"Security in libraries is a big issue"... that warrants fingerprint technology?

From Hansard - Business Questions in the House of Commons, Thursday 25th January 2007:

Greg Mulholland (Leeds, North-West) (LD):
The right hon. Gentleman will be aware of the growing concern at the increasing number of schools that are collecting data on pupils that is derived from biometrics such as fingerprinting, for use in electronic registration and library systems. He will also be aware of the fact that legal opinion, including that of the British Educational Communications and Technology Agency, has stated that this practice contravenes the Data Protection Act 1998. Does he agree that it is time to debate this important subject in the House?

Mr Straw: I am not aware of the practice, but obviously people have accepted it. There is a problem with ensuring people’s identity, and one of the ways of doing that is to use biometric data. Security in libraries is a big issue for younger and older people. If the hon. Gentleman really thinks that this is an important matter, he can raise it on the Adjournment.

Jack Straw's initial sentance seemed 'stumbled' when I watched on the BBC Parliament channel last Thursday as he was clearly "not aware of the practice" of taking children's biometric fingerprints, vein scans and in some cases iris scans in schools without parental consent or knowledge - and the above reply was his answer.

(Is "security in libraries" a big issue?... perhaps for the end user it is)

He quite obviously had no idea this was going on in schools (as does most of the adult population) yet his ignorance of children's compliance to give up their biometric data in a school environment didn't seem to concern him or warrant an open debate.

In Jack Straw's reply " but obviously people have accepted it" is not accurate at all. How can he say people have "obviously" accepted it when he has no knowledge of biometric technology involving children in schools at all ?

In a written statement, reported in The Register, Greg Mulholland said:

"It is precisely because of that ignorance among many MPs that I want to have a debate."

Legislation need to be monitored and updated to accomodate the expanding technology that our society has. This applies especially to children as they are the ones that will grow up and live in a technological society.

Schools building in biometric systems under BSF

With the governments Building Schools for the Future (BSF) programme one biometric company is partnering up with the large PFI contract holders/bidders to build in biometric systems in schools that are either being renovated or new build schools.

Consultation with learning authorities and local councils should be required with written consent obtained from all parents, before the biometrics are built into these schools as standard.

"The Building Schools for the Future (BSF) and Academies program requires ICT solutions providers to bid for all the ICT systems in a single bid. In order for the OnRecord range of products to be made available to the BSF and Academies projects, Gladstone Education have developed close partnerships with some of the leading educational ICT suppliers within the UK."

A biometric developer that piononeered the vein scanner in a scottish primary school, currently has a 15 year management contract with an academy in Middlesbough.

"Fujitsu is providing a managed service under a fifteen-year contract that specifies key performance indicators and service level agreements."

If you are concerned about the use of biometric systems in schools then contact your local council for their reassurance that this technology will not be used without full consultation and consent from parents.

It is worth checking the companies that get awarded the contracts for the schools in your area as they are independant parties that will have access to your children's data.

This from the General Manager of Fujitsu Europe Limited.

"Biometric solutions will increasingly allow us to move towards a cashless society"

So no ulterior motive for this company then to get'em whilst they're young...

Early Day Motion - Biometric data collection in schools

BIOMETRIC DATA COLLECTION IN SCHOOLS
19.01.2007
Mulholland, Greg

That this House is alarmed at the growing practice of schools collecting and storing the biometric details of children as young as three; notes that up to 3,500 schools use biometric software to record the data of approximately three quarters of a million children; shares parents' concerns that children's data, often including photographs and fingerprints, is stored on unregulated data collection systems and potentially insecure school computer networks and could therefore potentially be misused; notes that collecting the data from children under 12 without parental consent directly contravenes the Data Protection Act; believes that no child should have biometric information taken without the express written permission of their parents; further believes that no child should be excluded from school activities where this permission is not forthcoming; welcomes the decision by the Department for Education and Skills to update guidance to local authorities and schools; and calls on the Government to conduct a full and open consultation with stakeholders, including parents and children, on this issue as part of their redrafting process.

---

The above Early Day Motion (EDM) has been laid down by Greg Mulholland MP for all MP's to sign, detailing issues and concerns surrounding the practice of children's biometric data collection in schools. This EDM has support from across the three main political parties.

Please take time to read the EDM and lobby your MP to sign it if the use of children's biometric data in schools concerns you.

For more information on this see Leave Them Kids Alone website.

The Open Rights Group (ORG) have sensible and practical advice on how to effectively lobby your MP by letter or email - it is worth reading.

