Biometric attendance and employee privacy: practical points in Morocco

Faces and fingerprints are biometric data: they identify a person permanently, and cannot be “changed” like a password. An employer installing a biometric terminal therefore processes sensitive data, governed in Morocco by Law no. 09-08 and supervised by the national data protection authority, the CNDP.

This article gives practical reference points, not legal advice. Have your setup reviewed by an adviser and refer to the CNDP’s current texts and forms. Outside Morocco, other rules apply.

The employer is the data controller

The company decides to track attendance and how: it is the data controller. Neither the terminal manufacturer nor the software vendor carries that responsibility for it. In practice, the employer completes the formalities, informs employees and sets the access and retention rules.

Prior authorisation for biometrics

In its practical sheet on biometric devices, the CNDP states that installing such a device requires an authorisation request. The file includes in particular a description of the device, a compliance undertaking, and the model information notice given to the people concerned. This is done before going live.

The same sheet recalls an important principle: biometric data should not be kept in raw form; a limited number of characteristics (the template) is extracted. Check with the manufacturer how your terminal stores templates.

Informing employees

Before collection, each employee should know, in writing:

• the purpose (attendance and working-time management);
• the data used (identity, punches, biometric template);
• the retention period;
• who has access;
• how to exercise their rights (access, rectification, objection) and whom to contact.

An internal memo and a notice board are the usual channels.

Offering an alternative

Offering another way to punch (card, code) to employees who cannot or prefer not to use biometrics is good practice, and often a point that gets examined. Most terminals combine several methods.

Limiting data and its circulation

Questions to ask about your system:

1. Where are the templates? Only on the terminal, or copied to a PC or server?
2. Are passage photos recorded? Are they needed?
3. Who sees what in the software? Does a team leader need national ID numbers or addresses?
4. How long are raw events kept?
5. What happens to the template of an employee who leaves?

How Atlaxys Tempo handles these points

• Faces and fingerprints stay on the terminal by default. An encrypted copy in Tempo exists only if the employer turns the option on (off by default), after checking their authorisation covers it; turning it off deletes every copy.
• Event photos are never requested from the terminal.
• Before capturing a face or fingerprint from Tempo, the operator must confirm the employee was informed and agreed; the confirmation is written to the audit trail.
• The CNDP reference and the employee notice are recorded in the Privacy screen; raw event retention is configurable (24 months by default).
• Personal information is hidden from most roles; the national ID number is encrypted.
• When someone leaves, “also remove from terminals” deletes their face, fingerprints and cards from the terminals.
• Nothing is sent over the internet, and Atlaxys Consulting has no remote access to the data.

Tempo is not “compliant” by itself: it helps the employer document and apply their process. Technical details are on the roles, audit and backups page.

Checklist

• CNDP authorisation request filed before go-live
• Information notice given and displayed
• An alternative to biometrics offered
• Limited roles, personal information protected
• Retention period set
• Leaver procedure (removal from terminals) defined

These points also appear in our pre-installation checklist.