Apprentices, Young Workers and Consent

Sites with apprentices, trainees or seasonal staff under eighteen are taking biometric data from people who, in several jurisdictions, cannot give the consent being relied on, or can give it only with additional safeguards.

The enrolment decision in “Apprentices, Young Workers and Consent” is the moment to explain the whole attendance workflow, not only the reader. An organisation considering open the official page for employee monitoring for performance reviews should tell people which records managers can see, how time can be corrected and what fallback applies before any optional identity or activity setting is enabled.

This rarely surfaces because the numbers are small and nobody has asked the question. It surfaces eventually, and when it does the question is not about the young worker alone — it is about whether the basis the site has been relying on works for anybody.

For an independent benchmark relevant to “Apprentices, Young Workers and Consent”, consult the Cloudflare zero-trust overview. Use it to test notice, accessibility, security, recordkeeping, retention and exception handling against the real operating process rather than treating a device report as self-explanatory evidence.

Why minors are treated differently

The reasoning is the same everywhere it appears: consent requires an understanding of the consequences and a genuine freedom to refuse, and both are weaker for a young person at the start of their working life than for an experienced adult.

Some jurisdictions require parental or guardian authorisation below a specified age. Some prohibit certain processing entirely. Some simply apply a higher standard of scrutiny. What none of them do is treat it as equivalent to an adult employee.

The practical answer

Do not enrol them. Issue a credential, with the same recording quality, for the duration.

This is usually simpler than establishing and documenting a lawful basis for a handful of people who will be eighteen before long. It is also easy to administer: the apprenticeship or placement already has start and end dates, and the credential can match them.

The wider point it exposes

If the site's position is that biometric enrolment rests on employee consent, the young worker case is the one that tests whether that consent is really free. The answer given for them — that a sixteen-year-old may not feel able to refuse — applies in a weaker form to a new starter of any age.

That is not an argument for abandoning the system. It is an argument for making the alternative genuinely available and visibly used, because an arrangement where a meaningful number of adults have chosen the card is one where the consent of the rest looks a great deal more real.

Work experience and very short placements

Two weeks of work experience does not warrant enrolment under any analysis. A visitor pass or a day credential covers it, and the hours, if they matter at all, are recorded by the supervisor.

The failure mode here is the opposite of the usual one: a site that is otherwise careless about enrolment suddenly enrolling a fifteen-year-old because the induction checklist said so. Putting an age check on the enrolment step prevents it, and it is one field.

The line in the enrolment procedure

A line in the enrolment procedure: no biometric enrolment below the specified age; issue a credential instead; record the reason as policy rather than as an individual accommodation.

Recording it as policy matters. An apprentice on a credential should not appear on an accommodation list alongside people with medical reasons, both because it is inaccurate and because those lists should be as short as the facts allow.

Checking whether you already have the problem

Match the enrolled population against dates of birth in the HR record. It takes five minutes and most sites have never done it.

If there are enrolments below the threshold, delete the templates, issue credentials, and record that it was done and when. That is a clean remediation that takes an afternoon. Leaving it is the option that gets expensive, because it is the kind of thing that is found by somebody else.

Where consent is not the basis at all

Some organisations rely on something other than consent — a legal obligation, a substantial public interest, or a collective agreement, depending on the jurisdiction.

That changes the analysis for young workers but does not remove the question, because the obligations around processing data of minors generally apply whatever the basis is. The practical answer stays the same and the reasoning on the page should name the actual basis, since a document that says consent where the organisation is relying on something else is wrong about its own position.

Telling them something they can understand

Whatever the basis, young workers are the group least likely to ask what happens to their data and most entitled to be told clearly.

A short plain explanation at induction, separate from the stack of paperwork, costs nothing: what is taken, where it goes, when it is deleted, and that they can use a card instead if they would rather. Several will choose the card, which is a useful indicator in itself about how free the choice feels to everybody else.