Your MP's contact details can be found at Write To Them.

BECTA - "care needs to be taken to consider the concerns of parents in this area"

BECTA, the British Educational Communications and Technology Agency's newsletter - Tech News September 2006 - has a section starting on page 11 of their newsletter discussing biometric technology in schools.

BECTA, according to the governments responses to Tom Watson Labour MP and Greg Mulholland Liberal Democrat MP, are consulting with the Information Commissioners Office in drawing up guidelines using biomeric systems in schools for the DfES.

This is what BECTA have to say about biometrics used in schools:

"Authentication systems beyond the common username/password approach are becoming more popular, but as fast as devices and solutions come on the market there are fresh concerns raised about the operations of schemes including issues of privacy and anonymity."

Privacy and anonymity are areas that concern children's rights and privacy groups as well. Child privacy and anonymity needs to be exhausively discussed with such groups that can offer specialist advice in this area before any guidelines are drafted. Hopefully BECTA will pursue their concerns in the right way.

"Some commentators have suggested that traditional registration is not simply about marking attendance; and that teachers carrying out this task can learn more about a pupil during this time than simply if they are present or not."

"A minority of schools are already investing in these systems and it is likely more will try and automate mundane tasks to free up teacher time and improve administration. However, care needs to be taken to consider the concerns of parents in this area."

A school should respect consideration of any concerns that parents may have. It is the right (and lawful) way to proceed. The only way to do this is to alert parents to the practice that schools are using their child's biometric data and gain their informed written consent.

BECTA's concerns are ones that are shared by parents, privacy/rights watchdogs, MP's and others. These concerns surely now must lead to some serious debate time to air these issues and get some regulation into a market that is currently uncontrolled.

Biometrics for school registration & canteen now in India

A school in Hyderabad have introduced biometrics for registration and canteen monitoring for both students and teachers. Privacy groups may pick up on this in India and scrap the systems as they did in Hong Kong and China, we'll just have to see.

And in just three weeks since it was introduced, fewer children and even teachers are bunking class.

Gillick Competence

I'm going to put Terri's input here on Gillick Competence, as it is details the principle of it more than my previous post on children's decision making capacity and parental involvement.

An important element in assessing the competence of an under 16 to give consent is the question of whether s/he refuses parental involvement.

Unless the young person actively chooses not to consult parents, the ordinary common-law position of parental responsibility for under 16's applies.

Information Commissioner has doubts

Been a little busy this week - these few items explain.

On the subject of biometrics in schools the Information Commisioners Office (ICO) seems to have doubts:

"For us to come out now and say fingerprinting isn't allowed would be very difficult because these systems have come in over the last four years. We were asked about them and we said it was okay." David Smith, deputy information commissioner.

We all have jobs where at times it can be “very difficult” to admit advice given has been wrong but if it is your job, and you’re getting paid good money for it, you have to get one with it. Let's hope that the ICO don't cover their backs with flimsy guidelines that they are consulting the DfES on.

Also fingerprinting children without parental consent would bring the issue of whether the child is Gillick Competent.

Connexions advice: Decisions on a young person’s ability to give consent will be based on the "Gillick Competence" test.

The phrase “Gillick competence”derives from the House of Lordscase of Gillick v West Norfolk and Wisbech Area Health Authority(1986 AC 112), in which it was determined that a child under theage of 16 years could give consent for medical treatment provided they had the cognitive and emotional maturity to understand the implications of the decision being taken.

This test is now applied wherever an agency wishes to determine whether the consent or direction of a minor is valid.

Comments on fingerprinting

As the row rumbles on in York, it emerges that another school has taken children's fingerprints without parental consent.

The first two comments at the bottom of the article made me smile:

"Well if it only stops one terrorist attack, it'll be worth it"

"Library tickets in the front line in the fight against terrorism - amazing!"

Guidelines being written...

This from the Liberal Democrats Website:

"Education minister Jim Knight confirmed that the Government will be issuing draft new guidance about fingerprinting in schools."

A full and open debate is needed on this subject with stringent guidelines written sooner rather than later.

The governments responses in the past have been to direct enquiries about biometric fingerprinting in schools to the Education Act, BECTA and the Data Proctection Act, rather than dealing with the contentious issues and concerns surrounding the use of biometric technology in schools.

Now, five years or so after the technology was introduced in schools, the government have realised their previous advice given is not adequate.

