Biometric fingerprint readers ditched for hygiene reasons... to be replaced by contactless biometric systems?

On Twitter schools have been spotted ditching biometric fingerprint readers for contactless cards due to hygiene reasons, which completely makes sense as this was one of the issues raised initially over 15 years ago when fingerprint scanners started appearing in schools.  

Though some biometric suppliers have been keen to stress that sterilising fingers before using biometric scanners is good to keep children 'safe'.

So as good as it is to see fingerprint scanners be replaced by less personally intrusive methods it does open the way for a contactless biometric system, i.e. facial recognition, to replace the touch fingerprint pad.

Which seems to be, somewhat, what has happened here at a UTC school in Leeds, UK, where Years 10 (14/15 year old) and Year 12 (17/18 years old) students have started school after having been shut since mid March 2020.  

A combined facial recognition and thermal imaging system has been installed to check student's temperature to identify each student whose temperature is taken.  However it has to be said they have ditched their fingerprint scanners for contactless cards, which was used for building entry, class registration and lunch payment.  The newly installed facial recognition has not directly replaced, on first glances, the fingerprint system but it is still registering the students with their biometric data.

We have also installed a high spec thermal camera in the reception area. This camera uses facial recognition technology to enable unobtrusive thermal imaging and temperature measurements of students and staff. An alert is issued to the Principal if someone’s temperature is above a certain level.

Every school in England and Wales that wishes to process an under 18 year old's biometric data, including facial recognition, needs explicit written parental consent to do so and it is uncertain whether this particular UTC has done that.  When questioned specifically on whether they had gained parental consent, as per the Protection of Freedoms Act 2012, the UTC replied:

Albeit it this is a reply on Twitter (which now looks to be unavailable) but it is not glaringly obvious that the school is operating this biometric system in line with UK legislation specifically aimed at schools processing children's biometric data - The Protection of Freedoms Act 2012.  

The use of facial recognition in UK schools is also questionable under GDPR, the EU General Data Protection Regulations 2018.  Schools in France have been advised not to use facial recognition and a school in Sweden was fined for using the technology.  GDPR does not change at country borders or whether we are Brexiting so the use of facial recognition technology is certainly questionable in this UK school.

There are good reasons legislations are specifically put in place to protect children biometric data being unnecessarily processed and they should be adhered to.  

Fine for processing students’ fingerprints imposed on a school

A statement, issuing a fine, to a school from Poland’s Personal Data Protection Office (UODO), the equivalent to our Information Commissioner's Office (ICO), found the school to be in breach of the General Data Protection Regulations (GDPR) for using children's fingerprint data to allow access to their canteen.  The ruling stated that:

"The school processed special categories of data (biometric data) of 680 children without a legal basis, whereas in fact it could use other forms of students identification."

and

"...it is important to stress that the processing of biometric data is not essential for achieving the goal of identifying a child’s entitlement to receive lunch. The school may carry out the identification by other means that do not interfere so much in the child’s privacy. Moreover, the school makes it possible to use the services of the school canteen not only by means of fingerprints verification, but also electronic cards, or by giving the name and contract number. Thus, in the school, there are alternative forms of identification of the child’s entitlement to receive lunch."

Here in the UK biometric fingerprint readers have been used in schools since 1999.  Up to 2012 schools were using children's fingerprints quite often without informing parents or asking their permission, as a consequence after some pressure upon the UK Government to address this, legislation was passed in 2012 requiring schools to obtain parental permission to process their child's biometric data and offer an alternative means to the biometric system. 

However, a survey done by children's data privicacy group defenddigitalme found that even after the 2012 legislation parents were still unaware of options not to use the fingerprint system.

Children's biometric data needs to be secure for the child's lifetime - decades.  It does seem excessive to use biometric data for daily mundane tasks in school, when another form of ID is perfectly acceptable - we have expressed that view since 2005.

This point was also expressed in the UODO report according to Venturebeat:

'The final decision cited numerous facets of GDPR, including recital 38, which refers to specific provisions made for data protection of children, "it should be emphasised that children require special protection of personal data, as they may be less aware of the risks, consequences, safeguards, and rights they have in connection with the processing of personal data" the report found.'

If the Polish Data Protection Office have ruled this use of children's fingerprint biometrics as a violation of GDPR then presumably the same would apply to any school using such systems in the UK.

This is absolutely a GDPR issue we will be following up here in the UK.

The English text of the UODO decision is here and the Polish version here.

