State of Biometrics 2022 - a review of policy and practice in UK education

I co-authored a report with Jen Persson from DefendDigitalMe, 'The State of Biometrics 2022 - a review of policy and practice in UK education', which was published last week.  There is no collection, monitoring, record of biometric technology in schools held by any UK government department, regulator or commissioner so information in the report was obtained by Freedom of Information requests and research collated over the number of years I've been doing this blog.

There is definitely further research and questions to be answers and issues to be resolved following the publication.  

Biometric technology has crept from school services, canteen, library, etc, into the classroom - where 'sensors' (cameras) now scrape data from children into a group view for teachers and management to gauge real time interest in lessons, engagement, attentiveness and emotion.  This behavioural data capture is classed as biometric data under the Protection of Freedoms Act, Chapter 2 (28)(2).

From PRNewswire:

"ViewSonic Corp., a leading global provider of visual solutions, has partnered with the Smestow Academy in Wolverhampton, England, as the first school in the UK to deploy the AI-powered myViewBoard Sens analysis tool in the classroom. Through the real-time insights generated by the intelligent sensor, the school can ensure the classroom follows the wellness compliance, increase students' engagement, and facilitate a safe and active learning environment for the best possible learning outcome."

 

The Report in summary

The Protection of Freedoms Act 2012 and weak enforcement of data protection law are failing to protect millions of children from the normalisation of routine use of biometric data for everyday canteen and library transactions, and increasingly intrusive bodily surveillance in the classroom. 

Pupils in the UK are effectively guinea pigs in the use of emerging technology for companies from around the world, including facial recognition technology that has already been banned from schools in other countries.

Some companies claim that their products can measure mood and attentiveness, or use artificial intelligence to manage behaviour-based classroom planning. Some companies even claim to be able to detect autism without any child development expertise.

How this normalisation and these emerging products may affect the full and free development of the child are yet to be seen.

The fast-growing uses of intrusive technology involving bodily data in educational settings worry child rights advocates and law makers alike. 

Lord Paul Scriven said, “As parents you should be very worried and angry that private companies are seeking to make a profit from your child’s face, fingers, eyes and other personal characteristics while trying to pretend that it is all to aid their educational attainment. Where do we draw the line?”

• Data from FOI requests to schools (all UK) Our findings from enquiries to 550 schools with over a quarter of a million pupils in total, suggests that around three quarters of secondary schools are using fingerprint technology or other biometrics, and where used, uptake is routinely 85%, or more where use is restricted to only certain year groups.

• Despite the law requiring consent some schools in England are discriminating against children in receipt of Free School Meals (FSM) by obliging them to use the fingerprint systems, and others make it obligatory for all pupils. (We are yet to quantify these issues and plan to continue further research.)

• Emerging technologies, school trials and scope creep including under COVID. Schools started using facial recognition more widely in 2020. At least one school got new facial recognition technology free, “as part of a trial”. Some schools combined entry access readers with thermal and facial detection. Some are trialling “experimental” products including attentiveness and mood detection that are unevidenced in their intended outcomes or in any unintentional effects on children’s behavioural and cognitive development in UK classrooms. Voice is rarely considered under school biometrics policies whereas fingerprint technology is now routine.

• Lack of regulatory enforcement. Six months after North Ayrshire schools in Scotland put their facial recognition rollout on pause, there has been no visible ICO regulatory enforcement action. We include a latest position statement in the report.

• Large multinational companies have bought out the originally small school biometrics suppliers and many significant UK school providers are owned in the US, Canada and Israel.

• Parents’ survey findings (2018) Survation polled 1,004 parents with children in state schools on behalf of defenddigitalme about their experience of technology in schools. Over a third of parents (38%) whose children were using biometrics in school, said they had not been offered any choice despite the law that requires parental consent, the Protection of Freedoms Act 2012, and over 50% of parents had not been informed how long their child’s  fingerprints or other biometric data is retained or when the data would be destroyed.

