, security
Car park or barrier access without contactUHF1 to several metresEnhanced: clear information, testing for stray reads
Equipment inventory, logisticsUHF1 to 10 metresModerate where objects are tracked, high where holders are tracked
Locate people continuouslyRTLSA few metres across the siteHigh: DPIA, solid legal basis, specific information

If you have badges to buy, do not pay for range you do not need: it is the best way to reduce the risk. The chip is chosen from the catalogue of RFID badges and cards, once the purpose has been written down.

Securing badges: a GDPR obligation

Article 32 calls for appropriate technical and organisational measures, having regard to the state of the art. On a badge, that formula translates into a concrete question: what happens if someone copies an employee's chip?

Badge cloning: the risk to cover

In 2008, a team of researchers (Nohl, Evans, Starbug and Plötz) reconstructed the Crypto-1 algorithm of the MIFARE Classic by analysing the chip and the protocol, at the USENIX Security conference. That same year, the Radboud University team published "Dismantling MIFARE Classic": key recovery in under a second on ordinary hardware, data read out, cloning demonstrated.

On a 125 kHz chip of the EM4100 type, no cryptographic attack is even needed: the identifier is transmitted in clear. A reader-writer costing a few tens of euros is enough to copy it onto a blank card.

The countermeasures worth having:

  • →a chip with mutual authentication and modern encryption for sensitive zones;
  • →diversified keys per badge, never a single key for the whole estate;
  • →anti-passback and detection of abnormal presentations;
  • →immediate deactivation of a lost badge, with the request traced;
  • →physical protection of the carrier: a bent badge breaks its antenna, a card holder avoids that kind of incident and keeps the chip readable.

Encryption and key diversification

A single key for 800 badges means that one compromised chip opens everything. Diversification consists in deriving one key per badge from a master key: the compromise stays local.

Good practice also plays out on the content: if an attacker reads the chip, they must find nothing exploitable there - no payroll number, no list of zones, no clearance level in clear. Rights are computed on the server side, at every read. To compare chip generations before renewing an estate, our article on the choice between MIFARE DESFire and EM4100 sets out the security differences.

Securing readers and logs

The weak link is not always the card. It is often the badly configured reader or the log left open.

  • →Readers: firmware up to date, configuration locked, cabling protected, no freely accessible reader able to trigger a remote door release. Our selection of badge readers covers multi-frequency USB and long-range UHF; above all, check compatibility with your existing chips.
  • →Administration console: multi-factor authentication, named accounts, access rights reviewed every year.
  • →Logs: log the consultations (who looks at which passage), and not only the door openings. The CNIL has published a dedicated recommendation on logging measures; it applies to your access software too.
  • →Data breach: a mislaid export of logs is still a breach, to be notified to the CNIL within 72 hours if it presents a risk (art. 33).

What an employer may not do with a badge

These limits are not common-sense recommendations: they are written down, and the CNIL has already held them against employers.

No geolocation of employees

A reader records a passage at the door. It is readers multiplied inside that tip the system over into monitoring.

An RFID badge does not locate, it records a passage close to a reader. The temptation is to multiply the readers in order to reconstruct a route. The CNIL closes that door: the system must not be used to monitor movements inside the premises.

The distinction with object tracking is a useful one: our article on the RFID geolocation chip for tracking a tagged object deals with equipment, not with people. Transposing the method to an employee changes the legal regime: geolocation, enhanced information, a DPIA, and often no legal basis at all.

No biometrics and no photo at every clock-in

On 27 August 2020 the CNIL issued formal notices to several employers for systematically photographing their employees at every clock-in, up to four times a day. It found the collection excessive in the light of minimisation and gave them three months to bring themselves into compliance, a conventional time clock being sufficient.

On biometrics, the doctrine is settled: non-biometric systems (badge, code) must be preferred as soon as they provide a sufficient level of security. Biometric authentication is admissible only on a subsidiary basis, with necessity demonstrated, a DPIA, and compliance with the model regulation adopted by decision no. 2019-001 of 10 January 2019.

No continuous monitoring and no automated sanction

Three prohibitions often slip into staff handbooks without anyone noticing.

Monitoring continuously. Readers in every corridor, on every landing, in every meeting room: the system no longer controls access, it tracks activity. That is the case targeted by the 2018 DPIA list under the heading of constantly monitoring employee activity.

Tracking staff representatives. NS 42 explicitly excluded monitoring compliance with delegation hour quotas and any interference with protected employees' freedom of movement. The CNIL guidance repeats that limit.

Imposing a sanction on a raw log. No read at 8.02 am does not prove lateness: remote working, a site visit, a forgotten badge, entry through another door. A sanction based on an uncontextualised log is fragile, and a wholly automated decision falls under article 22 of the GDPR.

The sanctions are not theoretical: article 83 of the GDPR provides for up to 20 million euros or 4 % of worldwide turnover, and the CNIL has formal notices, injunctions and fines at its disposal.

Visitor and contractor badges

A visitor is a data subject like any other, with one particularity: they have signed no employment contract, do not know your internal rules and leave with a badge that sometimes opens more doors than intended.

Visitor register: content and retention

The useful minimum: surname, first name, company, date and time of arrival, name of the person visited, time of departure. NS 42 listed exactly those items, without setting a retention period of their own.

The visitor must be able to read the essentials in ten seconds at reception: purpose, retention, recipients, rights.

Handing over the badge is the moment at which the visitor has to be informed, before the first read and not after.

