North Ayrshire Council's FOI responses...

I asked a Freedom of Information request (FOIR) to North Ayrshire Council (NAC) and got a response here.  It warrants further investigation on a few issues.  Consent.  Data Protection Impact Assessment.  Cost and claims NAC make of the system to speed up lunch lines and being 'Covid safe'.

Consent.  I have touched on this before but I am curious as to who is determining the age of the ability of the child to consent to using their facial biometrics to pay for food.  In England and Wales where a school wants to take and process a school's biometric, for any child under 18, parental consent is required by legislation. 

In NAC it seems there was a debate on consent... 12 or 14?  Consideration, though I can't see how this marries up, was that 12 year olds can withhold data on what they eat to their parents therefore they can consent to having their biometrics used.  Am I thick, because I'm not connecting this reasoning up??

But somehow, it appears from advice from the supplier, that in other schools they have opted for 14 - why? ...we don't know - but it's quicker and easier to facial scan kids who can give consent themselves than wait for parents to consent apparently.  See below communications sent to me via FOIR response:

I was interviewed this morning on BBC Radio Scotland about consent, NAC are saying that they have a 97% uptake.  I bet they do, children when asked for consent is simply invalid due to it not being able to be freely given due to the power of imbalance between the school and family, not wanting to be different and peer pressure.  

And how do parents and children differentiate between the finer nuances of facial recognition essentially taken from a still photograph (FR), live facial recognition (LFR) taken from live video feeds and retrospective facial recognition (RFR)  from non live video records?  Parliament can barely eek this out privacy wise so how on earth can a child or parent without some hours research on the topic?

If parents and children could read the Data Protection Impact Assessment (DPIA) done on the system, all 16 pages of it with redactions about data sharing, they might not be so keen to use facial recognition.

But BBC Radio Scotland said, the 'kids and parents like it'.  Erm, so what?  Biometric technology used by children has been discussed in UK Parliament and at EU level and its deemed in legislations, DPA 2018 and GDPR, to be unlawful.  There are lots of things we 'like' and some are legislated against for good reason where minors are involved.

Although only EU regulators have responded to schools using facial recognition and fingerprints to ban it and fine the schools using biometrics in France, Sweden and Poland.  

Why isn't our regulator, the Information Commissioners Office doing this?  A good question that I hope will be resolved soon enough.

Data Protection Impact Assessment - as I mentioned earlier, parts on data sharing are redacted.  In order for full transparency I believe with such a new technology, potentially being unlawfully used, we should see exactly how it is being used.

Cost and claims - again redacted.  This is our tax payers money, we should have a right to know under Freedom of information.

Justification of using FR to 'speed' up lunch lines and covid safe - I think I'd like to see a cost benefit analysis on this 'speed' claim in comparison to the older system and see some statistics on this.  How many seconds are the schools going to save and what will they do with the new found time in the school day?

Same with the covid safe claim, it maybe is who knows?  (I did think because of kids wearing masks that this was an aerosol transmission...?)

A new FOIR with further questions is here.

What is the current situation with facial recognition in UK schools?

This situation with facial recognition technology use in UK schools is unknown, as is the case for the amount of schools using pupils biometric fingerprints.  

Using the Freedom of Information Act and catching the media on this as it happens seems to be the only way  to see how this technology is being rolled out, as schools are under no obligation to inform the Information Commissioner's Office (ICO), who oversees the Data Protection Act (DPA) 2018 and the General Data Protection Regulations (GDPR), that they are taking and processing children's biometric data.

As of this week it appears that North Ayrshire Council, Scotland, are in the process of implementing facial recognition in to its 9 high schools and West Lothian Council, also in Scotland, are looking at introducing facial recognition technology in its 11 high schools - a total of approximately 20,000 students.

In England there are:

Kingsmeadow Community Comprehensive School,  Gateshead

Canon Slade CofE School, Bolton

Murray Park Community School, Derby  - Update 20/10/21:  I have been contacted by Realsmart who have stated, "Realsmart do not provide any systems that work with biometrics". I welcome more clarification on this and will post accordingly.

Langley Park School for Girls, Beckenham

...another 5,000 students and I suspect there are quite a few more schools too.

Consent and Legalities

England and Wales - explicit consent from parents must be sought for a school to take and process a child's biometric, which was, up to now, mainly in the form of a fingerprint template, this now however extends to photographs used for a facial recognition system.  This is law and the legislation covering a schools obligation to gain consent is in the Protection of Freedoms Act 2012 (PoFA).

Both parents need to consent and so does the child.  Any child or parent not consenting overrules the consent of a parent that does consent.  An alternative to the biometric system must also be provided and this alternative option should be made aware to the parent/s child - see page 10 of the governments 'Protection of biometric information of children in schools and colleges' advice to schools.

