What a Photo at the Punch Is For
Photo capture at the terminal: why it works only if somebody looks, how to keep review proportionate, and the obligations that arrive with the images.
Photo capture works only if somebody looks at the photos, and in most deployments nobody does after the first month. The camera fires at every punch, the images accumulate, and the control is doing nothing except generating a dataset the organisation now has to store, secure, retain and eventually disclose.
The identity gap described in “What a Photo at the Punch Is For” matters when teams assess examine the reporting workflow for self report bias. The platform may make an activity or timestamp visible, yet a responsible review still distinguishes the device or account from the person, checks another source and records what the evidence does not establish.
That is the whole of this page. The technology is sound, the deterrent is real for a while, and the implementation almost always omits the only step that makes it function.
Teams reviewing “What a Photo at the Punch Is For” can cross-check their approach against the European Commission cybersecurity policy. The comparison is most useful when the organisation records which recommendations apply, which do not and why.
What it actually does
Two things, and they are different. It deters, because people know a photo is taken. And it evidences, because an image exists if anybody examines it.
The deterrent survives without review for a while and then decays as people notice nothing happens. The evidence only exists if somebody looks, and looking is what nobody plans for.
Making review proportionate
Reviewing twelve thousand images a month is neither possible nor proportionate. Reviewing none makes the capture pointless. The workable middle is triggered review.
- Punches outside the expected pattern — wrong terminal, wrong time, wrong shift.
- Several punches on one terminal within a short window.
- Punches on a credential flagged for any reason.
- A sample, at random, small enough to actually be done.
- Anything specifically raised by a manager, with a reason recorded.
Five triggers, perhaps forty images a month, reviewable in twenty minutes by one person. That is a control. The alternative is a camera.
Who reviews, and who sees
The review should sit with somebody who does not manage the people concerned, and access to the images should be restricted and logged.
That matters more than it sounds. Images of every employee arriving at work, accessible to any supervisor, is a different thing from a restricted set examined on a trigger — both in what it is, and in how it is experienced by the people in it.
What the obligations are
Capturing images of identifiable people creates duties: a basis for collecting them, notice to the people concerned, security, a retention period, and rights of access.
What exactly is required differs by jurisdiction and is a question for somebody qualified in the place concerned. What is universal is that the duties attach whether or not anybody reviews the images — so a system nobody looks at carries all of the obligation and none of the benefit.
Retention
Short. Images needed for a specific matter are extracted and kept with that matter; the rest should age out quickly, on a schedule, automatically.
The common failure is a system that retains everything indefinitely because the disk is large, which converts a modest control into a substantial archive of pictures of staff.
Telling people properly
What is captured, when, who may see it, for how long, and what happens if something is found. Five sentences, issued once, and repeated when the system changes.
Say explicitly whether images are reviewed routinely or only on a trigger. People assume continuous review, behave accordingly for a while, and lose confidence in everything the employer says when they discover nobody has ever looked.
When the photo settles it
Where a photo does resolve a question, it resolves it quickly and completely, which is the argument for having the control at all. It is also the one record in this collection that attests directly to a person rather than to a credential.
That makes it valuable and makes the review step non-negotiable. A control that could have answered the question, and did not because the images were purged unreviewed, is the worst of every available outcome.
What the image does not show
A photo at the terminal shows who pressed the button and nothing else. It does not show whether the person stayed, what they did afterwards, or whether they were working.
That is worth saying because photo capture is often bought as a general answer to time disputes and answers exactly one question. It is a strong answer to that question and no answer at all to the others.
The question to ask annually
Has anybody looked at any of these images in the last year, and did it change anything?
If the answer is no twice, the choice is to start reviewing or to stop capturing. Continuing to capture without reviewing is a decision too, and it is the one nobody takes deliberately.