Designing Biometric Attendance People Will Consent To

Before any hardware decision, three questions need written answers. What exactly is the purpose, stated narrowly enough that scope creep is visible when it happens. How long is the data retained, as a date rather than a vague policy. And what is the non-biometric path for someone who declines, including whether it is equally fast and equally private. If those three answers are not settled, the project is not ready, and we say so before quoting.

The DPDP Act 2023 sets the frame. Biometric data processed for attendance is personal data. It requires a clear, itemised notice in plain language and in languages the data principal understands, which in most Indian deployments means at least Hindi and English and often a regional language. It requires consent that is free, specific, informed and unconditional, and it gives the individual a right to withdraw that consent and to have data erased. Withdrawal has to actually work, which means the erasure path must be built and tested, not described in a policy document.

Architecture follows from that. We store a mathematical template rather than a facial image. Templates are not reversible into a usable photograph and are far less useful to an attacker. Matching runs on the edge device where possible, so raw frames never leave the premises. Anti-spoofing runs passively against printed photographs, screen replays and video loops, tested against the categories described in ISO/IEC 30107-3 rather than asserted in a brochure.

Consent under duress is the fundamental problem and no amount of engineering removes it. When an employer or an institution asks, refusal carries a social and sometimes a career cost, so consent in these settings is never fully free. The honest response is to reduce what is at stake: collect the minimum, retain it for the shortest useful period, offer a genuinely equal alternative, and never let biometric enrolment status become visible to a supervisor as a compliance metric. The second failure is measuring the wrong thing. Vendors quote a single accuracy figure. That figure is an average, and averages conceal the entire issue. Large-scale independent evaluations have repeatedly found false match and false non-match rates varying by an order of magnitude across demographic groups, with darker skin tones, women and both the youngest and oldest age bands generally faring worse. If you never measure by group, you will never see that a specific set of your users is being marked absent twice a week while the overall number looks excellent.

Operational failures compound this. Enrolment done quickly in poor lighting creates a low-quality template that produces rejections for months, and the affected user is blamed rather than re-enrolled. Cameras positioned for average height fail for people significantly shorter or taller. Then there is scope creep, which is the most common ending for these systems. An attendance deployment acquires a dwell-time report, then a productivity dashboard, then a manager who wants to know who left early. Each step is small and none of them are covered by the original consent. We build purpose separation into the data model to make that expansion require a deliberate, documented decision rather than a configuration toggle. And we decline some briefs outright: emotion recognition, attention scoring in classrooms, and covert enrolment. The validation is weak, the bias is documented, and the harm falls on people who cannot argue back.