Scotland and Northern Ireland - here the PoFA 2012 does not apply.  Scottish schools have tended to ask for consent in line with the PoFA but recently seem to have taken it upon themselves, from exactly whose advice is unknown at this time, to presume that S1-S3 pupils need parental consent and S4-S6 pupils can consent themselves.  See North Ayrshire's consent forms S1-S3 and S4-S6.  

S4 students are 14/15 years old, under PoFA no student under the age of 18 can consent to their biometrics being processed by schools.

However, this consent process becomes redundant as indications from Europe show that facial recognition in schools is in direct contravention of the EU legislation GDPR.  Rulings against using facial recognition in schools has been acknowledged by our UK ICO in their June 2021 report, page 22, 'The use of live facial recognition technology in public places':

The report went on to state that: "The research found support for the government imposing restrictions on the use of FRT [facial recognition technology] by the police (55%) and in schools (68%). The Ada Lovelace Institute recommends a voluntary pause on the sale of FRT to enable public engagement and consultation to take place." ...in which case why are UK schools spending tax payers money on this legally questionable technology?

The legalities of facial recognition in UK schools is unknown.  We are still subject to the EU GDPR and under that facial recognition use in schools has been in contravention of the strict use of biometrics with minors that the EU Act cites.  

Our ICO appears unable to answer what communications they have had with educational establishments or companies supplying facial recognition to schools.  A recent of Freedom of Information on this was refused on 30th September 2021, citing Section 12, exceeding costs and time - I am hopeful there may be a disclosure of some information though - see here.

See WhatDoTheyKnow for Freedom of Information requests on this topic.

Facial recognition arrives in UK schools

Facial recognition is emerging in UK schools for canteen payments.  The promise of the technology is "to keep pupils safe from allergies and keep the school Covid secure" and to speed up lunch lines, reducing times from however many seconds it was before, to only 5 seconds per pupil 'serve time' with facial recognition technology.  This new biometric technology is, according to the Business Manager at Kingsmeadow School in Gateshead:

 "...just fast!  Better than fingerprints"

The fortuitous supplier of the emerging facial recognition technology is CRB Cunninghams.

Gosh, even faster than fingerprints!  Wasn't that one of the main reasons to introduce biometric technology two plus decades ago?  Because pupils can't forget a thumb but can forget a 4 digit pin or swipe card, hence a thumb on a scanner is faster, right?  Epic fail fingerprint technology - you're obviously just not fast enough.  (Erm... if students can forget a 4 digit PIN what hope have they of passing any exams if their memory is that bad!   Anyway...)

Then is there is the 'Covid secure' reason.  No need to touch anything at the point of sale.  But then a swipe card ticks those boxes too.  The facial recognition technology even works with a mask/face covering... but then so does a PIN or a swipe card.  Plus the hundreds of students passing through a lunch line will have walked through school corridors, placing their hands on the corridor swing doors to get to the dining hall, etc, so I'm not sure the 'Covid secure' reason stacks up.

Then there's the old bullying issue.  According to Ed Tech providers of cashless catering systems, cash in schools = bullying issues.  Well, if that happens the school must sort it out.  Having cashless catering systems in schools won't solve any bullying issues.  As one Reddit user asks 'how can the computer tell if the person isn't being held there by a bully'?  Good question.

History

According to this article, describing CRB Cunninghams recent introduction of facial recognition to school lunch lines, "CRB Cunninghams have used biometric data since 2008 on the cashless catering system".  Erm not quite so.  Cunninghams have been supplying fingerprint biometric systems to schools in Angus, Scotland, since 1999 according to a Freedom of Information request (FOIR) answer from Angus Council.  As far as is known, this the first use of biometric technology with children in schools in the UK, Europe, USA, Canada, and the western world.

Angus Council FOIR response, September 2018:

Cunninghams introduced biometric technology in schools 22 years ago, before the technology was being used anywhere else regularly in society.  Now it's seems they are at the forefront today pioneering facial recognition technology. 

Lucky Cunninghams, first for both biometric fingerprint and now commercially viable biometric facial recognition technology for kids in schools.  Though by no means the only supplier now.  

Innovate, supplying Langley Park School for Girls in Bromley.   

Canon Slade School Parent Facial Recognition Pdf in Bolton using Cunninghams, and Murray Park Community School Parent Facial Recognition Pdf in Derby using Realsmart  - Update 20/10/21:  I have been contacted by Realsmart who have stated, "Realsmart do not provide any systems that work with biometrics". I welcome more clarification on this and will post accordingly 

I stated commercially viable earlier, as facial recognition was trialled in 2010 in ten UK schools by Aurora, for registration purposes, in Northamptonshire, Cambridgeshire and Hertfordshire.  It was quickly ditched as it just wasn't fit for purpose.  Clearly the technology has matured and is now deemed fit for use on children in schools.

Legalities and consent

Well, this is where it gets interesting and complex and warrants another post really but for a quick view see here.  I'll expand on this more in another post.