Where Clock-In Becomes Monitoring

Geofenced clock-in is one of the lighter uses of location data. It stops being that at four specific points.

Background collection

An app that can see location when it is not being used is no longer checking a punch; it is tracking a person who also punches.

This is the single line that matters, and it is a permission setting.

"While using the app" is sufficient for the function.

Check what the product requests, and verify what arrives when the app is closed for a day.

Continuous tracking during the shift

Offered as a feature in several products, framed as knowing where staff are.

For a fixed workplace it answers nothing — they are at the workplace, which the punch already established.

For visiting roles it produces a route where attendance needed twelve points.

Ask what it would inform. Usually nothing, which means the request is about reassurance.

Automatic clock-out on leaving the boundary

Sounds efficient.

Requires continuous monitoring to work, because the system must watch the boundary constantly.

And it misfires: a position drift clocks someone out while they are working, and they discover it at the end of the week.

The convenience is real and the cost is the whole narrow justification, which is a poor trade.

Punch photographs

A picture at every clock-in, to confirm identity.

Effective against buddy punching and a substantial escalation.

Whether it is biometric data depends on how it is processed — stored for a human to glance at, or matched against a template. The second carries a higher bar and the marketing calls both the same thing.

Decide it separately, record the decision, and do not let it arrive bundled.

The pattern

Each of the four is offered as an improvement to the same product.

Each removes the thing that made the deployment easy to justify.

And each arrives without a decision unless someone is watching for it.

What to do

Write down which features are enabled at go-live, with the state of each.

Check after every vendor release, because features arrive switched on.

Say in the notice what the system does not do, which commits you and is checkable by anyone with a phone.

And when one of the four is proposed, ask what decision it would inform — which is the question that resolves most of them.

Record what is enabled at go-live

The baseline that makes a later change detectable.

List every capture setting and its state on the day you start.

Screenshot it, or export the configuration.

File it with the assessment.

Compare after every vendor release, because features arrive switched on and "we never enabled that" needs supporting with dates.

Turn the principle into a test

For an example that can make this requirement testable, consult remote employee monitoring software. Treat the page as a starting point rather than proof and reproduce the workflow with real roles and failures.

Independent reference

For an external point of reference, see the ICO. This popular specialist source offers a useful reference beyond product documentation.