Face-Scan Entry at Condos: Is the Owners' Vote Enough?

Many buildings move from keycards to face scanners in the same order. A vendor quotes a price, the committee approves, the general meeting votes, the installers arrive, and the juristic person tells every unit to come down for a front-facing photo. Data protection law comes up later, or not at all.

One condominium did it differently. Before switching the system on, its management company wrote to the Office of the Personal Data Protection Committee (the PDPC Office) on behalf of the juristic person. It asked what the building may do when a co-owner or resident refuses to have their face collected, and asked the regulator to review its consent form. The reply is the PDPC advisory opinion on the steps for collecting sensitive data through a face-scan system for a condominium juristic person, which the opinion anonymises with a single Thai letter. This article calls it Condominium A.

This article walks through that answer point by point, compares it with two other opinions on biometric data, one about an airport operator and one about the Expressway Authority of Thailand, and sets it beside the penalty provisions of the Personal Data Protection Act B.E. 2562 (PDPA). The same reasoning reaches office buildings, factories, gyms and any business with a face or fingerprint scanner on a door or a time clock.

The general meeting voted yes. Why is individual consent still needed?

Because a resolution and PDPA consent answer different questions. A resolution under condominium law amends the bylaws on the use and management of common property. Consent under Section 26 belongs to each data subject. A co-owner who raises a hand in the meeting cannot consent for a neighbour or a tenant.

The facts in the opinion are plain. Condominium A said it had put the plan to the general meeting as the Condominium Act requires and had amended the bylaws on the entry system. The PDPC recorded those facts in its opinion and still concluded that explicit consent from the data subject is required. The statement that a vote cannot replace consent is this author's reading of that answer; the PDPC did not write that sentence in so many words.

Why a resident's front-facing photo becomes biometric data

Condominium A's system needed a front-facing photo of every co-owner and resident in the project, stored as the database the recognition software matches against. The PDPC said data of this kind arises from technology that uses a person's physical features to verify identity, which puts it inside the definition in Section 26.

The PDPC then held the juristic person's purposes, namely raising building security, convenience for residents and screening outsiders, against the exceptions in Section 26 and found none that fits. One route was left: explicit consent.

Buildings that believe the words "for security" on a notice settle the matter should read that again. The security reasoning that supports ordinary CCTV does not carry over to a face scanner, because the data is of a different category under a different section. Ordinary cameras are covered in CCTV in offices, shops and condos: what the PDPA expects.

Can a building make every resident scan their face?

Only where the face scan is truly necessary for, and related to, the building's contract or service. Where it is not, the building cannot insist and must offer another way in. The test comes from Section 19, paragraph four, which the PDPC quoted in full.

The PDPC explained that this provision exists to stop consent being forced as a tied condition. Where the data is necessary for and related to the contract or service, however, a data controller may make consent a condition, provided it collects only what is necessary under Section 22. The answer therefore splits into two cases.

Which case covers a building that ran on keycards for years and has only now switched to faces? The PDPC did not decide; it left that to the juristic person. But the example it gave for the first case is a building that has used biometric data from the start of the project or from the signing of the contract. A building where keycards have always worked needs to be able to say why a face has become necessary today.

The opinion given to the Expressway Authority of Thailand (EXAT) about biometric time clocks offers a way to think about necessity. There the PDPC gave examples of situations in which biometric data cannot yet be called necessary.

Turned into questions for a building, that gives three. Is there a real problem, such as cloned keycards or outsiders getting in? Would face scanning actually solve it? Has the building tried something that does not use biometric data? This comparison is the author's suggestion: the EXAT opinion is about an employer and its staff, not about condominiums.

What must a building offer residents who say no?

Another way to verify identity that actually gets them in and out. The PDPC listed four examples and left the choice to the juristic person, according to what is suitable and feasible for the building.

• An electronic keycard, the method Condominium A used before the change
• Verification through an app on a mobile device
• Multi-factor authentication
• An identity check by a security guard or a staff member assigned by the juristic person

The condition buildings tend to overlook sits at the end of the answer. The alternative must not be an unreasonable obstacle to using the contract or service. The PDPC's reason: if it is, the request for consent is not truly free. Put differently, if the alternative is made so awkward that residents give in and scan, the consent forms collected that way are in doubt too.

The PDPC opinion on the identity-verification system of a public airport operator describes a similar arrangement. As set out by the body that asked, passengers who do not consent to biometric enrolment go through the normal process with an identity document and a boarding pass. The existing channel stays fully open.

Tell people in advance what happens if they refuse

The PDPC told the juristic person to state the effect of not providing the data in its privacy notice, at the time consent is requested: for example, that the resident will have to use another method set by the juristic person to enter and leave. The reason is that this information matters to the data subject's decision, under the principles of fairness and transparency.

