Tuesday, October 19, 2021

North Ayrshire Council's FOI responses...

I asked a Freedom of Information request (FOIR) to North Ayrshire Council (NAC) and got a response here.  It warrants further investigation on a few issues.  Consent.  Data Protection Impact Assessment.  Cost and claims NAC make of the system to speed up lunch lines and being 'Covid safe'.

Consent.  I have touched on this before but I am curious as to who is determining the age of the ability of the child to consent to using their facial biometrics to pay for food.  In England and Wales where a school wants to take and process a school's biometric, for any child under 18, parental consent is required by legislation

In NAC it seems there was a debate on consent... 12 or 14?  Consideration, though I can't see how this marries up, was that 12 year olds can withhold data on what they eat to their parents therefore they can consent to having their biometrics used.  Am I thick, because I'm not connecting this reasoning up??

But somehow, it appears from advice from the supplier, that in other schools they have opted for 14 - why? ...we don't know - but it's quicker and easier to facial scan kids who can give consent themselves than wait for parents to consent apparently.  See below communications sent to me via FOIR response:

I was interviewed this morning on BBC Radio Scotland about consent, NAC are saying that they have a 97% uptake.  I bet they do, children when asked for consent is simply invalid due to it not being able to be freely given due to the power of imbalance between the school and family, not wanting to be different and peer pressure.  

And how do parents and children differentiate between the finer nuances of facial recognition essentially taken from a still photograph (FR), live facial recognition (LFR) taken from live video feeds and retrospective facial recognition (RFR)  from non live video records?  Parliament can barely eek this out privacy wise so how on earth can a child or parent without some hours research on the topic?

If parents and children could read the Data Protection Impact Assessment (DPIA) done on the system, all 16 pages of it with redactions about data sharing, they might not be so keen to use facial recognition.

But BBC Radio Scotland said, the 'kids and parents like it'.  Erm, so what?  Biometric technology used by children has been discussed in UK Parliament and at EU level and its deemed in legislations, DPA 2018 and GDPR, to be unlawful.  There are lots of things we 'like' and some are legislated against for good reason where minors are involved.

Although only EU regulators have responded to schools using facial recognition and fingerprints to ban it and fine the schools using biometrics in France, Sweden and Poland.  

Why isn't our regulator, the Information Commissioners Office doing this?  A good question that I hope will be resolved soon enough.

Data Protection Impact Assessment - as I mentioned earlier, parts on data sharing are redacted.  In order for full transparency I believe with such a new technology, potentially being unlawfully used, we should see exactly how it is being used.

Cost and claims - again redacted.  This is our tax payers money, we should have a right to know under Freedom of information.

Justification of using FR to 'speed' up lunch lines and covid safe - I think I'd like to see a cost benefit analysis on this 'speed' claim in comparison to the older system and see some statistics on this.  How many seconds are the schools going to save and what will they do with the new found time in the school day?

Same with the covid safe claim, it maybe is who knows?  (I did think because of kids wearing masks that this was an aerosol transmission...?)

A new FOIR with further questions is here.

Friday, October 01, 2021

What is the current situation with facial recognition in UK schools?

This situation with facial recognition technology use in UK schools is unknown, as is the case for the amount of schools using pupils biometric fingerprints.  

Using the Freedom of Information Act and catching the media on this as it happens seems to be the only way  to see how this technology is being rolled out, as schools are under no obligation to inform the Information Commissioner's Office (ICO), who oversees the Data Protection Act (DPA) 2018 and the General Data Protection Regulations (GDPR), that they are taking and processing children's biometric data.

As of this week it appears that North Ayrshire Council, Scotland, are in the process of implementing facial recognition in to its 9 high schools and West Lothian Council, also in Scotland, are looking at introducing facial recognition technology in its 11 high schools - a total of approximately 20,000 students.

In England there are:

Kingsmeadow Community Comprehensive School,  Gateshead

Canon Slade CofE School, Bolton

Murray Park Community School, Derby  - Update 20/10/21:  I have been contacted by Realsmart who have stated, "Realsmart do not provide any systems that work with biometrics". I welcome more clarification on this and will post accordingly.

Langley Park School for Girls, Beckenham

...another 5,000 students and I suspect there are quite a few more schools too.

Consent and Legalities

England and Wales - explicit consent from parents must be sought for a school to take and process a child's biometric, which was, up to now, mainly in the form of a fingerprint template, this now however extends to photographs used for a facial recognition system.  This is law and the legislation covering a schools obligation to gain consent is in the Protection of Freedoms Act 2012 (PoFA).

Both parents need to consent and so does the child.  Any child or parent not consenting overrules the consent of a parent that does consent.  An alternative to the biometric system must also be provided and this alternative option should be made aware to the parent/s child - see page 10 of the governments 'Protection of biometric information of children in schools and colleges' advice to schools.

Scotland and Northern Ireland - here the PoFA 2012 does not apply.  Scottish schools have tended to ask for consent in line with the PoFA but recently seem to have taken it upon themselves, from exactly whose advice is unknown at this time, to presume that S1-S3 pupils need parental consent and S4-S6 pupils can consent themselves.  See North Ayrshire's consent forms S1-S3 and S4-S6.  

S4 students are 14/15 years old, under PoFA no student under the age of 18 can consent to their biometrics being processed by schools.

However, this consent process becomes redundant as indications from Europe show that facial recognition in schools is in direct contravention of the EU legislation GDPR.  Rulings against using facial recognition in schools has been acknowledged by our UK ICO in their June 2021 report, page 22, 'The use of live facial recognition technology in public places':

The report went on to state that: "The research found support for the government imposing restrictions on the use of FRT [facial recognition technology] by the police (55%) and in schools (68%). The Ada Lovelace Institute recommends a voluntary pause on the sale of FRT to enable public engagement and consultation to take place." ...in which case why are UK schools spending tax payers money on this legally questionable technology?

The legalities of facial recognition in UK schools is unknown.  We are still subject to the EU GDPR and under that facial recognition use in schools has been in contravention of the strict use of biometrics with minors that the EU Act cites.  

Our ICO appears unable to answer what communications they have had with educational establishments or companies supplying facial recognition to schools.  A recent of Freedom of Information on this was refused on 30th September 2021, citing Section 12, exceeding costs and time - I am hopeful there may be a disclosure of some information though - see here.