I asked a Freedom of Information request (FOIR) to North Ayrshire Council (NAC) and got a response here. It warrants further investigation on a few issues. Consent. Data Protection Impact Assessment. Cost and claims NAC make of the system to speed up lunch lines and being 'Covid safe'.
Consent. I have touched on this before but I am curious as to who is determining the age of the ability of the child to consent to using their facial biometrics to pay for food. In England and Wales where a school wants to take and process a school's biometric, for any child under 18, parental consent is required by legislation.
In NAC it seems there was a debate on consent... 12 or 14? Consideration, though I can't see how this marries up, was that 12 year olds can withhold data on what they eat to their parents therefore they can consent to having their biometrics used. Am I thick, because I'm not connecting this reasoning up??
But somehow, it appears from advice from the supplier, that in other schools they have opted for 14 - why? ...we don't know - but it's quicker and easier to facial scan kids who can give consent themselves than wait for parents to consent apparently. See below communications sent to me via FOIR response:
I was interviewed this morning on BBC Radio Scotland about consent, NAC are saying that they have a 97% uptake. I bet they do, children when asked for consent is simply invalid due to it not being able to be freely given due to the power of imbalance between the school and family, not wanting to be different and peer pressure.
And how do parents and children differentiate between the finer nuances of facial recognition essentially taken from a still photograph (FR), live facial recognition (LFR) taken from live video feeds and retrospective facial recognition (RFR) from non live video records? Parliament can barely eek this out privacy wise so how on earth can a child or parent without some hours research on the topic?
If parents and children could read the Data Protection Impact Assessment (DPIA) done on the system, all 16 pages of it with redactions about data sharing, they might not be so keen to use facial recognition.
But BBC Radio Scotland said, the 'kids and parents like it'. Erm, so what? Biometric technology used by children has been discussed in UK Parliament and at EU level and its deemed in legislations, DPA 2018 and GDPR, to be unlawful. There are lots of things we 'like' and some are legislated against for good reason where minors are involved.
Although only EU regulators have responded to schools using facial recognition and fingerprints to ban it and fine the schools using biometrics in France, Sweden and Poland.
Why isn't our regulator, the Information Commissioners Office doing this? A good question that I hope will be resolved soon enough.
Data Protection Impact Assessment - as I mentioned earlier, parts on data sharing are redacted. In order for full transparency I believe with such a new technology, potentially being unlawfully used, we should see exactly how it is being used.
Cost and claims - again redacted. This is our tax payers money, we should have a right to know under Freedom of information.
2 comments:
Hey Pippa, great work on this, thanks for all your hard work! I'm a privacy researcher and I've been looking into this as much as I can because I agree with you that the UK is sleepwalking into becoming a surveillance state. There are a couple of questions I've been wondering about since I heard about this scheme. Do you think they have chosen schools in Scotland because of the fact that the consent laws are slightly different? I think under EU law the age of consent for any online service is 16 - and that makes sense for pupils in S5 and S6 who should all be 16 at least (we all were when I was in school anyway) - most in S4 will probably still only be 15 for most of their time in that year group.
It also occurred to me that the very reason they're using schoolchildren for this (and in particular teenagers) might be to track natural developmental changes in a person's face - everyone changes most during that time of their lives. I suppose as long as they capture data on a daily basis to contribute to the template, then this would work to give a good idea of how much a person's face can change naturally, and therefore how much leeway should be given for a "bad hair day" or something.
Personally I'm going to spend the next while reading through their privacy policies and those of their affiliates, parent companies, subcontractors and subprocessors to see what data is exchanged (according to their declarations) and with whom - not just biometric data either. I will also be checking your blog for updates and working slowly through the 67 pages of the ICO opinion from June.
Keep up the good work!
Hi Steve,
Just caught your comment and apologies for delay in replying. Thank you for your comment.
"Do you think they have chosen schools in Scotland because of the fact that the consent laws are slightly different?" The supplier states their facial recognition system is in over 70 schools of which a small proportion are in Scotland, so it may appear not, although certainly the consent process (or lack of it) would mean it would be easier to implement in Scotland.
"It also occurred to me that the very reason they're using schoolchildren for this (and in particular teenagers) might be to track natural developmental changes in a person's face..." The facial recognition system used does track changes in the children's faces every 3 months and the algorithm adjusts accordingly. See this video https://vimeo.com/570313423 around 16-19 mins in.
It is not clear that the canteen supplier of the facial recognition has developed this specific, sophisticated, algorithm learning facial recognition product. The facial recognition element has been supplied for free to the schools that have offer me that date under Freedom of Information Request. The facial recognition element is constantly learning and I would humbly presume the developer of such technology would want that data to improve the product, as that's how technology progresses - though I have no evidence to state this is happening in this case.
For more information see my WhatDoTheyKnow Freedom fo Information page https://www.whatdotheyknow.com/user/pippa_king
Post a Comment