Professor Fraser Sampson, Commissioner for the Retention and Use of Biometric Material and Surveillance Camera Commissioner and author of the report foreword, suggests there is inadequate oversight of school procurement among wide ranging comments.  “Some – including, surprisingly, the Department for Education – appear to have taken the view that bare compliance with Chapter 2 of the Act is all that is required to ensure the lawful, ethical and accountable use of biometric surveillance in schools.” He asks five key questions of practice in schools: Who's benefiting? Who's watching? Whose company are you keeping? Where's the push? And, Why the rush?

There are no UK national requirements for any quality or health and safety standards of biometric or AI technology when used by state schools, and no oversight or record of what is used where.

Current legislation is ineffective in protecting children’s and students’ rights in educational settings from age 2-25 and change is needed now. defend digital me is calling for a ban on biometric systems in educational settings.

Authors: Pippa King and Jen Persson

Artwork: Hannah Mallory

'Who knows what about me?'

The publication of the "Who knows what about me?" report today by the office of The Children's Commissioner for England highlights the huge amount of data gathered on children, including the use of biometric technology in schools.

5 salient points about biometric technology used in schools is listed in the infographic in this post.

Using one's biometric data is a more data intrusive way of accessing schools services than a PIN or swipe card.  This has been recognised by legislation and schools therefore are legally obliged to offer students an alternative means to access such services and must have consent, from both parents and students, if biometric data is to be taken and processed.

Schools in the UK have been using biometrics since 1999.   Often this was done without informing parents due to the fact that the Data Protection Act 1998 did not list biometrics as 'sensitive' personal information, hence parents permission or even knowledge that their children's biometric were being taken happened.

Many different types of biometric technology have been used in schools. The biometric most used is fingerprint.

Campaigning by parents lobbying Members of Parliament culminated, 13 years after schools started using the technology, with legislation covering consent to biometric processing in the Protection of Freedoms Act 2012, Chapter 2.

It is prudent to minimise personal data given.  We have no idea if a child's biometrics given in the education system is compromised or shared, with other agencies or companies, the effect this may have later in their life.

Know your facts and consider keeping your child's biometric digital data from unnecessary use when an alternative means of identification will suffice.

Biometric consent for students in Scotland

Under the Protection of Freedom Act 2012 if schools want to use and process a child's biometric data
they must ask for consent from the pupils and parents.  Schools must also offer an alternative option to access systems if consent is not given to process a student's biometrics - such as a pin number or swipe card.

Schools use a student's biometrics to access facilities such as canteen, library, registration, etc, and the biometric of choice seems to favour the fingerprint.

The Protection of Freedom Act 2012, Chapter 2, details how schools must seek consent to hold and process student's biometric data.  However, this consent only applies to children in England and Wales and with Scottish authorities planning to roll out more biometric technology in schools to extend consent for Scottish students, around the use of their biometric data, is absolutely reasonable. 

In order to move towards consent for children in Scotland (and Northern Ireland) Freedom of Information requests have been sent to every local authority in Scotland to determine how prevalent the technology is in schools, whether consent is sought, type of biometrics used and for what purpose.  As it is school holidays, and given that the beginning of term is busy, we expect to this this information back by end October 2018 and then work to get this issue of consent raised in the Scottish Parliament.

Updates coming... new developments

Since I started this blog over 10 years ago the state of surveillance, monitoring and application of biometric technology used in schools on our children, the next generation, has increased beyond imagination.  Okay, there may be arguments that his 'improves' their education, enables better educational analysis, reduce admin time/costs, etc... but personally, I've not seen a dramatic increase in the next generations intellectual ability or schools being more affluent because of technology.  Certainly here in the UK we currently have a national funding crisis in education. 

Credit: https://www.pinterest.co.uk
/pin/68539225552401806/

It is a different education that is needed for today's kids.  Access to information is greater to an individual than ever before.  Knowing and retaining information in this age maybe is not a necessity as much as it was.  Moreover how to apply that knowledge in this ever changing society perhaps is a skill children should learn.  Discernment, where one's digital footprint is left and the data left again one's digital identity should also be considered.  How, who and what may be assumed by a children's online activities on the Internet - and within a school network - is a burgeoning area that needs urgent consideration, especially for those it could potentially affect in decades to come. 

With governments, private education tech companies and private companies running schools having access to individual educational data from the age of 2 years old (in the UK) to 19 and beyond gives an enormous potential for profiling.  I could write about this for an age, as these are all points that have been raised with the proliferation of technology in education for the past decade plus.

