How we use your face at work
We use face recognition on the clock-in tablet so we know who is starting and finishing a shift. This page explains what we take, why we take it, who can see it, and how to say no.what to do if it does not work for you. If English is not your first language, ask your manager and we will go through it with you.
What we take
- Three photos of your face. We take them on the tablet when you first sign up. It takes about a minute.
- A face template. The system turns your photos into a long set of numbers. This is called a template. It is not a picture, and it cannot be turned back into one.
- A photo each time you clock in or out with your face. The tablet keeps the picture from the moment it recognised you. It is a picture of what the camera sees, so it can show what is behind you.
- Checks by the camera. While the clock-in screen is open, the tablet looks through its camera every few seconds and checks any face it sees against the faces it knows. It does this for anyone standing in front of it. We do not keep those pictures. We keep only the one from the moment you clock in or out.
- A match score. Each time, the system records a number for how well your face matched.
The tablet also checks that it is at the facility. It checks that it is on the facility’s internet connection. It checks its own location. It checks for a Bluetooth beacon placed near it. That check is about the tablet, not about you. The result is saved with each clock-in and clock-out, and your manager sees a note on your timesheet if the check fails. We do not track where you are when you are not at work.
We do not try to work out your age, your mood, your health, your ethnicity or anything else about you from your face.
Why we use it
- To be sure the right person is clocking in and out.
- So the hours on your timesheet are correct and you are paid correctly.
- To stop somebody clocking in for someone who is not here.
- One of your three photos is also used as your profile picture, so managers and other staff can see who is who.
- To keep it working for you. If the tablet starts having trouble recognising you, your manager may ask you to take your photos again.
We do not use your face for anything else. We do not use it to watch you during your shift, to check how fast you work, or to see where you are in the building.
No law says we must collect your face. We do it because it makes the time records more reliable. This is not a trial: the system is in normal use.
The system is not perfect. Sometimes it does not recognise someone, and it can work less well for some people than for others. If it does not recognise you, that is the system’s fault, not yours. Tell a manager, and they will record your hours for payroll by hand.
Where it is kept
Your photos and your face template are kept on Amazon Web Services (AWS) computers in Sydney, Australia.
Everything is encrypted. That means it is locked, so people who are not allowed to see it cannot read it.
Even though it is kept in Australia, this facility is still responsible for it under New Zealand law.
How long we keep it
- Your three photos and your face template: for as long as you work here. When you leave, we delete them.
- Your clock-in and clock-out photos: 90 days, then the system deletes them automatically. This is the same whether you still work here or have left.
- If you switch to a PIN, your face template and your three photos are deleted straight away. Clock-in and clock-out photos already taken stay until they are 90 days old.
- Your clock-in and clock-out times, the match scores and the result of the tablet’s location check stay with your pay records. The law says we must keep pay records. These are numbers and dates, not pictures.
Who can see it
- Your manager. Your clock-in and clock-out photos show on your timesheet, so they can check the hours before payroll. They also see how well your face matched.
- Your manager, again. One of your three photos is your profile picture in the app your manager and the roster planner use. A manager who unlocks the enrolment screen on the tablet can see all three.
- Anyone at the tablet. When the tablet recognises you — or thinks it does — it shows your name, your job and your profile picture on the screen, so you can check it has the right person.
- Other staff. The staff list on the tablet shows everyone’s name, profile picture, job and staff number, whether they are clocked in, and whether they use their face or a PIN.
- Birra Bytes. This is the company that built the system and keeps it running. They can see it only when they are fixing a problem.
- Amazon Web Services stores it and matches the faces for us.
- Nobody else. We do not sell it. We do not put it on the internet. We do not give it to anyone else unless you ask us to, or the law says we must (for example, a court order).
Your choice
Is there another way to clock in?
- You can use a PIN instead. You type your own number on the tablet to clock in and out.
- You can change your mind at any time, even after you have signed up. After you clock in or out, tap “Change how you clock in” on the tablet. That screen only shows for a few seconds. Your face template and your three photos are deleted straight away, and you choose a PIN.
- If you later switch back to face recognition, your PIN stays as a back-up.
- Your job, your shifts, your hours and your pay do not change because of your choice.
- If you use a PIN, the camera may still see you as you walk up to the tablet, until you tap “Use my PIN instead”. The tablet does not know your face, and it keeps no picture of you.
- If face recognition does not work for you at all — for example because of a medical condition, a disability, or a facial difference — tell [name, job title]. We will agree another way with you, such as recording your hours by hand.
- If this facility changes this later, we will tell you.
Your rights
- You can ask to see the information we hold about you.
- You can ask us to correct it if it is wrong.
- You can ask us to delete your face template and your photos. You will then use a PIN. The tablet will then not know you, and we will record your hours by hand.
We will answer you within 20 working days.
If we do not agree to correct something, you can ask us to attach your own statement to it, saying what you think is wrong. We have to do that.
This facility has written down why face recognition is needed and how you are protected. You can ask to see that document at any time. You do not have to give a reason.
Who to ask
If you are not happy with our answer, you can contact the Office of the Privacy Commissioner — privacy.org.nz · 0800 803 909.