It's been a while...

January 2023 - after 15 months of the ICO looking into the use of facial recognition (FR) being used by schools, supplied by CRB Cunninghams, it deemed that the use of FR with children in schools was 'likely to have infringed data protection law' ...but the ICO were not taking any action.  

Instead they decided to write a Case Study on FR in schools - basically a 'how to do this with our blessings' piece.

After campaigning to get this completely inappropriate biometric technology out of schools for the last two decades the ICO's lack of action on this was a surprise and blow.  Here are a list of the breaches the ICO identified of GDPR and Data Protection legislation (all found here):

    Article 35             - Data Protection Impact Assessment

    Article 5 (1)(a)     - lawfulness, transparency, fair processing

    Article 5 (1)(e)     - storage

    Article 12             - child friendly language

    Article 13             - right to be informed

    Article 6 and 9     - data minimisation, lawfulness, transparency, fair processing

John Edwards the Information Commissioner is choosing to do nothing about the likely unlawful use of FR and biometric fingerprint systems in around 75% of UK secondary schools.

Ruling from around the EU on this are from Sweden, France, Poland and Bulgaria:

All above EU schools were found to be in breach far less than UK schools but yet John Edwards and his ICO team choose to do nothing about the use of the use of biometrics in schools here.

So imagine my surprise today, reading from Jon Baines at Mission de Reya, that the same John Edwards and team decide to "issue[s] enforcement notices ordering Serco Leisure and community leisure trusts to stop using FRT and fingerprint scanning to monitor workers’ attendance" and for only breaching Article 5 (1)(a), 6 and 9.  Serco have been given 3 months to halt their use of biometrics or face a £17.5m fine or 4% of Serco's annual worldwide turnover - phew!!  Seems the ICO are really not happy bunnies with Serco using biometric technology on their employees.   

What about the millions of children using biometric technology in schools?   Looks like the ICO is not bothered about kids biometrics - obviously.  Maybe the fines aren't as lucrative, maybe the optics look bad fining schools?  ...who knows.

Having been utterly deflated after the ICO's reaction to schools using FR (and therefore fingerprints) I presumed I would have to wait until John Edwards is replaced in 2027 for a more deserved ruling, as where could I go if your own Information Commissioner is not enforcing the very legislation he is paid for?

Now it seems the ICO is enforcing the legislation with some bias here, something I'm sure Mr Edwards isn't meant to do.