What can be the legal basis for processing photos on employee passes?

ANSWER

First, it is necessary to determine which entity will be the controller, that is, the entity deciding on the methods and purposes of processing, with regard to your employees' photos. If the requirement to include a photo on the pass is imposed by the entity that manages the area/building where your company is based, and you obtain the photos from employees on that entity's behalf and then pass them on to the property owner, then the property owner may be the controller and should have a legal basis for processing the data. In that case, as the processor, you would transfer the photos under a data processing agreement that should be concluded between you and the property owner.