---

Feb 2006 - Jacqui Smith:
My Department has issued no guidance to schools on the collection and recording of pupils' biometric information. In collecting data of this type the school is likely to rely on the broad powers contained in paragraph 3 of Schedule 1 of the Education Act 2002. This enables a governing body to do anything which appears to them to be necessary or expedient for the purposes of, or in connection with the conduct of the school.

July 2006 - Beverley Hughes:
I refer the hon. Member to the reply given on 27 February 2006, Official Report, column 504W, to the hon. Member for Bognor Regis and Littlehampton (Mr. Gibb). [above]

October 2006 - Jim Knight:
The Department has not issued guidance to school governors on whether they should consult parents before implementing a policy of taking thumb prints for library issues… The British Educational Communications and Technology Agency (BECTA) published guidance for schools in 2004 on their obligations and responsibilities under the Data Protection Act and other related legislation.

...and finally

Dec 2006 -Government response to e-petition:
The Department for Education and Skills does provide guidance for schools and local authorities on data protection and the security of personal data which would include Biometric data.

However we are currently working with the British Educational and Communication Technology Agency (Becta) and with the office of the Information Commissioner to update the guidance including around the use of Biometric technologies.

Data collection in schools

ARCH blog comments here on the masses of data collected about children in schools.

Why have we got fingerprint scanners in school libraries?

Just saw this child's view on fingerprint technology here in York, where the issue over biometrics in schools rumbles on:

Those who are worried about the system simply don't understand how it works. It is used for taking out books and nothing else. "And I'm quite happy with that."

No, no, no - it's not just used for taking books out. It's primarily there to monitor what you read by your age, gender and what ethic origin you are. The library systems can restrict learning resources to these groups too.

These features are adverstised by the school library retailers - the real reasons why schools are buying into fingerprinting...

The inspectors were very impressed by the way in which we are able to provide detailed statistics and monitor use of the library by gender, year group, ethnicity and individual progress in numbers of books borrowed. This is due to the excellent reports developed...

How nice (not)- a prime example of un-informed decisions taken by children who do not know the full facts.

"...as long as you have got nothing to hide, you should have nothing to worry about" - actually it's because you have nothing to hide you should be worried about it. Value liberty.

Biometrics used by parents to check whereabouts of children?

Registration, library books, canteen purchases, paying money into school - now fingerprint technology can be used by parents to track their children on the school bus - but concerns have been raised.

Indian River County students could have been the first on the Treasure Coast to experiment with the technology, but a district plan to try a biometrics program on a few school buses raised concerns over student privacy from the Indian River School Board in September.

District officials were considering a program in which parents could check a Web site to know whether their children had been picked up or dropped off at the bus stop or if a bus was running late. With the program, which would have used biometrics finger imaging as students got on and off the bus, school officials could monitor whether a bus driver was stopped along a road or had deviated from the regular route.

At the September meeting, board member Lenora Quimby said she was "very concerned about the whole 'Big Brother' issue."

Anger in York as schools fingerprint children

In York, UK, thousands of children have been fingerprinted in schools, some without parental consent. After the controversy came to light a primary school has scrapped the fingerprinting system pending an outcome of any debate.

Some of the reasoning given by one head teacher to introduce fingerprinting systems into his school was ... "the world has no answer to terrorism without using these things and I would see us as getting them ready for the world in which they will have to live." Is this within a remit of a school?

One parent is furious: "I think fingerprinting the children is appalling," The father, who asked to remain anonymous, said he was concerned that someone hacking into the school's computer could get access to confidential personal information gleaned from the fingerprinting system.

China scraps fingerprinting monitoring system in schools

When Hong Kong banned fingerprinting in schools last year it was understandable.

Their data protection laws are similar to ours in the UK, they wanted to stop fingerprinting children before it became a runaway trend that was too late to stop and they had concerns regarding children not giving their privacy rights the consideration they deserve. All very commendable.

Roderick Woo, Justice of the Peace at the Hong Kong Office of the Privacy Commissioner: "It was a contravention of our law, which is very similar to your law, which is that the function of the school is not to collect data in this manner, that it was excessive and that there was a less privacy-intrusive method to use."

But when China, a one-party authoritarian state, has also scrapped fingerprinting in schools because of concerns over children’s privacy rights – the question has to be asked why, in the UK and USA, is it increasingly used in schools, unregulated, to monitor many aspects of children’s lives, quite often without parental consent or knowledge?

Quite unbelievable!