What was wrong with Condominium A's consent form?

It folded several purposes into a single consent. The form sent for review listed two purposes. The first was the security of people and property, such as identifying people entering and leaving, vehicle access and the moving of property, and it also mentioned building management. The second was building management and keeping out unauthorised outsiders. Residents were given one choice: Agree or Disagree.

The PDPC called this bundled consent. Where purposes are unrelated, the data subject should be able to consent to each one separately. Its example: separate face scanning for the security of the building from face scanning for general management and any other purpose unrelated to security.

Beyond that point, the PDPC summarised the consent requirements of Sections 19 and 20 and of the Committee's consent guideline. A building can use the summary as a checklist for its own form straight away.

1. Ask before or at the time of collection. The PDPC stated that there is no retroactive consent.
2. The data subject must express consent by a clear act of their own, such as signing or actively selecting an option.
3. In writing or by electronic means, unless by its nature that cannot be done.
4. State the purpose specifically, not in general terms.
5. Keep the request clearly separate from other text, and do not combine several kinds of data or several matters in one consent.
6. Use an accessible form and plain language that does not deceive or mislead about the purpose.
7. Minors, incompetent and quasi-incompetent persons: follow Section 20. For a minor aged ten or under, consent comes from the person exercising parental power.

What follows when a form fails these requirements? The PDPC cited Section 19, paragraph seven in its answer, and that paragraph is blunt about the effect: a non-compliant request for consent

What does the PDPA attach to doing nothing?

The PDPA provides three kinds of consequence: administrative fines, civil liability, and criminal penalties for certain conduct. Section 26 data sits in the top tier of administrative fines.

The figures in the table are statutory ceilings. They do not say what any particular building would be fined. Section 90 tells the expert committee to consider the severity of the conduct and the size of the business, and allows it to order rectification or issue a warning first. Even so, a building that knew and did not act will find its circumstances harder to explain than one that never knew.

Residents can sue without proving the building acted deliberately

Section 77 covers both the data controller and the data processor, so the juristic person and the company that maintains the system fall under the same provision. It accepts two defences: force majeure or the data subject's own act, and compliance with an order of an official acting under the law. "We did not know consent was required" is not one of them.

A face differs from a password in that it cannot be changed. If the whole building's face database gets out, the juristic person can issue new cards but not new faces. The PDPC itself wrote in its answer that biometric data by its nature carries a fairly high risk of affecting people's rights and freedoms. Under Section 78, paragraph two, a claim is barred three years after the injured person knows of the damage and of the party liable, or ten years after the wrongful act.

When committee members and managers face penalties personally

The PDPA's criminal penalty for Section 26 data is in Section 79. It applies to use or disclosure in breach of Section 27 and needs an additional element. It does not apply to collection alone.

Suppose a juristic person takes the face images and entry times it collected to open doors and posts them in the building's chat group to shame owners who are behind on common fees. That is a disclosure beyond what was consented to and may humiliate the data subject, so Sections 79 and 81 have to be read together. Section 81 speaks of instructions, acts, and failures to instruct by a director, a manager or a person responsible for the operation.

What must the contract with the face-scan vendor say?

There must be a data processing agreement with the company that installs and maintains the system. A quotation and a hardware warranty do not serve as one. The PDPC told Condominium A this in its additional observations, citing Section 40, paragraph three: for the tasks assigned to the processor,

The PDPC named two things the agreement must contain. First, the processor must keep security measures that meet the minimum standard in the Committee's notification. Second, the processor must report a personal data breach to the juristic person without delay, within 72 hours of becoming aware of it where feasible. The source is Clause 6 of the notification on security measures, read with the notification on breach reporting.

This lands on the juristic person directly, because the duty under Section 37(4) to report a breach to the PDPC Office within 72 hours belongs to the juristic person as controller. If the vendor learns that the face database has been broken into and stays silent, the building has nothing to report. The clauses themselves are covered in the article on processor agreement clauses.

Before signing or renewing, the author suggests putting four questions to the vendor in writing. Are the face templates stored in the device at the door, on a server in the building, or in the cloud? Which of the vendor's staff can access them? When a resident moves out or withdraws consent, how is the data erased, and within how many days? When the contract ends, how is everything returned or erased? These four are good practice, not wording from the opinion.

The airport opinion offers a way to think about how long data lives. The body that asked explained that a passenger's token is deleted 48 hours after the flight departs, and the PDPC recommended considering pseudonymisation or encryption as part of the security measures. A building should ask itself the same kind of question: is the face of a tenant who moved out last year still in the system?

Does a condominium that was exempt from record-keeping stay exempt?

Some condominium juristic persons believe they need not keep the Section 39 record, because the PDPC once told another condominium that such bodies generally have the character of a non-profit organisation and are exempt from some items under the small-business notification. The same answer also stated where the exemption stops.