What to do?  I have been absent somewhat from blogging here as the transfer of biometric technology tested used on children in the UK has now widened into the rest of society.  My concern is when the state uses biometric technology without consent, much as schools did from 2001 - 2013 in the UK.  I set up a sister blog a couple of years ago to keep the two developments of biometric technology, schools / wider society, separate - see my State of Surveillance website.

However, there is now an issue of facial recognition creeping into US and Chinese schools for a variety of reasons.  Here in England and Wales (not Scotland or Northern Ireland) facial recognition is not viably an option for schools with under 18 year olds, as per the consent required under the Protection of Freedoms Act 2012.   The argument for the use of biometrics in schools - whether  fingerprint or facial recognition - is basically unproven, as other, less invasive, less 'valuable', means of identification will suffice.   This is an issue I intend to raise again here.

So, hopefully, (in a rather large nutshell) I've explained my absence and fully intend at least once a week to start again back here.   T'will be nice to get back to it!

Updated Advice for schools on using pupil's Biometrics

Last Month the Department for Education issued an updated advice for schools taking and processing students biometric data.

This useful advice is also a 'must' read for students and parents so they are fully aware of their rights of access to services should they choose NOT to participate in a biometric system.

A recent survey, carried out by DefendDigitalMe, revealed that:

"Over a third (38%) [of parents] of those who said their child’s school uses biometric technology said they were not offered a choice of whether to use this system or not and 50% have not been informed how long the fingerprints or other biometric data are retained for, or when they will be destroyed — despite the Protection of Freedoms Act 2012 requiring parental consent, and an alternative to be on offer, showing that practical guidance is needed to help schools understand how to implement the legislation."

This shows that there is still clearly a lack of understanding by schools of their legislative obligations to parents and students with regards to biometric data storage, processing and their consent.

Please do have a read of the above advice, any of the information here and make an informed choice about your/your children's biometric data.

Schools asking for consent to process children's biometrics

I am getting a lot of emails from concerned parents of children leaving primary school to go to secondary school with the way that the secondary schools are asking for consent to use their child's biometrics - fingerprint, fingertip data - and not offering an alternative method to access the catering, library, registration, etc, system.  In this parents are feeling that their request for consent is coerced.

Schools MUST offer an alternative to biometrics.  The Protection of Freedoms Act 2012, Chapter 2, Section 27 (7) states that: 

The relevant authority must ensure that reasonable alternative means are available by which the child may do, or be subject to, anything which the child would have been able to do, or be subject to, had the child’s biometric information been processed.

Unfortunately some parents have been made to feel from schools that they are being unreasonable in not giving consent and that they are they only one objecting to biometric consent.  You are not a 'problem parent'.  You and your child have a right to not give the school biometric data - data that is absolutely unique, personal, highly precious and that needs to be secure for the child's life time.

Parents feeling isolated by a school is a story I have heard over the past 10 years so many times from so many parents - you are not alone at all.  I myself last year, when my child entered sixth form, was told by the Principal that I was the only parent objecting to them using my child's biometrics - I was not.

Quite often the supplier of the biometric system to the school will also offer alternative means of accessing the system they provide.  Examples are swipe card, PIN number and taking the names of the children at the point of sale at the till, so it shouldn't be an inconvenience for the school to offer alternative means of identification.

The new EU General Data Protection Regulations is law for every member state of the EU, including us.  It came into law 27th April 2016.  Schools are subject to this.

Point 32 states:

Consent should be given by a clear affirmative act establishing a freely given, specific, informed and unambiguous indication of the data subject's agreement to the processing of personal data relating to him or her, such as by a written statement, including by electronic means, or an oral statement.

Point 42 states:

Consent should not be regarded as freely given if the data subject has no genuine or free choice or is unable to refuse or withdraw consent without detriment.

If anyone has any concerns or questions please don't hesitate to get in touch, I'm really happy to help if I can.

Consider carefully when consenting to children's biometrics in schools

'Turning fingers into keys'
Credit: kaprik/shutterstock.com

There is a great article written by Brian Patton, University of Oxford, entitled "The trouble with taking biometric technology into schools", that appeared in The Conversation earlier this month, which every parent and student should read before considering using their biometrics in schools.

