Quick answer

Philine employers may use fingerprint, facial-recognition, or other biometric attendance systems, but employees retain rights over their personal data. The employer must establish a lawful basis for processing, explain the system’s purposes, collect only proportionate information, protect it, and retain it only for justified periods. A company policy or signed consent form does not, by itself, satisfy all these requirements.

Consent is not always required, and employees do not automatically have an unconditional right to refuse biometric attendance. The answer depends on the information collected, the employer’s legal basis, the system’s necessity, and the safeguards in place. The governing framework is Republic Act No. 10173, the Data Privacy Act of 2012, its implementing rules, and National Privacy Commission (NPC) issuances. privacy.gov.ph

What information does a biometric attendance system protect?

Privacy protection extends beyond the fingerprint or face initially captured. It can cover identifiable enrollment images, biometric templates used for matching, employee identifiers, attendance logs, and records linking a scan to a particular worker.

Calling a stored record a “template,” “code,” or “encrypted file” does not automatically make it anonymous. If it identifies an employee, directly or through other information, it remains personal information.

Biometric information is not automatically sensitive personal information simply because it is biometric. Philippine law defines specific sensitive-information categories. Health information, genetic information, and certain government-issued identifiers fall within those categories.

In NPC Advisory Opinion No. 2023-025, the NPC treated a facial photograph as personal information while recognizing that a dataset containing sensitive information requires the corresponding legal basis. Employers must therefore examine the actual data and processing involved—for example, whether an attendance system also collects health information or government-ID details. privacy.gov.ph

When is biometric attendance lawful?

The employer needs an applicable legal basis

Section 12 of the Data Privacy Act recognizes several grounds for processing ordinary personal information. Depending on the circumstances, an employer may rely on consent, necessity for an employment contract, compliance with a legal obligation, or legitimate interests.

These grounds have conditions. An obligation to maintain employment records does not, without further analysis, establish that collecting fingerprints or facial templates is necessary. Likewise, writing a biometric requirement into a handbook does not remove the need to assess proportionality. lawphil.net

Legitimate interest requires an assessment

Under NPC Circular No. 2023-07, an employer relying on legitimate interest must assess:

Purpose: What specific, lawful interest does the system serve?
Necessity: Is the chosen processing suitable, necessary, and proportionate?
Balance: Does that interest outweigh the impact on employees’ fundamental rights and freedoms?

Accurate timekeeping or preventing attendance fraud may explain an employer’s objective. They do not automatically justify every feature of a system.

A practical application of these tests is to examine whether cards, PINs, supervised attendance, or another arrangement could adequately meet the identified need with less intrusive processing. The answer will depend on the workplace.

Legitimate interest cannot serve as the legal basis for processing sensitive personal information. That processing must meet an applicable condition under Section 13. privacy.gov.ph

Does signing a consent form settle the issue?

No. Where the employer relies on consent, it must be freely given, specific, informed, and properly evidenced.

NPC Circular No. 2023-04 states that pressure, intimidation, or adverse consequences for refusing consent can undermine its validity. In an employment setting, a threat of discipline for refusing supposedly voluntary consent therefore raises a serious concern.

The employer should distinguish between:

Processing it considers necessary under another lawful basis; and
Optional processing for which it seeks genuine consent.

A privacy notice explains what happens to your data. A consent form asks for permission. Acknowledging receipt of a notice is not necessarily consent.

If consent is the basis, you may withdraw it. Where no other lawful basis supports continued processing, the employer must stop without undue delay. Withdrawal does not retroactively invalidate processing that was lawful before withdrawal. privacy.gov.ph

What should employees be told?

Ask for the attendance system’s privacy notice and the Data Protection Officer’s contact details. The explanation should be understandable and address:

What is collected: images, templates, timestamps, location, or other information.
Why each category is needed and the legal basis relied upon.
How enrollment, matching, storage, and attendance decisions work.
Who receives or accesses the information, including service providers.
How long each category is retained.
How employees can request access, correction, or other remedies.
Whether automated processing can significantly affect pay or employment decisions.

The implementing rules generally require relevant information before data enters the system or at the next practical opportunity. A vague statement that information is collected “for company purposes” is inadequate to explain a detailed biometric system. privacy.gov.ph

What rights can employees exercise?

Access your own information

You can request confirmation of processing and access to your personal information, together with relevant details about its use, recipients, retention, and automated processing.