Schools asking for consent to process children's biometrics

I am getting a lot of emails from concerned parents of children leaving primary school to go to secondary school with the way that the secondary schools are asking for consent to use their child's biometrics - fingerprint, fingertip data - and not offering an alternative method to access the catering, library, registration, etc, system.  In this parents are feeling that their request for consent is coerced.

Schools MUST offer an alternative to biometrics.  The Protection of Freedoms Act 2012, Chapter 2, Section 27 (7) states that: 

The relevant authority must ensure that reasonable alternative means are available by which the child may do, or be subject to, anything which the child would have been able to do, or be subject to, had the child’s biometric information been processed.

Unfortunately some parents have been made to feel from schools that they are being unreasonable in not giving consent and that they are they only one objecting to biometric consent.  You are not a 'problem parent'.  You and your child have a right to not give the school biometric data - data that is absolutely unique, personal, highly precious and that needs to be secure for the child's life time.

Parents feeling isolated by a school is a story I have heard over the past 10 years so many times from so many parents - you are not alone at all.  I myself last year, when my child entered sixth form, was told by the Principal that I was the only parent objecting to them using my child's biometrics - I was not.

Quite often the supplier of the biometric system to the school will also offer alternative means of accessing the system they provide.  Examples are swipe card, PIN number and taking the names of the children at the point of sale at the till, so it shouldn't be an inconvenience for the school to offer alternative means of identification.

The new EU General Data Protection Regulations is law for every member state of the EU, including us.  It came into law 27th April 2016.  Schools are subject to this.

Point 32 states:

Consent should be given by a clear affirmative act establishing a freely given, specific, informed and unambiguous indication of the data subject's agreement to the processing of personal data relating to him or her, such as by a written statement, including by electronic means, or an oral statement.

Point 42 states:

Consent should not be regarded as freely given if the data subject has no genuine or free choice or is unable to refuse or withdraw consent without detriment.

If anyone has any concerns or questions please don't hesitate to get in touch, I'm really happy to help if I can.

Consider carefully when consenting to children's biometrics in schools

'Turning fingers into keys'
Credit: kaprik/shutterstock.com

There is a great article written by Brian Patton, University of Oxford, entitled "The trouble with taking biometric technology into schools", that appeared in The Conversation earlier this month, which every parent and student should read before considering using their biometrics in schools.

Other than copy most of the article into this post I would urge a read of the article which succinctly discusses security, effectiveness, implications of a data breach and consent.  

Schools and biometric companies supplying schools are keen to reassure parents and students that it is not a (pictorial) fingerprint that is being stored but simply a number string -  a number string completely unique and specific to your child's 'bio' body 'metric' measure.

Patton makes the valid point that:

"For other biometric data it's important to remember that what is being matched within the computer is not, say, one fingerprint against another. It is a set of data drawn from the features of the scanned body part – a numerical abstraction. Steal this key and you have effectively stolen that part of the person."

He also goes on to say that,

"...a  data breach will mean these type of scans will be untrustworthy for the pupils – for the rest of their lives.

And therein lies another issue: with the potential for life-long consequences, are pupils, some below the age of 16, competent to opt in to such a scheme? And what of those who opt out? It's one thing to ask adults to weigh up the balance between convenience and risk, but there are two likely issues that would make this harder in schools. There is an inbalance of power between those wanting to implement the technology and those subject to it.  This raises serious concerns about informed consent – perhaps one of the reasons why in 2012 using biometrics was banned in English state schoolswithout parents' consent."

It is unclear if there have been any data breaches of biometric databases in schools as the UK Information Commissioner's Office (responsible for the UK Data Protection Act), in response to a Freedom of Information request regarding compromised biometric databases specifically in education, are "unable to conduct an electronic search of our system using the term ‘biometric’" and so could not supply information on if there has been any data breaches of children's biometric data in schools.

There are potentially long term, unknown consequences to this biometric technology used on the youngest generation in society - we are experimenting with it on our children in schools for daily activities that can be easily undertaken, quite adequately, without the use of biometrics.

I guess an individual will only know when their biometric data has been compromised when in the future they hit a problem regarding their biometrics.  How will they know when it was compromised, by whom and where their very personal digital identity has gone? 

In the words of Brian Drury, IT Security Consultant:

"Once a child has touched a [biometric] scanner they will be at the mercy of the matching algorithm for the rest of their lives."

Biometric facial recognition in education

Facial recognition is a biometric technology not much used in education.  If it is to be used it has been mooted that it will track children’s facial expressions to gauge response to lessons or on screen learning but it is now starting to creep into identifying and verification of students.

