Facial Recognition at the Factory Gate

Employee consent is fragile in China because of the subordination between employer and employee. Consent must be voluntary and explicit under Article 14, and an employee who fears disadvantage may not be giving genuine choice. Article 13(2) allows processing necessary for HR management under lawfully formulated labor rules and collective contracts, but facial recognition is sensitive PI. Article 29 requires separate consent for sensitive PI unless a law or administrative regulation provides otherwise. Article 13(2) is not such a law. So the employer cannot rely on the generic onboarding clause or on Article 13(2) alone. It should first apply necessity and proportionality: is facial recognition the least intrusive way to stop buddy punching? A badge plus random spot checks may suffice. If the employer still proceeds, it should conduct a DPIA, adopt a written labor rule through the democratic procedure, offer a non-biometric alternative, make refusal free of retaliation, obtain separate consent, limit retention, store templates locally, and restrict access. The German works council's consent-first preference is relevant to EU law and employee relations, but it does not substitute for PIPL requirements. The safest design is optional facial recognition with an equivalent fallback, not a mandatory system.

Start with the data categories and volumes. Attendance logs for 3,200 employees are ordinary PI, below the 100,000-person threshold in the March 2024 cross-border provisions, so the small-volume exemption would cover them if they were the only data. The health check results are sensitive PI. At 3,200 employees, the sensitive-PI count is below 10,000, so the transfer does not trigger the mandatory security assessment on volume grounds. The employer could use a standard contract or certification if no exemption applies. The HR exemption is relevant: the 2024 provisions exempt transfers necessary to conclude or perform a contract with the individual, or for HR management under lawfully formulated labor rules and collective contracts, from security assessment, standard contract and certification. That exemption may cover the Workday HR data if the labor rules are properly adopted and the transfer is genuinely necessary. It does not waive the Article 39 notice and separate consent for cross-border transfer, the Article 55 impact assessment, or the Article 29 separate consent for sensitive health data. It also does not apply if the company is a CIIO or transfers important data. The employer should document the exemption analysis, keep the data minimal, and avoid exporting health data that global analytics does not need.

A DPIA is mandatory under Article 55 for sensitive PI, automated decision-making, entrusting processing and cross-border transfer. Here all four are present. The assessment should describe the facial templates and health data, the necessity of each purpose, the alternatives considered, the retention periods, the recipients in the EU, the security measures, and the risks to employees and how they are mitigated. Article 56 requires the report and processing records to be kept for at least three years. For the local cloud vendor, the relationship is likely entrustment under Article 21 if the vendor only hosts and administers the system on the manufacturer's instructions. The written agreement must specify the purpose, duration, processing method, data categories, security measures and both parties' rights and obligations. The manufacturer must supervise the vendor, restrict administrator access, require confidentiality, prohibit subcontracting without approval, require breach notification, and require deletion or return at the end. If the vendor uses the data for its own purposes, it is a separate handler and Article 23 separate consent is needed. The manufacturer should also apply the Multi-Level Protection Scheme and access logging. For the EU transfer, check the GDPR transfer mechanism separately; PIPL compliance does not satisfy EU law.