Other than copy most of the article into this post I would urge a read of the article which succinctly discusses security, effectiveness, implications of a data breach and consent.  

Schools and biometric companies supplying schools are keen to reassure parents and students that it is not a (pictorial) fingerprint that is being stored but simply a number string -  a number string completely unique and specific to your child's 'bio' body 'metric' measure.

Patton makes the valid point that:

"For other biometric data it's important to remember that what is being matched within the computer is not, say, one fingerprint against another. It is a set of data drawn from the features of the scanned body part – a numerical abstraction. Steal this key and you have effectively stolen that part of the person."

He also goes on to say that,

"...a  data breach will mean these type of scans will be untrustworthy for the pupils – for the rest of their lives.

And therein lies another issue: with the potential for life-long consequences, are pupils, some below the age of 16, competent to opt in to such a scheme? And what of those who opt out? It's one thing to ask adults to weigh up the balance between convenience and risk, but there are two likely issues that would make this harder in schools. There is an inbalance of power between those wanting to implement the technology and those subject to it.  This raises serious concerns about informed consent – perhaps one of the reasons why in 2012 using biometrics was banned in English state schoolswithout parents' consent."

It is unclear if there have been any data breaches of biometric databases in schools as the UK Information Commissioner's Office (responsible for the UK Data Protection Act), in response to a Freedom of Information request regarding compromised biometric databases specifically in education, are "unable to conduct an electronic search of our system using the term ‘biometric’" and so could not supply information on if there has been any data breaches of children's biometric data in schools.

There are potentially long term, unknown consequences to this biometric technology used on the youngest generation in society - we are experimenting with it on our children in schools for daily activities that can be easily undertaken, quite adequately, without the use of biometrics.

I guess an individual will only know when their biometric data has been compromised when in the future they hit a problem regarding their biometrics.  How will they know when it was compromised, by whom and where their very personal digital identity has gone? 

In the words of Brian Drury, IT Security Consultant:

"Once a child has touched a [biometric] scanner they will be at the mercy of the matching algorithm for the rest of their lives."

Compulsory fingerprinting for primary school children in Australia

Fingerprinting children in school, especially primary school children, is a contentious issue - with parents and children having the right in the UK not to participate.  Schools must seek written consent to take and process a child's biometric data.

Not so in Australia it seems.

In this article it reported that East Para Primary School has told parents they have "no choice" in the matter for a school registration system that will eventually be introduced for parents too if they want to enter the school.  The school's current newsletter states the same blerb parents have had here in the UK reassuring that no image of the fingerprint will be stored, it cannot be reconstructed and the biometric data will not be given to government or agencies... but put plainly it is a biometric mark/measure of your child's body, in this case a fingerprint, that has to stay secure, safe and never be compromised.

Giving up ones biometric may not be considered a proportionate use of personal data.  Parents should be able to decide what level of privacy they want for themselves and their children in this respect.

The article 'East Para Primary School pupils to have fingerprints scanned as part of new student attendance record-keeping program' goes on to report:

School mother Sandra Tomasin said she was disgusted by the move and immediately rang the school to ask that her Year 1 son be exempt from the program.

“They have told me that I have no choice,’’ Ms Tomasin said.

“It is an invasion of privacy. I don’t want to let it happen but I want to keep him at the school.’’

Ms Tomasin said regardless of whether or not finger prints were stored by the system, primary school children having to scan their fingers when they came and went to school was outrageous.

Sandra Tomasin is rightly outraged and should have a right for her child to attend school and NOT having to give up their biometric data.

In the UK schools fell short of giving this ultimatum as it was thought to breach Human Rights legislation by denying a service to a child because they chose not to give up their biometric data, any ultimatum of this sort was also on shaking grounds with Article 16 of the UN Convention on the Rights of the Child  (right to privacy) "Every child has the right to privacy. The law should protect the child’s private, family and home life." - which does apply to Australia.

The below statement was made by Privacy International in 2002 about library systems that used children's fingerprint biometrics in the UK to log books in and out.  It is still applicable now.