What happens if UK schools do not comply with written parental consent for children's biometrics?

This new school term in the UK presents parents with a new transparency regarding the data a school holds and processes on their children.  A transparency that parents in the UK have not had before.  Since 2001 schools have been taking, storing and processing children's biometric data and have been able to do with without consent or consultation with the parent/s. This nearly happened to my children in 2005 when they were six and seven years old, hence this blog.

After campaigning, lobbying parliament and working with other committed parents and privacy organisations The Protection of Freedoms Act 2012 was passed in May 2012 and as of September 1st 2013 schools by law need to gain written parental permission before taking a child's biometric data.

This is what the Department of Education stated in reply to a recent Freedom of Information Act request when asked:

Q -  What action will be taken by which body if any school is in breach of its statutory duty to comply with the Act?

A - As you are aware, the new provisions in the Act will come into force from 1 September 2013.  The provisions will apply to any school, sixth form college or further education institution using biometric systems where education is provided to children under 18. 

These new duties require schools and colleges to notify all parents that they intend to take and process their child’s biometric information and, as long as no one objects in writing, the written consent of only one parent will be required.  

It is important that consent is actively sought and received and that it is informed consent: requiring schools and colleges to gain written consent makes sure that parents are aware both that their child’s school uses an automated biometric system and that it is up to them whether or not their child’s biometric data is taken.   
In addition, as you have highlighted, a pupil can object or refuse to participate in the processing of his or her biometric information. The child’s right to refuse applies both to the giving and the on-going storage and processing of biometric data. If at any time the child objects to the processing of biometric data the school or college must stop doing so.   

Where pupils do not use automated biometric recognition systems, either because their arents have refused consent or they themselves have refused to participate, schools are required to provide reasonable alternative arrangements for them.

The Department of Education's second reply to the initial question goes on to state that (as the above first response did not answer the querient's request): 

There are two bodies that have the remit and powers to investigate a complaint concerning a breach of a school’s duties under the Protection of Freedoms Act 2013, when this Act comes into force for schools in September 2013, and the existing Data Protection Act 1998.

I should first say that if, in the first instance, you believe that a school has failed to comply with the requirements of the Act, you should first complain to the school using the formal complaints process. Each school in England is required by law to have a complaints procedure and to publicise that procedure. If, having exhausted the full complaints process (including appealing), you are not happy with the outcome of your complaint, then two further options are available to you. 

If the school has failed to comply with its duties under the Protection of Freedoms Act (e.g. failing to notify each parent of a child of the school’s intention to use the child’s biometric data), and the school concerned is a maintained school, the Secretary of State may consider and investigate the complaint directly with the school’s governing body.  If it was decided that the school had not complied with their statutory duties under the Act, the Secretary of State could issue a direction to the school.   

On the other hand, if the school fails to comply with the Data Protection Act (e.g. processing or handling the data inappropriately), the  Information Commissioner’s Office (ICO) may investigate the complaint.

So if you are not happy in the way consent has been sought, from you or your child, or you may be a parent who has not been informed by the school of its intent to process your child's biometric data, these are the procedures you can go through to hold the school to account.

Schools have been informed by the Department of Education how to comply with the law but I have already had a number of communications with parents who have forwarded me 'consent' communication/forms received from their children's school which do not comply with Department of Education guidelines.  

Some schools are not offering an alternative for children not using biometric systems, some schools hinting that if the consent form is not signed they will assume consent, schools making false assurances stating that no one else has access to that biometric data - which is incorrect because police can access school fingerprint biometric databases by making an access request (see Q50 and51) and not necessarily tell the parent or child.  Some schools claim that the data stored is not a fingerprint, which is true in the sense it is not a replica of their child's print, and not part of the Department of Education Guidelines - but the digital biometric data stored form a child acts like a fingerprint, it can identify like a fingerprint and can convict like a fingerprint.

One parent telephoned to say that her child, upon an induction day to high school, had been told by school staff that if Mummy did not sign the consent form the child would not be allowed in the canteen over dinner time to sit with their friends.  The child was understandably distressed by this and the parent obviously concerned. 

I hope these are isolated instances of bad practice but if you are not happy with how your school has acted in this, you have the above information to help decide the next course of action you wish to take or email me.