Fingerprint scans, retina scans, and so forth, are somewhat difficult to keep secret, though. And practically impossible to change if adversaries gain access to them.

They don't have to be at the desk when writing it... they could be in the restroom or at their home.

Installing a camera behind their desks is illegal in many jurisdictions.

passwords are in the category of "something you know" and cannot be replaced by things like fingerprint scans and retina scans which are "something you have". They are actually a lower form of security than passwords because they can be easily faked.

and how would you know that what they're writing down is actually their password?

@Caleb Biometrics (fingerprint scans, retina scans, ...) would typically be considered something you are, not something you have.

@aCVn - no, typically, biometrics are used to both identify and authorised persons. My phone doesn't ask for password after verifying my fingerprint.

@a CVn I think you are right.

@jwenting Because your cameras would also record them typing in their password when they logged in. :) In other words, your CCTV network now becomes target #1 for anyone seeking access to your network.

@vsz Agreed, but I'm 99.9% sure that that suggestion was tongue-in-cheek.

@vsz I think a citation that using CCTV to monitor employees is “illegal in many jurisdictions” is needed”

@Tim : is needed by whom? Could you please provide a citation for the claim that it is needed? Seriously, just google GDPR and video surveillance. If I was writing a complete answer about the topic, I would include plenty of references, articles and laws. If you really need them, ask a separate question where it can be answered in detail.

@vsz needed by everyone because this site is about providing high quality, reliable information? The vague citation you’ve given (“Google GDPR and video surveillance”) really doesn’t back you up. I know for a fact that GDPR does not cause CCTV in the workplace to be illegal in any of the jurisdictions it applies - imagine the chaos if it was!

@Tim : do you want to go so far off topic and discuss something completely unrelated to the question? And it's not that CCTV itself is illegal, but the direct observation of specific employees is illegal without evidence of criminal activity and without them being informed. There is a difference between cameras installed in hallways, on outside walls, and the ones installed inside offices targeted at the desks of specific employees. (And before you criticize me, please count the number of citations in the answer itself).

@vsz the answer was a joke; that’s why it doesn’t have citations. I want to prevent people (in this case, you) spreading misinformation - if that requires going off topic, so be it. It’s normally illegal to not inform them yes; it’s not illegal to install without evidence of criminal activity. Again, there is a difference, yes - but both are fully legal. As an example, most bank branches will have a CCTV camera looking at the desks. Most busses have CCTV with a view of the driver. Most shops have CCTV on the tills. None of that is illegal; please stop claiming it is.

@Tim : your examples are exceptions specifically mentioned in the regulation. You can't just have a camera pointing to a desk of an employee who is not directly handling money. And even in the rare and exceptional cases you can, there has to be a well-defined reason, the employee has to explicitly agree with that (you can't force the employee to accept), and there are many other limitations.

@vsz no, they’re not specifically mentioned in GDPR legislation because they’re not exceptions; any employer has a right to install CCTV in their business: as long as the reason is communicated to employees. You’re just making things up to try and make your point (and I don’t understand why! Its trivial for me to find evidence completely contradictory to your claims).

How do you suggest ensuring users are not storing their fingerprints and retinas in plaintext?

@Tim In most places, an employer has no right to observe the employee's private, personal correspondence, be it e-mail, WhatsApp messages or whatever. If an emploee opens up his e-mail on his cellphone and your CCTV catches a glimpse of what he is typing there, you're into a sea of trouble.

@T.Sar That’s not what the article says. It’s not disputing what I’ve said at all. “even if the telephone monitoring ... do not involve the content of the communications, it still violates article 8”. It’s saying that every phone line which says “Calls may be recorded for training and quality assurance” are breaking the law? Nonsense. “Therefore, the monitoring activities should be necessary, proportionate and transparent.” - this is my point. If an employee is sending texts at work (they shouldn’t be?), it’s their fault: they’ve been notified. This article does not support your argument.

@T.Sar take a read of citizensadvice.org.uk/work/rights-at-work/… which actually does set out what can and can’t be monitored, as per UK law (which conforms to GDPR (and the EUtHR rulings), as per the Data Protection Act 2018. In fact, one specific, legitimate use of monitoring is “to check for unauthorised use of telecommunications systems, such as whether you are using the internet or email for personal use”

@Tim Keep Reading the article: "In the WP29’s viewpoint, any monitoring of electronic communications should be exceptional, namely when necessary to obtain to obtain proof of certain actions of the worker; detect unlawful activity; detect viruses; or guarantee the security of its systems. Therefore, concealed or intrusive monitoring is generally unlawful." You'll have a hard time proving that your CCTV recording what the employee types on his personal phone isn't intrusive.

@T.Sar do you understand what “not legally binding” means? “In this context, although not legally binding, the Article 29 Working Party (hereafter WP29) opinions provide important guidance. In fact, national data protection authorities take them into account when applying and enforcing national laws.” - in other words, unless their opinion has been put into law (which it has not been in the UK, at least) there are no legal consequences. At all. Please stop misrepresenting this article; it’s disingenuous.

@Tim I understand. I also understand that, from the article you linked, the equipment being monitored is provided partly or wholly for work. You can't check what your employees do on their personal phones, period. More so, this isn't only about the UK. You're the one scoping it down to something far more narrow than it should.

@Tim One more reading about this

@T.Sar so are you claiming that the line which states that “recording on CCTV cameras” is allowed is wrong? In case it were to see an employee using their device? Are you suggesting that if I were to open my phone to a private conversation and allow the CCTV camera to see it, the employer has broken the law? I suppose if someone were to read a book, the employer has broken the law too because they’ve copied a copyrighted work? Get real.

@T.Sar yet again, that does not make monitoring illegal. Read the last paragraph: “It is important to follow the above principles when preparing such provisions - to clearly notify the employee of the ongoing monitoring before starting to implement it, to clearly discuss the purpose of the monitoring and to ensure that the monitoring is legal, necessary and proportionate and the protection of the employee's data is ensured.“

@Tim proportionate and necessary being the key, here. You'll need to have a specifically designed CCTV system if you want to catch what your employees do on their phones. Regular cameras don't cut it. It is not different from installing cameras on the toilet area just because your employees can go there to write down their passwords. You're ignoring the proportionate and necessary parts of this regulation.

@Tim It is a matter of intent. Having your CCTV monitor your cashier to identify possible money theft is one thing. Having a camera on your regular office grunt to make sure he isn't typing a specific password on his private phone is a totally different matter. Do not generalize.

@T.Sar right, so having a CCTV camera pointed at an employer provided computer screen is acceptable. If the employee causes the camera to see a phone screen, that’s not the employer’s fault. I think we can both agree that putting up surveillance with the purpose of monitoring private communications is illegal (as my link from the CA made pretty clear). (As is cameras in the toilets except for extreme cases, again, as my link makes clear). As a summary, putting up CCTV to monitor the usage of a work device is not illegal.

@Tim Indeed, and that I something I agree with you. The problem exists if, and only if, the employer sets up a system that intentionally checks for things that would be excessive to monitor, like what the employee does on his personal phone.