In the UK, facial recognition systems are not used in schools with the exception of one small instance of facial recognition being used in education in 2010 at the City of Ely Community College for registration purposes.  The college no longer uses the facial recognition system as it wasn’t suitable for the purpose intended; the scheme ran for around an academic year before being scrapped.

U-T San Diego file photo

Now the technology has matured over the past 5 years, facial recognition is coming back into education.  Encinitas Union School District, in California, students will log in to their iPads via facial recognition technology for a first-of-its-kind pilot project.  This involves the iPad scanning the child’s face every 60 seconds claiming to help kids log on to technology and for them not to forget their passwords.  If a child cannot be taught to remember their password then what hope is there for the schools to actually educate them!   This is not about remembering passwords or saving time logging on.  This is about constantly verifying the student so that the data controllers running the educational software can accurately gather data on that individual.  So here facial recognition is being used to identify and continuously verify.  Not without controversy though, parents are not happy with this constant biometric facial scanning for a number of reasons, invasion of privacy of minors and a that it a waste of money, with a petition set up against the facial recognition technology being used in this schools district.

From the San Diego Union Tribune:

“Encinitas Union launched its iPad program in 2012, equipping each third-through sixth-grade student with a device to use for school work and lessons. Since then, the district has put iPads into the hands of all of its 5,400 students, at a cost of $2.7 million.
“It’s creepy to take a photograph of a kid every 60 seconds,” said Gil Saidy, who has a third grade son at Flora Vista Elementary School. “I don’t trust them. I don’t want these roving cameras in my house.”

“It’s a momma-bear’s instinct to protect their child. I just don’t know who has access to the face scans,” said another parent, Darcy Brandon. “Where is the data being stored?”

The pilot program would start with 100 students and, if successful, the technology could ultimately be added to all district iPads. Parents must opt-in to have their child use biometrics.”

At the very least it is an opt-in scheme so hopefully most parents will have the common sense to say ‘no’ to this unnecessary use of facial recognition, desensitising our kids to constant monitoring.

Unlike fingerprint or palm scanning biometrics used in schools, facial recognition is a non-participatory biometric with the ubiquitous scanning happening without conscious involvement.  What else is the facial scanning revealing?   

Educational companies are lining up with emotional face biometrics coming into education gauging how a student is feeling, where their eyes are looking, how they are reacting.  An article from September 2013 reports that SensorStar Labs have a product that records “When the student is looking up at the teacher, the teacher score goes up.  If she looks down at the computer, the computer score goes up. So we’re tracking facial expressions.  If she makes a smile, it might be indicative that is enthusiastic about the topic.”

Facial recognition has also been introduced at St Mary's High School, St Louis, for 'safety' reasons only allowing in to school registered members on the database.  This is thought to be the first instance of facial recognition being used in this way in the States.  There is also a 'watch list' of peoples faces not allowed in the school that alerts law enforcement if those persons of interest try to enter.  Presumably opting out of this facial recognition system is not an option for pupils as it would deny them entry to education.

Facial recognition seems to be emerging as the new educational biometric.  Not for the student convenience or safety, more about verification of data capture... who is where, doing what and when. 

Children are the most data mined section of our society.  Biometric facial verification more accurately authenticates the data grab and profiling of our kids.  

Florida bans biometrics in schools, and the industry's "emerging fight" against it

It has been interesting to follow the progress of the Florida legislature to ban schools from taking and processing children's biometrics, the process of which started late last year.  It will be the first time in the USA or worldwide that biometrics have been banned in schools, when Gov Rick Scott signs the bill.  Some have argued that the UK Protection of Freedoms Act 2012 should have gone this far but instead we have that schools can only process a child's biometric data with written parental consent.  However, how parents are fully informed to make that consent still leaves the process open to spin and ambiguity surrounding the technology and its capabilities.

In Florida three bills were filed dealing with Florida schools using biometrics, during September and October 2013. With one, SB188 relating to education data privacy, being passed on April 11 2014. It reads (see lines 49-66):

(1) An agency or institution as defined in s.1002.22(1) may not:

(a) Collect, obtain, or retain information on the political affiliation, voting history, religious affiliation, or biometric information of a student or a parent or sibling of the student.  

The bill passed by 113 Yeas to 1 Nay. 

This news has been met by the biometric industry in the United States with fears it may lead to other states approving similar bills.  There are already laws in other states concerning parental consent for schools to use biometric technology but SB188 goes one step further, by banning it.

