I asked a Freedom of Information request (FOIR) to North Ayrshire Council (NAC) and got a response here. It warrants further investigation on a few issues. Consent. Data Protection Impact Assessment. Cost and claims NAC make of the system to speed up lunch lines and being 'Covid safe'.
Consent. I have touched on this before but I am curious as to who is determining the age of the ability of the child to consent to using their facial biometrics to pay for food. In England and Wales where a school wants to take and process a school's biometric, for any child under 18, parental consent is required by legislation.
In NAC it seems there was a debate on consent... 12 or 14? Consideration, though I can't see how this marries up, was that 12 year olds can withhold data on what they eat to their parents therefore they can consent to having their biometrics used. Am I thick, because I'm not connecting this reasoning up??
But somehow, it appears from advice from the supplier, that in other schools they have opted for 14 - why? ...we don't know - but it's quicker and easier to facial scan kids who can give consent themselves than wait for parents to consent apparently. See below communications sent to me via FOIR response:
I was interviewed this morning on BBC Radio Scotland about consent, NAC are saying that they have a 97% uptake. I bet they do, children when asked for consent is simply invalid due to it not being able to be freely given due to the power of imbalance between the school and family, not wanting to be different and peer pressure.
And how do parents and children differentiate between the finer nuances of facial recognition essentially taken from a still photograph (FR), live facial recognition (LFR) taken from live video feeds and retrospective facial recognition (RFR) from non live video records? Parliament can barely eek this out privacy wise so how on earth can a child or parent without some hours research on the topic?
If parents and children could read the Data Protection Impact Assessment (DPIA) done on the system, all 16 pages of it with redactions about data sharing, they might not be so keen to use facial recognition.
But BBC Radio Scotland said, the 'kids and parents like it'. Erm, so what? Biometric technology used by children has been discussed in UK Parliament and at EU level and its deemed in legislations, DPA 2018 and GDPR, to be unlawful. There are lots of things we 'like' and some are legislated against for good reason where minors are involved.
Why isn't our regulator, the Information Commissioners Office doing this? A good question that I hope will be resolved soon enough.
Data Protection Impact Assessment - as I mentioned earlier, parts on data sharing are redacted. In order for full transparency I believe with such a new technology, potentially being unlawfully used, we should see exactly how it is being used.
Cost and claims - again redacted. This is our tax payers money, we should have a right to know under Freedom of information.