Privacy and access control

March 2010 Access Control & Identity Management

Employee privacy may soon become a thorn in the side of South African businesses, Kathleen Carroll offers advice from the USA.

Kathleen Carroll, director government relations, HID
Kathleen Carroll, director government relations, HID

For the past four years, HID Global has been working to educate policymakers about RFID technology and address the concerns they have raised about its potential impact on privacy rights. Despite these efforts, anti-RFID legislation continues to be introduced in state legislatures nationwide.

Some legislation would ban the use of the technology in such applications as access control systems. In other cases, the legislation would require employers to label each access control badge with a warning that the badge contains RFID technology. Some state legislation even goes so far as to give employees the right to refuse to carry an access control badge that uses RFID.

Smartcards have not been exempted from the proposed bans or regulations because definitions of RFID often include the phrase 'any technology that communicates via radio waves', thus implicating smartcards. The good news is that, to date, the most onerous legislation proposed has failed to pass.

Privacy and security

Thus the RFID industry and users of the technology have an opportunity to avert a legislative solution and benefit in other ways by taking steps to address privacy proactively. For example, employers that use RFID-based access control systems (PACS) can better protect employees’ personally identifiable information (PII) and reduce their potential exposure to liability.

First and foremost, conducting a privacy impact assessment (PIA) can help determine where privacy might be implicated in the deployment of a PACS. To view an example of how to conduct a PIA, The Department of Homeland Security is a great place to start. By asking questions about how PII is collected or used in a system, users can decide whether the PII is needed and if it is, how best to protect it.

A PIA might reveal that PACS databases often contain PII if information such as an employee’s home address, telephone number, car licence plate number, or the like is included. Following some basic privacy principles can help avoid problems or liability:

* Minimise use of personally identifiable information (PII).

* Limit the length of time that data is retained.

* Use available technology solutions such as encryption to protect PII.

* Control access to data collected (clear audit trail if there is a breach).

* Establish mitigation procedures if a breach occurs.

Business justification

Beyond PII, PACS raise a potential privacy concern with the ability to monitor employee movements. For example, when an employee arrives in the morning, leaves for lunch or goes home at the end of the day. The key element to remember is that any monitoring should be based on a legitimate business justification, and in most cases, limited to work hours. If the system is to be used for monitoring location, employees’ written consent should be obtained before any monitoring takes place.

Because smartcards are facilitating the convergence of physical and logical access control, understanding the privacy concerns associated with such use can help companies avoid any pitfalls. Creating a privacy policy for both the employer and the employee can help drive awareness and compliance with the principles outlined here.

Communicating those policies and routinely reiterating them can help protect both the employer and the employee. The policy should be signed by each employee and then placed in the employee’s personnel file. Protecting employee privacy is a sound business decision that can create goodwill and promote employee satisfaction.

For more information contact John Lakin, HID Global, +27 (0)72 923 9426,,


Share this article:
Share via emailShare via LinkedInPrint this page

Further reading:

A contact-free hotel experience
Issue 7 2020, Technews Publishing , Access Control & Identity Management
Check-in and go straight to your room without stopping at the reception desk at Hotel Sky in Sandton and Cape Town.

HID Global acquires Access-IS
Issue 7 2020, HID Global , News
HID Global acquires provider of miniaturised reader devices that combine key technologies for mission-critical markets.

AI digitises coronavirus management
Issue 7 2020, NEC XON , Access Control & Identity Management
NEC XON is using NeoFace Watch and specialised thermography cameras to measure temperature and identify employees and visitors.

Combining visual and IR face recognition
Issue 7 2020, Suprema , Access Control & Identity Management
The FaceStation F2 offers face recognition and anti-spoofing performance.

Anviz unveils FaceDeep5
Issue 7 2020, ANVIZ SA , Access Control & Identity Management
Anviz Global has unveiled its new touchless facial recognition identity management and IoT biometric device.

Touchless biometric options
Issue 6 2020, Entry Pro , Access Control & Identity Management
When it comes to estate access control management, the foremost topic of conversation at the moment seems to be the importance of touchless biometrics.

Fast access to Kevro production facilities
Issue 6 2020, Turnstar Systems , Access Control & Identity Management
Employee and visitor access at Kevro’s Linbro Park premises in Gauteng is controlled through eight Dynamic Drop Arm Barriers from Turnstar.

Know your facial recognition temperature scanner
Issue 6 2020, ViRDI Distribution SA , Access Control & Identity Management
Facial recognition with temperature measurement is, for the most part, available in one of two technologies – thermopile and thermography/IRT.

Suprema integrates with Paxton’s Net2 access control
Issue 6 2020, Suprema , Access Control & Identity Management
Suprema has announced it has integrated its devices with Paxton’s access control system, Net2.

Contactless check-in at hotels
Issue 6 2020 , Access Control & Identity Management
Onity has delivered the DirectKey mobile access solution to hotel chains around the globe, which allows for contactless check-in and property access.