Many experts, privacy organisations and others have aired concerns over children using their biometrics in school for a variety of reasons:
     - Security of data - What does a child do if their biometric data is compromised?  How and when would that become apparent?  Leaps and bounds in technology cannot possibly foresee how this could play out in the decades to come.
     - The personal information that is held against the biometric - Reading or eating habits, who views that?

     - The sharing of biometric data and personal data stored against it - Government agencies now routinely take biometric data and upload it to other databases.

     - The subtle psychological message using this technology gives to children, that to gain access to books/knowledge, food/money, normalises the use of biometrics for mundane yet essential activities.   

Janet Kephart of the Secure Identity and Biometrics Association (SIBA), set up in February 2014, states that one of four biggest challenges of 2014 is to help clear the air in "a newly emerging fight in state legislatures whereby there is a push to ban biometrics in public schools".  

Kephart claims that, "Biometric technologies do not store identities; they store templates".  Surely template/s based on a particular person are designed to identify said person, otherwise how would the system work?  Then the next statement contradicts her earlier statement by saying, "To further assure privacy, names are kept separate from the biometric templates, encrypted, and not directly linked with the biometric data".  Yes, so they are linked then but encrypted.  Indeed, one might liken this to doublespeak?

She then, unsurprisingly, states the usual line to be seen and heard in the spiel dished out to schools in the USA and UK by biometric vendors, "...the outline of fingerprints aren’t stored like an image – they’re turned into a set of series of numbers that can’t be reverse engineered."  Yes, a set of numbers that is digitally transferable between databases.

With regards to Florida banning biometrics in schools (with SIBA only being set up two months earlier with a view to, "educate folks about the reality of biometrics, bridging the gap between Washington and the industry" , maybe SIBA was set up because of SB188?) Janet Kephart states:

“Nobody in Florida decided to do due diligence on this... [presumably she has proof of this allegation]  No one clearly went out and asked how biometric technology actually works … nobody asked the question. It was just basic public servant due diligence that they didn’t do and there’s really no excuse for that.”

Just a minute... where was the "due diligence" of the biometric industry from 2001 onwards effectively testing biometric technology on children by fingerprinting 4 year olds to get a library book out, using infrared palm scanners trialled on primary school children in 2006 so they could eat, iris scanning children for lunch lines in 2007, facial scanning kids in 2010 to stop them from turning up to school late, voice biometric planned in 2007 for students, and (partly what prompted SB188) a Florida school district iris scanning 700+ children to travel on a bus?  All without parental consent or appropiate discussion, hence the legislation in the US States and the UK.

And SIBA want to talk about due diligence?   An apology would be more fitting.

Let's tell it how it really is.  In this article is an astonishing, yet bluntly open, account of why Saudi Arabia are introducing biometrics in schools, explaining below the exact reasons for biometrics and CCTV.  Surveillance.  It is a "form of supervision", to" install a sense of discipline", to "track children", to make them "respect regulations" and gain "better productivity".  At least there is some honesty here, more than we have had from the biometric industry and government on this issue in the US and UK for the past decade.

Kevin Townsend, original founder of ITsecurity.com, puts it most succinctly in his March 2014 article - Why we must keep biometrics out of schools - definitely worth a read.

Swalecliffe Primary running out childrens biometrics for catering, registration, library and printing - caterer supplies the biometric system

After a few years of biometric vendors steering clear of selling biometrics to primary schools (it seemed that 'fingerprinting' younger children was less palatable that older children), Swalecliffe Community Primary School have decided to role out biometric technology so the children there can eat lunch and potentially print documents, log their registration and take library books out.

After sending Swalecliffe a Freedom of Information request, it turns out that surprisingly the system was not paid for by the school, instead the generous catering company GS Plus (the school caterers) are providing the system.  Which begs the question - who is the data controller?  Who exactly is processing the children's biometric data - the catering company or the school?  Seemingly also the biometric software the caterer is providing also will be used for registration... so is the catering company branching out into registration or is another company providing that?

The school did not effectively communicate to parents that the child had the right to refuse this, instead flanneling the issue up in an "e [electronic?] safety" discussion within school.  The template Department of Education letters (see page 14) do not advise this.  In their template letters this is communicated unambiguously to the parents in writing.

As always biometrics are used as a solution to a problem, and indeed the technology is effective at authenticating users, but the efficiencies come with the system not the authentication process.

