eXpress badging® defines customer-provided data for photo ID credentialing using industry-recognized Personally Identifiable Information (PII) classifications.
🔒 This ensures that only the data necessary for issuance of identity badges/cards is collected, stored, and processed, while the highest-risk regulated data is explicitly rejected. Customer data is located within our ShareFile account during secure transmission and is automatically deleted within 30 calendar days, within our local server in customer-specific folders during data management, and then deleted once uploaded within customer-defined Veonics Portal account(s).
📑 Classification Levels
🟢 Low Risk Data
PII elements are usually needed for basic badge issuance. They do not pose much risk if compromised or exposed to the public.
-
First Name, Middle Initial, Last Name
-
Job Title / Department
-
Internal ID / Badge Number
-
Professional Certifications (e.g., RN, MD, PE)
✅ Considered low-risk PII (NIST term: “linked information”).
✅ Fully supported and processed in the Veonics® Portal.
🟡 Medium Risk Data
Adds sensitive organizational identifiers. When combined with Low Risk data, Medium Risk data can present a moderate level of risk and liability if exposed publicly in different formats; the primary concern being identity fraud when paired with associated logos and affiliations.
-
Badge Photo
-
Employee Number
- RFID Badge Number
-
Hire Dates / Employment Status
-
Email Address
- Employer or affiliation name
- Badge issue and expiry dates
⚠️ Considered moderate-risk PII (NIST term: “linked & linkable information”).
⚠️ Supported in the Veonics® Portal with customer accountability for retention and accuracy.
🔴 High Risk Data
Adds personal attributes not required for badge issuance, outside of ID badge/card distribution and data controls within an identity assurance program. Combined with either low or medium-level PII data, high-risk data pose the highest risk of identity fraud for malicious purposes.
Enable the Data Visibility feature set to the Privacy setting for these elements that hide data from view, unless an authorized user enables viewing with reason comments for auditing purposes.
-
Home Address
-
Date of Birth
-
Vehicle License Plate Number
-
Phone Numbers
-
Records involving minors (<18 years old)
❌ Considered high-risk PII (NIST/ISO: “sensitive PII”).
❌ eXpress badging® does not request, require, or store this data. It is only allowed long term storage in customer-managed accounts during the licensing period , and we recommend using the Veonics Portal Enterprise SaaS subscription for higher-level data compliance.
❌ Customers are instructed to exclude these fields from badge projects if it is not required.
⛔ Banded (Prohibited) Data
Includes data governed by strict regulations (HIPAA, GDPR, CCPA, PCI DSS, etc.).
-
Protected Health Information (PHI) under HIPAA
-
Special Category Data under GDPR (e.g., biometric, racial/ethnic, religious data)
-
Social Security Numbers (SSN)
-
Driver’s License Numbers
-
Credit Card / Payment Data
🚫 Explicitly rejected.
🚫 Not contractually permitted for submission into the Veonics® Portal or We Print processes.
🚫 If submitted in error, this data will be purged immediately upon recognition and logged as a policy exception.
⚖️ Industry Alignment
-
NIST SP 800-122 (Guide to Protecting the Confidentiality of PII): Aligns with “non-sensitive PII,” “sensitive PII,” and “prohibited/special category.”
-
ISO 29100 Privacy Framework: Aligns with principles of minimization, consent, and proportionality.
-
HIPAA / GDPR / CCPA: Explicitly excluded from photo ID credentialing scope.
🚨 Enforcement
-
Customers must limit data submission to Low, Medium, and High Risk categories.
-
Use of Banded data will be immediately disabled upon eXpress badging acknowledgment.
-
Violations may result in account suspension until remediation.
Badge Data, Templates, and RFID Security
The combination of photo ID badge data, badge template design, and RFID card numbers does not compromise the security of customer access control, time and attendance, point-of-sale (POS), vending, or tracking systems. These downstream systems rely on additional layers of authentication and access control using two-factor technologies.
Regardless, the first concern is RFID duplication and cloning of a valid RFID badge, so it can be used for fraudulent purposes, which is highly sophisticated and unlikely. Bad actors will exploit easier methods like tailgating or following an authorized user through an open door.
The only theoretical risk would be if an RFID number were cloned and replicated onto a matching physical credential—a scenario that is highly unlikely due to encryption, system-level protections, and audit controls. So, if cloning is a concern or issue, enable two-factor technologies where applicable.
In practice, the most probable security risk in ID badging is not electronic compromise, but rather a visual breach (e.g., someone misusing a badge’s appearance to impersonate an authorized individual). This is why both badge template security logic and visual identity standards are critical parts of our compliance model.