SecEd issuing some advance warning of the future implications to schools processing childrens biometrics:
"Paula Williamson, a legal expert from The Information Law Practice, said: “In order for the consent to be valid it must be ‘fully-informed’. A school will need to give clear and comprehensive information to the parents and arguably the pupils in order for them to make fully-informed decisions about whether to give their consent.”
Parents should also be informed who the information might be shared with, for example schools may need to allow companies that run cashless catering systems to hold data, or may be compelled to share data with the police.
Also, schools cannot obtain this permission through an opt-out letter of consent, whereby parents not agreeing must actively inform the school. Letters must be opt-in.
...schools found to be in breach of these provisions face a potential fine of up to £500,000."