The school justifying the introduction of biometrics by apparently "ensuing greater" safeguarding is an emotive, and I find a slightly distasteful, use of language (unless the school really did have child safety issues?).  Unfortunately "safeguarding" is a word that is overused to the point of almost dangerous dilution of the meaning of it, especially when it is used to effectively 'sell' a system to parents.  Other less invasive, proportional identification processes can be used to ensure equal safety of children - especially with young children, whose biometric data had to be ubersecure, and not compromised at their early age.

See my comments in red below.  Another Freedom of Information request will be sent to the school as this throws up more questions (as is often the case) to gain clarity of how who has access to the children's biometric data, i.e. who is the data controller, what companies are involved and who is ultimately actually paying for this?

I can't really imagine the caterer is paying for this altruistically... (?)  I'm sure the tax payer will be propping this up.  Commercial companies do not survive by 'gifting' computer hardware/software to schools.  The cost will be obviously worked into the price of the contract or meals.


24 Jan 2014

Dear Swalecliffe Community Primary School,

Under the Freedom of Information Act please could you supply the following information within 20 working days.

As per the article
http://www.canterburytimes.co.uk/School-swaps-ditches-dinner-money-woes-hi-tech/story-20343882-detail/story.html#ixzz2o2awFg5z


1) In the above article it is quoted that the biometric system
 would “save the school essential funds”. Please advise:
i) how this would save the school essential funds

Swalecliffe Answer: As a school we are responsible for any debt accrued by parents not paying for the meals their children have. This is part of any school’s meals contract. 
In addition we require an admin assistant to manage the monies coming into school, sending the debt letters, checking the registers and then making phone calls to parents who still haven’t paid their debt. In total this amounts to approximately 15 hours per week of school admin time. This does include the time of the contractor’s cash collector which obviously impacts on the meal prices.


ii) the amount of funds estimated to be saved per year.


Swalecliffe Answer: Admin costs: £7,098 per annum
Debt costs: £1,200 per year on average each year since 2009 (although these costs have been increasing with a debt of £1,300 from September 2013 – December 2014)

33 weeks x 15 hours a week = 495 hours

£7098 divided by 495 = £14.33 per hour (incl physical expenses i.e. letters)

Will a member of staff loose 15 hours a week from their employment i.e. will someone be financially worse off?

iii) the cost benefit analysis done showing savings to the school.



Swalecliffe Answer: As above


2) Please advise the cost of the biometric system

Swalecliffe Answer: The details of this are not transparent to the school because the system is being provided by the school caterers with no costs incurred by the school 

Nice.  Just a thought but perhaps the school caterer could have subsidised the debt incurred by the missed payments rather that incur more debt by providing a biometric authentication system?    

So then who is the data controller then and who has access to the children's biometrics?


3) Please advise any ongoing licensing or maintenance costs

Swalecliffe Answer: There are no specific costs linked to the biometric system and cashless catering for schools. However as the software is now in school we have decided to upgraded our registration system, combining the two together to make morning registration more efficient and ensure even greater health and safety and safeguarding procedures within the school. This has cost the school £480 per annum but will also save us £48 per annum as we wont be using other software we currently purchase. 

How can biometric technology ensure *more* health and safety.  I'd have thought the hygiene of the scanners having hundreds of fingerprints on them (not to mention the added expense of wiping them clean) would have created a health risk.  Safeguarding... how many issues have the school had with 'safeguarding procedure' at registration time to justify a biometric registration system?


4) Please supply the documents sent to parents for meetings and
letters sent about the biometric system, including letters sent 
regarding parental consent.

Swalecliffe Answer: Please find attached [documents need to be provided externally]

Another post on this topic is warranted as the Head Teacher's comments regarding the alternative identification offered is unorthodox and not a response I've seen before.


5) Please show how the school communicated to the students that 
they had a right to refuse to use the biometric system.

Swalecliffe Answer: The system was shared and talked about in an assembly and by the class teachers as part of our e safety and ICT day in school. The children were asked to talk about it at home and decide with their parents what was right for them. During the actual process of registering for biometrics the staff were very careful to ensure that if any child was worried or anxious that they stopped and spoke to the parents before taking the reading. This only occurred with one child who has a specific learning difficulty and Asperger’s Syndrome. The children were very excited about the process. 


6) Please advise what the “right information” was given by the
 school to parents who had concerns about the system

Swalecliffe Answer: Please see the documents sent to parents. Following our information sessions and our drop ins we collated the most frequently asked questions and shared them with the whole parent body.

Again I will deal with this in another post, details given were inaccurate - details to follow.  Suffice to say I will point this out to the school ASAP so they have the opportunity to the rectify information given to parents. 