LA Times, Dec 2006: [update March 2007 - this LA Times link is broken, please click here for the LA Times archived article]
Shanghai's Shixi Primary School was forced to scrap a fingerprint monitoring system for students last year in the wake of widespread criticism over students' privacy rights.

Where do your fingerprints go?

Unregulated taking of fingerpirnts from childrens as young as three in the UK?

This is happening in Canada to university applicants...

From Excaliber, York University's Newspaper, Toronto, January 3rd 2007:

If you're thinking about taking, or if you've already taken, the Law School Admissions Test (LSAT), you know all about the hours of studying it takes to prepare for the exam. But are you prepared for what happens to your thumbprint when you hand it over at the door?

What happens to the fingerprint afterward is the cause of the controversy that has spread across Canadian law school campuses.

After thumbprints are taken at the Law Schools Admission Tests (LSAT) exam, they are sent to the United States to be processed. here, American authorities, including the FBI, have access to the prints.

Claire O'Sullivan is a fourth-year contemporary studies and Spanish student at the University of King's College in Halifax. She took the LSAT this fall and is upset that she had to hand over her thumbprint before writing the exam.

She said she was never told what the print would be used for. She said she wishes more people were protesting the requirement for students to hand over their thumbprints before writing tests like the LSAT.

"I wish it never happened," she said.

Musing on forthcoming guidelines...

Thinking about the forthcoming “guidelines” which are going to be issued - the government are working with BECTA, who obviously have no issue with biometrics in schools otherwise they would voiced concerns months ago and are working with the Information Commissioner Office (ICO). The ICO says it's a "complex issue that was still being worked out".

Well, let's work it out with BECTA and the ICO but also with children's rights organsiations, the reports listed below and legal advice as well - balanced.

From the Register, David Smith, deputy Information Commissioner:

“Now there's a requirement that consent is informed and freely given. That will depend on the age of the child”

“The idea is that as long as children can understand the implications of what they are being asked to do, they can give consent without deferring to their parents.”

"The Data Protection Act is about the pupil's rights, not the parents' rights over the children's information"


INFORMED CONSENT

From the Foundation for Information Policy Research (FIPR) report to the Information Commissioner on Children's Databases, November 2006, page 89:

Data Commissioner -"If a data subject is of sufficient maturity to understand their rights under the Act then the data subject should be approached for consent to process their personal data. In general the Commissioner believes that at the age of 12 an individual is likely to have this level of maturity, but understands that this may not always be the case.

There does appear however, from time to time, to be some confusion in the matter of consent in schools. This usually relates to the age of pupils and the point in time when educational establishments should cease to ask parents’ consent to process pupils’ personal data and should start to ask the pupils themselves."


FREELY GIVEN CONSENT

FIPR report to the Information Commissioner, page 94:

First, the practitioners asking the young people for consent may have access to them in an environment where they are habituated to co-operate with the wishes of adults (such as at school). This would not seem to be an environment conducive to genuinely free choice.

Trustguide report, October 2006, for the government, page 76, with regard to biometric technology in schools:

It seemed that none of the attendees were thinking beyond the immediate scenario or what they had been told from ‘trusted’ sources (i.e. their parents, their teachers, or the community policeman). They felt that they could not challenge this viewpoint, or present any alternative views.


The government and the ICO have some solid views here to go on. Apparently the ICO have been "drawing up guidance on the use of fingerprints" since Mark Ballards article in The Register on the 7th September so hopefully it should be out soon.

However issuing guidelines will be fairly ineffective unless it is established who is going to monitor the implementation of any guidelines. When local government and central government have no idea how many school children are giving up their biometric data for databases, it will be a mamouth task simply finding out the schools biometric technology is already being used in.

Who is going to ensure that "a data subject is of sufficient maturity to understand their rights under the Act" in order for the data subject to be approached for consent? This would mean the Data Protection Act should be taught in school in depth and children tested on their rights under the Act - completely unworkable.

Maybe specific law needs to be created - with children aware of how their data is being used, parental permission sought in all circumstances until the child is over the child allowance age, who is looking at it and why, how secure the computer is storing their biometric details, possible implications of biometric data being unsecure and strict penalties for data controllors not adhering to the "law".

Perhaps that's unworkable too and would then demonstrate that biometric technology in schools is posing a problem to regulate, therefore open to abuse and children not being taught the value of their biometric details and who has access to it.

Anyway, I'm going to cynically predicit that any "guidelines" written will simply fit around the millions of pounds worth of biometric technology already in schools and such guidelines will be flimsy and ungovernable.

I do hope not.

Whatever the government does - let's make it workable.