For an attendance dispute, identify the particular dates, shifts, and records requested. This is more useful than an unrestricted demand for the company’s entire database.

The right concerns your information; it does not generally entitle you to coworkers’ records or unrestricted access to the attendance software. See the NPC’s guidance on access rights. privacy.gov.ph

Correct inaccurate attendance records

You can dispute errors in your personal data. If a scanner fails, records the wrong time, or associates an entry with the wrong employee, request correction and provide supporting evidence.

Ask HR to review the underlying facts before relying on the disputed record for payroll or disciplinary action. The privacy right to correction does not itself resolve every wage or disciplinary dispute, but it provides a route to challenge inaccurate information. privacy.gov.ph

Object to processing

The NPC recognizes objections to processing based on consent or legitimate interest, including certain automated processing and profiling. Its guidance requires an employer continuing despite an objection to establish and communicate the applicable lawful basis or compelling reason.

An objection is not automatically a blanket exemption from attendance requirements. Put the objection in writing, explain the particular concern, and request an interim attendance arrangement while it is assessed. See the NPC’s right-to-object guidance. privacy.gov.ph

Request erasure or blocking where justified

Erasure or blocking may be available where data was unlawfully obtained, is no longer necessary, or is otherwise processed unlawfully. It is not an unrestricted right to erase records still legitimately needed for legal obligations or claims. privacy.gov.ph

Know the response period

NPC Advisory No. 2021-01 provides for compliance with data-rights requests without undue delay, generally within 30 working days after receipt of the request and necessary documentation. Complex or numerous requests may justify up to 15 additional working days, with notice explaining the extension.

Government agencies are subject to the applicable response requirements under Republic Act No. 11032 and its implementing rules. These periods are distinct from the complaint procedure discussed below. privacy.gov.ph

How long may biometric information be kept?

There is no single retention period in the Data Privacy Act for every workplace biometric system. Retention must be justified by the purpose, applicable legal requirements, legitimate business needs, or legal claims. Keeping identifiable information indefinitely for an unspecified future use is not permitted.

Attendance records and biometric templates need separate retention analysis. An employer’s reason for retaining payroll-related attendance logs does not automatically establish a reason to retain the former employee’s biometric template for the same period.

When leaving employment, ask when enrollment images and templates will be deleted, what records will remain, and why. Do not assume either that everything must disappear on your last day or that the employer may keep everything permanently. lawphil.net

What security and vendor safeguards are required?

NPC Circular No. 2023-06 requires privacy and security measures in both government and private-sector processing. Relevant measures include:

A privacy impact assessment covering the system and its risks.
Access limited to authorized personnel who need the information.
Appropriate authentication, monitoring, and security controls.
Documented retention and secure disposal procedures.
Contracts and controls governing service-provider access.

The employer should also assess purchased, ready-made attendance systems. Buying a device does not establish compliance.

Using a cloud provider or an outside attendance vendor does not remove the employer’s responsibilities. Ask where information is stored, who can access it, and how deletion and incident response work. Features without a lawful basis or incompatible with privacy principles must be disabled. Circular_16-01Repeal_30Nov2023_CLEAN[6083]

Attendance collection also does not automatically authorize unrelated surveillance, advertising, or reuse of employees’ facial data. Any additional processing needs its own legal and privacy assessment. privacy.gov.ph

What employees should do if they have concerns

Get the documents. Obtain the privacy notice, enrollment instructions, consent form, attendance policy, and relevant employment or collective-agreement provisions.
Identify the specific problem. Examples include unexplained collection, excessive app permissions, inaccurate attendance, unauthorized disclosure, or continued retention after separation.
Write to the DPO and appropriate HR contact. State the facts, dates, requested explanation, and remedy sought.
Protect your attendance position. If enrollment is disputed or scanning fails, promptly request an approved alternative and document your availability and actual work.
Keep proof of delivery and the response. Preserve email acknowledgments, received copies, or delivery records.
Escalate through the appropriate channel. Privacy and employment issues may require different remedies.

Preserve copies of notices and forms, screenshots of your own attendance entries, error messages, payslips, work schedules, relevant correspondence, and any disciplinary notice. Record when you first learned of the issue.

Keep evidence lawfully. Do not access restricted systems, copy coworkers’ biometric information, or publicly post sensitive records to demonstrate the problem.

How to raise a complaint with the National Privacy Commission

First give the employer an opportunity to address it

Under Rule II, Section 2 of the 2021 NPC Rules of Procedure, as amended, ordinarily you must first notify the employer or other concerned entity in writing about the alleged violation.