7) How many parents consented to their children’s biometrics to be
processed by the school?



Swalecliffe Answer: There are 649 children on roll.
578 children are able to use the system 
535 have permission for biometrics (82% of the children)

82% efficiency for a biometric system?  What if other procedures in schools were only 82% efficient? - that would not be acceptable.  I don't think that's a great endorsement of the system. 

8) How many parents refused for their children to use the biometric system?



Swalecliffe Answer: 13 families have refused to allow their children to use the system 
However 11 of these do not use the catering facility and their children do not have school meals. 
Only 3 of these families attended the consultations evening, the information evening or the drop in sessions. 


9) How many consent forms were not filled in by parents?



Swalecliffe Answer: 41 have not completed any forms but all of these are families who do not have school meals 


10) How many children refused to participate with the biometric system?

Swalecliffe Answer: We had one child who was distressed by the process but they have a specific learning need and anything unusual is challenging for them. We also had one family who communicated that they were discussing the options with their child and would like their child’s opinions to be seriously considered in their decisions.

Florida moves to ban use of biometrics in schools

The bigger picture on how many children are 'experiencing' biometrics in schools 2013

Good that Big Brother Watch's 'Biometrics in Schools' report highlighted schools in the UK taking children's biometrics, though unfortunate that their figures are somewhat diluted as they are based on an alarmingly low response rate to their Freedom of Information Requests (FOIR).

Having a 39% response rate, 1255 replies from FOIRs sent  to 3,218 schools, is worrying as:
A) accurate data cannot be gleaned from it and
B) as schools are increasingly corporatised, does this suggest they see themselves as unaccountable?

But let's face it, if you were a school receiving a FOIR from Big Brother Watch about if/how your school uses children's biometrics you would be inclined not to answer, as legally every answer given under FOIR is "to the world", i.e. public.  Potentially embarrassing.

So if 40% of schools are using children's biometrics, as Big Brother Watch's FOIR response suggests, then when applied to the wider school population of 8.2 million, in England, this means that 3,280,000 children have their biometrics on school databases.  Interesting.  A figure not reported in the media.

But what about the remaining 60% of schools that did not reply to Big Brother Watch's FOIR?

In 2010 I asked 500 schools similar questions about their use of biometric systems for the then Protection of Freedoms Bill committee sitting in Parliament (now an Act of Parliament) and got replies from 47% of schools.  Because the data I had was not accurate enough to submit to the committee, not having got a near 100% replies, I rang round the schools that had not replied.

Two thirds of the secondary schools that did not reply were using biometric systems, so for example, in Liverpool's secondary schools the initial figure I got from the 47% FOIR response rate indicated that only 25% of schools used biometrics.   After ringing round the remaining schools this figure rose significantly to 72% of Liverpool's secondary schools using biometrics.

So does this mean we can apply the same criteria to the 61% of schools that declined to answer Big Brother Watch's FOIR?  In which case we would be looking at over 6.5 million children using their biometrics England's school population of 8.2 million.  A significantly larger figure than is being quoted in the media.

However, the demographic trend is that biometric systems are mostly used in secondary schools.  'Fingerprinting' primary age school children is not quite yet seen as acceptable, having had bad press in the past decade.  Whereas biometric systems in secondary schools are easier to stomach as children of secondary school age could use the technology routinely on their phone, PS and Xbox, etc.

As there are 8.2 million children in England's schools, with schools having children (from Reception, age 4/5, to Year 11, age 15/16) for 12 years, there are approximately 680,000 children per year group.  Perhaps more importantly, there is a need to look at the percentage of children having experienced biometric systems before they left school, i.e. looking at the secondary schools population where biometric technology is predominantly concentrated.  There is potentially a very high level of children passing through this age group experiencing using their biometrics in a school environment, normalising biometric use for fairly mundane transactions

It would only need two or year groups (or even one year of using a biometric system in a school) to accustom a child to the technology.  This may only mean that 1.3 million children have been using biometric systems in secondary schools but a near 100% experience of every child leaving school having experienced the technology.

So I guess the question could be better asked "How many children leaving school have experienced using biometric systems?"

Though still, the sheer numbers of children that have their biometric data on systems in schools, that possibly may be compromised in the future, is still a very valid point.

Thank you Big Brother Watch for highlighting the issue, as it is always good to have this topic in the news, but perhaps in the future more targeted research should be undertaken.

Quality of biometric normalisation does not necessarily lie in quantity of users - a nicely aimed, targeted demographic suffices.