Client keys and access notes in a cleaning firm

A cleaning firm in Winterthur looks after eleven households and two offices. For most of them it holds a key; for a few it only knows that the key is in the key box next to the front door. The keys hang in a cupboard in the office, each with a tag showing the surname and the street. The details on how to get in are on a sheet in a folder, and the employee who cleans the office on Seestrasse on Monday simply takes the key herself.

That works as long as everyone knows each other. It gets trickier when two more people join, when someone takes a key home for the weekend, or when a client ends the contract and nobody is sure whether the key was returned. This article describes what information comes together here and what options there are for handling it.

Three details that say more together than apart

A cleaning firm that works in homes and offices records three things that are unremarkable on their own:

Detail	What it says on its own
Address of the place	where cleaning happens
Access note	how to get in, such as a key box or a door
Key and its status	who holds it right now

Together they show how to get into a particular home. That is why such details are treated with more care than, say, a price list. Legally they are personal data: Art. 5 let. a of the Federal Act on Data Protection (FADP, in German DSG) defines personal data as all information relating to an identified or identifiable natural person, and a home address with access details falls under it. The key register concerns people too, since it records which employees held a key and when.

For the firm this means nothing out of the ordinary. The general principles of the FADP apply, and two of them shape the handling of keys in particular.

What the law requires in general

Proportionality and purpose. Under Art. 6 paras. 2 and 3 FADP, processing must be proportionate and may only take place for a specific, recognisable purpose. For the access note the purpose is narrow: it says how the person on the visit gets into the place. Anything beyond that, such as the residents’ habits or details about their health, has no place in it.

Data security. Art. 8 FADP requires the controller to take suitable technical and organisational measures for data security appropriate to the risk. The Data Protection Ordinance (DSV) names access control in Art. 3 para. 1 let. a: authorised persons should have access only to the personal data they need to carry out their tasks. For a cleaning firm, that translates to: whoever cleans a stairwell on Tuesday needs its access note, but not those of the other places.

What goes into an access note

The access note carries one sentence: where the key can be found or which door is meant. Some firms deliberately record what they leave out, namely door and alarm codes. They pass the codes to their staff another way, for example verbally or by phone. The idea is simple: a note that several people read should contain nothing that lets someone enter a place without further ado.

The police have an observation on where keys are kept. In its brochure “Riegel vor!”, the Swiss Crime Prevention agency (SKP) writes that burglars always assume, when they find a key safe, that a spare key is hidden somewhere in the house; they look for it and mostly find it. The brochure says this about a safe in one’s own home, not about cleaning firms. It does show, however, that hiding places are treated as places others know or find. Some firms therefore describe the location of a key box on the house only as precisely as the visit requires.

Neutral numbers instead of names on the key

The tag on the key is the part most likely to get lost. If it carries a name and address, a lost key can immediately be tied to a place. If it carries only a number, such as “K-014”, the register is needed to know where it belongs.

Such a system has three parts:

• The number. A running, neutral identifier without a name, street or town.
• The register. For each number, the place, the number of keys and the date the client handed them over.
• The log. Who took the key, returned it or reported it lost, and when, each with a date.

The log answers the question that comes up most often in daily work: where is K-014? It also has a second effect. Because it contains employees’ names, it is itself personal data and subject to the purpose principle: it serves key management, not the monitoring of employees.

Who sees what

In a firm of five people, different needs arise:

Person	Needs
Staff on a visit	the access note of the place they work at, on the day of the visit
Scheduling	all notes and the register, in order to plan
Owner	everything, with a record of who viewed what

The guide of the Federal Data Protection and Information Commissioner (FDPIC, in German EDÖB) on technical and organisational measures describes the logic using server rooms as an example: the fewer people have access, the better the security, and access is logged. A server room is not a client’s home, but the reasoning carries over to keys and notes: as few people as necessary, and a record of who had access.

Visibility can be limited in time as well. An employee needs the note on the day of her visit; after the visit, or after being reassigned, she no longer does.

When a job ends

Here Art. 6 para. 4 FADP applies: personal data are destroyed or anonymised as soon as they are no longer needed for the purpose of processing. The purpose of the access note is access for visits. When the job ends, that purpose lapses.

In practice two questions arise, and they can be kept apart:

• The key. It goes back to the client. The log records that it was returned, and a short confirmation to the client can document it.
• The note. It can be deleted after a set period, for example a few weeks after the job ends, so that it does not stay in the folder or the system for years.

The log of key hand-overs is a different case from the note, because it also documents that a key went back. How long a firm keeps it is its own decision. A fixed period can be named when someone wants to know how long data are kept.

What applies in the event of a lost key, contractually and under insurance, depends on the job and on the firm’s policy. This article does not cover it.

An arrangement that suits the firm

In short, an arrangement for client keys consists of a few parts: notes that only say how to get in, keys with neutral numbers, a log of who held them, visibility according to need, and a period for deletion. The FADP provides the framework; the implementation is up to the firm and depends on its size and its clients.

The idea for cleaning firms that we are working on takes up this arrangement: the app will keep an access note for each place that stays hidden until someone chooses to show it, and it will show it to staff only on the day of their visit. Keys will get neutral numbers, and every hand-over will appear in the log. When a place ends, the note is meant to be deleted after a period. The app will store the data on infrastructure in Switzerland.