You must show that it failed to take timely or appropriate action, or that it did not respond within 15 calendar days from receipt. Keep proof.

This is a complaint prerequisite, not a universal 15-day deadline for completing every access request. The NPC may waive the prerequisite for established good cause or serious circumstances, including grave and irreparable harm, lack of an adequate remedy, or patently illegal conduct. Waiver is discretionary. privacy.gov.ph

Prepare a formal, supported complaint

The NPC’s complaint guidance calls for a notarized complaint form or verified complaint, supporting evidence, and relevant witness affidavits. Explain the parties, events, alleged violation, and relief requested; attach your prior written complaint and proof of receipt.

Filing modes include personal submission, registered mail, courier, and electronic mail as authorized by the Commission. Follow the NPC’s current instructions on copies, electronic format, and filing arrangements. An informal inquiry should not be assumed to constitute a properly filed complaint. privacy.gov.ph

Applicable filing fees must be addressed. The rules recognize exemptions, including for qualifying indigent complainants, and discretionary waiver for good cause. privacy.gov.ph

What if biometric information is leaked?

Report suspected exposure to the DPO promptly and preserve the breach notice or other evidence.

Not every security incident triggers mandatory notification. The NPC’s rules consider whether information capable of enabling identity fraud—including biometric data—was reasonably believed acquired by an unauthorized person and whether serious harm is likely.

Where mandatory notification applies, the general period is 72 hours from knowledge or reasonable belief that the qualifying breach occurred, subject to the rules governing delay, postponement, or exemption. This is the controller’s notification obligation, not the employee’s complaint deadline. The NPC’s breach-reporting guidance explains the conditions. privacy.gov.ph

Ask what information was affected, how exposure was contained, what protection is offered, and whether the compromised biometric credential will continue to be used.

When help is urgent

Seek prompt legal or union assistance if there is a threatened dismissal, suspension, significant pay loss, suspected identity misuse, continuing disclosure, or imminent destruction of relevant evidence. Do not let an internal privacy exchange cause you to miss a deadline in a disciplinary notice or legal proceeding.

For private-sector employment concerns, the DOLE Assistance for Request Management System provides a channel for requesting Single Entry Approach assistance. A labor request and an NPC privacy complaint serve different purposes; one should not be assumed to resolve the other. arms.dole.gov.ph

Common mistakes to avoid

Treating consent as a complete waiver. A signature does not excuse excessive collection or inadequate security.
Assuming refusal has no employment consequences. Obtain advice and request an approved attendance alternative.
Waiting until payroll closes to report a failed scan. Raise errors promptly and retain evidence of work.
Demanding deletion of all records without distinguishing them. Identify templates, images, attendance logs, and payroll records separately.
Relying only on verbal complaints. Written notice and proof of receipt matter when escalating.

Frequently asked questions

Can I insist on a non-biometric alternative?

You can request one and explain your privacy, accessibility, or reliability concerns. Whether the employer must provide it depends on the processing’s lawful basis, necessity, proportionality, and any other applicable obligations. The Data Privacy Act does not create an automatic alternative-attendance entitlement for every employee. privacy.gov.ph

Are small employers exempt?

No general exemption removes employees’ privacy rights merely because the business is small.

Registration rules are a separate issue. NPC Circular No. 2022-04 includes mandatory registration triggers involving 250 or more personnel, sensitive information concerning 1,000 or more individuals, or processing likely to risk people’s rights and freedoms. It also requires registration for systems involving automated decision-making or profiling. Falling below a numerical threshold does not necessarily avoid registration, much less the underlying privacy obligations. privacy.gov.ph

What if the scanner marks me absent when I worked?

Immediately request correction, identify the affected shift, and provide supporting records. Ask for review of any resulting payroll or disciplinary consequence. An inaccurate record can be challenged through the right to rectification. privacy.gov.ph

Can I obtain my coworkers’ attendance records to prove unequal treatment?

Your access right generally concerns your own information. Requests involving other employees require separate consideration of their privacy and the applicable legal process. Preserve evidence already lawfully available to you and seek advice on obtaining additional records properly. privacy.gov.ph

This article provides general Philippine legal information, not advice on a particular employment dispute. The applicable outcome depends on the system, documents, facts, and legal basis involved. Official sources checked on 23 October 2026.

Double-click to edit...