Two rules are enough to stay within the framework:

  1. Do not collect more: scanning an identity document is justified only where legislation requires it; a vehicle registration is recorded only where the car park is controlled.
  2. Set and write down a retention period: the trace of a visit does not have to outlive the visit. If you have to keep a history for security purposes, choose a short period, justify it in the record and purge automatically.

Returning the badge and ending the visit

A visitor badge must be numbered, not named, and reusable. Its return marks the end of the processing: a badge that is not handed back is deactivated, it does not stay active "just in case".

On the practical side, a badge lanyard keeps the badge visible and makes it easier for a guard to check at a distance, with no electronic read. For contractors, add a confidentiality clause and a separate badge: mixing populations complicates access rights and purges.

The 7 questions to ask your badge supplier

  1. Is the chip encrypted? An identifier in clear can be read with any off-the-shelf reader: ask which encryption applies and to which part of the memory.
  2. Are the keys diversified per badge? A single key for a whole estate means that one compromised chip opens the lot.
  3. Are the badges compatible with our existing readers? Frequency (125 kHz, 13.56 MHz, UHF), protocol and number format: have it confirmed in writing before ordering. Our guide to choosing a badge reader and controlling access helps prepare the question.
  4. Can you encode a neutral identifier? A technical number with no name, department or payroll number avoids circulating personal data on the chip.
  5. Can you supply test samples? One badge per type of reader, before the full run: it is the only way to detect a frequency incompatibility.
  6. What happens to the personalisation file after production? It contains names, photos and sometimes payroll numbers: require return then documented erasure.
  7. What is the procedure for deactivating a lost badge? Timescale, channel, traceability: it is a security measure within the meaning of article 32.

GDPR checklist before ordering your RFID badges

  1. The purpose of each use is written down (access, time and attendance, canteen, car park).
  2. The record of processing activities contains one line per purpose, with legal basis, recipients and retention period.
  3. Employee information is drafted, dated and circulated before installation.
  4. The works council has been informed and consulted before the decision, with a written record.
  5. The DPIA question is settled and documented, biometrics and location included.
  6. The log retention period is set (3 months) and configured in the software, backups included.
  7. The data encoded is limited to a non-meaningful identifier.
  8. The processing agreement covers encoding, hosting and erasure at contract end.
  9. The access rights separate security from payroll, with an annual review.
  10. The deactivation of a lost badge is a written procedure, tested and known to reception.

To move from this list to an order, compare the RFID badges and cards: 7 chips available, encoding as an option, blank cards shipped within 24 to 48 hours, personalisation in 2 to 3 weeks after proof approval, volume pricing from €177.60 excl. VAT per box of 200 cards.

Sources

This guide describes the applicable framework and does not constitute legal advice: validate your system with your DPO or your legal adviser.

Unsure about the chip or the encoding?

Tell us the readers you have in place, your purposes and the volume to equip: we will settle the technology, the encoding and the identifier format with you.

See RFID badges and cards →

FAQ: your questions about RFID badges and the GDPR

Does a badge system still have to be declared to the CNIL?▾

No. The prior declaration regime disappeared with the GDPR, and simplified standard no. 42 has had no legal force since 25 May 2018. You must, on the other hand, keep a record of processing activities, inform employees, consult the works council where there is one, carry out a DPIA if the risk is high and secure the system. That is the file the CNIL asks for in an inspection.

Is a badge with no name on the chip really personal data?▾

Yes. An identifier on its own is pseudonymous, but the link between that number and a person exists in your software or in your encoding file. That link is enough to make the data personal within the meaning of article 4.1 of the GDPR. Anonymisation would mean permanently deleting that link - which would make the badge useless for opening a named door.

How long should access logs be kept?▾

Three months after they are recorded, according to the CNIL guidance on access to premises and the monitoring of working hours. That period concerns the logging data produced by the system. Working time monitoring data belongs to another processing operation and may be kept in intermediate archiving for up to 5 years. Do not confuse the two: a door log kept for five years is a breach of the rules.

Does the works council have to be consulted before installing badges?▾

Yes, in companies with at least 50 employees: article L2312-38 of the French Labour Code requires the works council to be informed and consulted before the decision to implement any means of monitoring employee activity, and informed of automated personnel management processing. Below 50 employees, the prior individual information required by article L1222-4 still applies.

Can an employee's movements be tracked with an RFID badge?▾

No, not continuously. A badge is only read close to a reader: it produces passage points, not a position. Multiplying readers to reconstruct a route amounts to geolocation, which the CNIL rules out inside the premises. Systematic monitoring requires a solid legal basis, specific information and a DPIA - and remains open to challenge before a court.

Who may consult badge data?▾

Only those whose role requires it, for the declared purpose. Access logs are consulted in the event of a security incident, by the security team; attendance data, by payroll and the manager concerned. The works council does not access individual data: it is informed and consulted on the system. Any consultation must be limited, traced and covered by written authorisation.

What does an employer risk if its badge system is not compliant?▾

A formal notice, an injunction, and a fine of up to 20 million euros or 4 % of worldwide turnover (art. 83 of the GDPR). In practice, the CNIL starts by asking for an account of the record of processing, the information given and the retention periods; the photo time clock cases of 2020 were settled by formal notices with a three-month deadline. The employment risk comes on top: a disproportionate system can be challenged before a court.

Melissa Oumaouche
See the author's articles
Melissa Oumaouche

With over 5 years of experience in creating content optimized for search engines, Mélissa is currently Marketing & Product Manager at SBE Direct, where she leads the product catalogue positioning across the e-commerce website and marketplaces, as well as the SEO content strategy in coordination with the marketing team she oversees.

We use cookies to improve your experience.