A face template is Section 26 data. From the day a building switches on a face scanner, the exemption it relied on does not cover that activity, and the juristic person needs a record of the face-scan activity that the PDPC Office and data subjects can inspect. Failing to comply with Section 39, paragraph one carries an administrative fine of up to THB 1 million under Section 82.

Three PDPC opinions on biometric data: where do they differ?

All three start from the same point: a face or fingerprint used to verify identity is biometric data under Section 26, paragraph two. They differ on whether a statute supports the collector's purpose.

The table shows that the collectors who may go without consent are those whose purpose is backed by a specific statute. The airport has the air navigation law and the National Civil Aviation Security Programme. The employer has labour protection law. And even with a statute behind it, the PDPC still asked for necessity to be shown on the facts first.

Rented office buildings, gyms and housing estates sit closer to the condominium than to the airport. If they cannot name the law that has them verify customers or tenants by face, they should prepare along the lines of the answer given to Condominium A. Factories and companies with biometric time clocks compare more directly with the EXAT opinion, which is discussed in The Sensitive Data Your Company Holds Without Knowing It.

EXAT told the PDPC it had already bought and installed 84 biometric time clocks for 3,149,010 baht. The answer did not change with the money already spent; the tests were still necessity and consent. In the author's view, a business that has already bought the devices should not expect the investment to justify compulsory scanning. For those who have not bought yet, the questions to answer before switching on are in Face-scan cameras at work: how strong a reason do you need?.

The system is already running. What do you fix, in what order, in 7 days?

The plan below is the author's proposal, ordered from the PDPC's answer to Condominium A. It works for office buildings and other businesses if you read tenant, member or employee in place of resident.

1. Day 1
   Take stock of what exists: how many devices, where face templates are stored, whose data is held (including tenants who have left, children, domestic workers and building staff), who has access, and whose consent forms are on file.Sections 22 · 39
2. Day 2
   Answer the necessity questions in writing and have the committee resolve whether the building treats the face as necessary for its service. If not, set the alternative method and check that it works at every door.Section 19, paragraph four
3. Day 3
   Rewrite the consent form: one box per purpose, the effects of refusing and of withdrawing stated. Bring the privacy notice into line.Sections 19 · 23(2)
4. Day 4
   Ask for consent again with the corrected form. For people whose faces were taken without valid consent, the PDPC said there is no retroactive consent, so the author suggests suspending use of their existing data until fresh consent is given, and erasing the data of those who decline.Section 19, paragraph seven · 26
5. Day 5
   Put the alternative method into real use for those who do not consent, and announce a withdrawal channel as easy as giving consent was.Section 19, paragraphs five and six
6. Day 6
   Sign or amend the data processing agreement with the vendor: security measures, breach reporting within 72 hours, and how data is erased on move-out and at the end of the contract.Section 40, paragraph three · Security notification, Clause 6
7. Day 7
   Enter face-scan entry in the record of processing, restrict access to the database, set a retention period, erase the data of people who have moved out, and file the committee resolution with its reasons.Sections 37(1), (3) · 39

A five-question self-test: how many can your building answer?

1. Can residents who do not scan their face get through every door, at every hour, the same as those who do?
2. Does the consent form have a separate box for each purpose, and was it signed before the photo was taken?
3. Does the building's notice say what happens if someone refuses or withdraws consent?
4. Is there a data processing agreement with the vendor, with a 72-hour breach reporting clause?
5. Are the faces of people who have moved out erased from the system, and does someone check this regularly?

Questions 1 to 3 come straight from the PDPC's answer on consent. Question 4 comes from its additional observation on processors. Question 5 comes from the duty in Section 37(3). If the answer to even one is no or not sure, start at Day 1 of the plan above.

Does the PDPC's answer certify that the building got it right?

No. The PDPC closed its answer to Condominium A by saying that its views and observations are only suggestions on some points. They do not certify that everything the building does is lawful or complete in every case, and anyone who believes the juristic person has breached the law keeps the right to complain or use other rights through the procedures the law provides.

That right to complain is real and available at once. In the EXAT opinion, the PDPC wrote this about a worker who disagrees with the collection of biometric data.

A single unhappy resident can therefore start the process alone, without a majority and without going through the general meeting. A building with a purpose-by-purpose consent form, another way in, an agreement with its vendor and a recorded resolution with reasons will have its explanation ready that day. To review what makes consent valid, continue with the guide to valid consent under the PDPA.

Who stands behind this guide?

Written by the AIPDPA legal team · Content owner: Phuwara Krobtaku, Attorney-at-law · Thai Barrister-at-Law · technology & intellectual property counsel

Lawyer's licence no. 477/2558 · Thai Barrister-at-Law · LL.M. in Intellectual Property & IT Law (Gold Medal)