Data Protection Impact Assessment

This record summarises why the operator of the Attendees attendance system, Ing. Matěj Kmínek, Company ID 02877961, does not consider it necessary to carry out a data protection impact assessment (DPIA) under Article 35 of the General Data Protection Regulation (GDPR), and serves as supporting material for customers who carry out their own assessment as controllers.

What was assessed#

The processing of data about customers' employees in the attendance system: recording arrivals and departures by touch on the terminal, from a phone or with an RFID chip, calculating working time and overtime, the vehicle logbook and bulk e-mails. The criteria are based on Article 35(3) GDPR, on the guidelines of the Article 29 Working Party (WP 248 rev.01) and on the list of kinds of processing that, according to the Office for Personal Data Protection (ÚOOÚ), require an impact assessment.

Why an impact assessment is not necessary#

• No biometric data. The system does not use fingerprints, facial recognition or any other biometric authentication. An employee identifies themselves by touching their name, with a password or with an RFID chip, whose identifier is not biometric data.
• No location tracking. The system does not determine the location of a device (by GPS or otherwise). The vehicle logbook contains only the places the employee enters themselves.
• No special categories of data. The system does not store health data, diagnoses or any other data under Article 9 GDPR. It records only the type of absence (for example "sickness" or "doctor"), which the employer needs to fulfil its obligations under employment law.
• No systematic monitoring of publicly accessible areas. The terminal at the entrance does not record images or sound and does not monitor the area; it records only the actions the employee performs themselves.
• No automated decision-making with legal effects; the system calculates attendance, while decisions on pay and on consequences under employment law remain with the employer.
• The scope and technology correspond to the ordinary recording of working time that the Labour Code requires of the employer (Section 96 of the Labour Code); this involves neither new technologies nor the combining of data from multiple sources.

The processing therefore meets at most one of the WP29 criteria (data about employees as vulnerable data subjects in relation to their employer), whereas the need for an impact assessment is usually inferred when two or more criteria are met.

Recommendation to customers#

The customer, as controller, assesses its own specific deployment. An impact assessment may be appropriate if the customer uses the system beyond ordinary attendance recording, for example to evaluate employee performance, or if it were to store health data in the notes.

Review#

The operator reviews this record once a year and always before introducing a feature that could increase the risk (for example biometrics, location tracking or a new connection to other systems).