Facial recognition in UK schools - the 'right' or 'wrong' type of biometric to be used with children?

10 months after the suspension of facial recognition (FR) at all the secondary schools in North Ayrshire Council, the Information Commisisoner's Office (ICO) has not yet issued any opinion on the use of FR in schools but are expected to publish this on their website in the near future (from their response to a Freedom of Information request received August 2022).  

The very much sooner the ICO issues their opinion the better.  We are seeing biometric analysis of children's bodily and facial data taken in schools, move from services, such as canteen and library, to classrooms monitoring emotional engagement.

A brief history of facial recognition in UK schools:

2010

Facial recognition was first used in UK schools.  Schools from Northamptonshire, Hertfordshire and Cambridgeshire used FR from September 2010 for registration.  The FR system was ‘faceREGISTER’ supplied by Aurora Computer Services, now part of Causeway.

Enquiries to the then Sir Christopher Hatton School, a comprehensive in Wellingborough, Northamptonshire, (now an academy) revealed that the system was scrapped after a few terms.

Since this instance, FR was not used in UK schools until 2020.

2020

FR was trialled in the summer term of 2020 at Kingsmeadow Community College for canteen payments.  It was fully implemented in the Autumn term of that year. 

The FR uses the School Information Management System (SIMS) photograph as a template.
The students present their face at a scanner at the point of sale (POS) to pay for their food.

The school is part of a pilot scheme and no funds were spent on the FR system.

If students do not wish to participate the person at the POS can identify the child by their photograph.

More information here.

FR supplied by CRB Cunninghams.

2021

CRB Cunninghams are supplying around 70 schools with FR technology.

In October North Ayrshire Council (NAC) implemented FR from CRB Cunninghams into 9 of its secondary schools.  The technology last a week.  It was suspended due to concerns from civil liberties groups and and parents.  The ICO paused the technology to review its acceptability under Data Protection Act 2018 and GDPR.

West Lothian Council (WLC) were planning on implementing FR in their 11 secondary schools.  In a January 2022 response to a Freedom of Information request they state, “WLC had begun to consider cashless catering in secondary schools using facial recognition, but this has not been progressed”

It was unclear by the end of 2021 how many of the nearly 70 schools had gone ahead with their FR technology.  David Swanston, managing director of CRB Cunninghams stated, “some schools had shown concerns about the system as a result of the reporting on the North Ayrshire schools and the company is planning on issuing a statement to reassure them next week.”  That statement to schools, as far as is known, never appeared on CRB Cunninghams website.

2022

March - PRNewswire reported that Smestow Academy, in Wolverhampton, are using a brand new type of facial/bodily scanning of students to determine their wellbeing in the classroom… “the first school in the UK to deploy the AI-powered myViewBoard Sens analysis tool in the classroom.” supplied by ViewSonic.

“Through the real-time insights generated by the intelligent sensor, the school can ensure the classroom follows the wellness compliance, increase students' engagement, and facilitate a safe and active learning environment for the best possible learning outcome.”

Smestow Academy are working with Intel and ViewSonic to develop “experimental hybrid learning rooms” within the academy - see 1 minute 59 seconds in this video - creating a "software ecosystem" to "add facial-expression recognition and mood indexing to better respond to learners' needs based on non-verbal cues"

April - Biometric Update reported that Stonyhurst College would be implementing FR in 2023 which “will have mobile and facial recognition with two-factor authentication to minimise occurrences of students and staff copying PINs” for door access.  The FR entry system is supplied by Suprema.  A case study video from Suprema ID showcases the company’s 50 biometric and mobile security reader devices in use at Stonyhurst College.

Suprema also provide Wolverhampton Grammar School with FR door access with an additional feature to read the body’s temperature.

June - A parliamentary House of Lords debate on Biometrics Technologies on the use of FR in schools.  Lord Scriven asks:

“Facial recognition technology is now used in classrooms to monitor children’s mood and engagement, despite some parents objecting. The biometric regulator has no powers to enforce compliance with the law in schools and the department does not even monitor the use of this technology. Why are the Government taking this approach, allowing private companies’ marketing departments to determine the parameters of our children’s civil liberties and privacy in the classroom?”

July - the Department for Education (DfE) issued new guidance on the use of biometric technologies in schools, with notable changes to include FR.  Seemingly some types of FR are acceptable:

“Schools and colleges must establish that facial recognition is both necessary and proportionate within the school and college environment.”... with no explanation from the DfE how FR could be necessary or proportionate in schools.

“Live facial recognition is not appropriate in schools or colleges.” (A tiddybiddy round of applause here I suppose).  It appears the the DfE is deciding which biometrics are acceptable for use on children in schools when legislations, such as the Data Protection Act 2018 and GDPR, do not offer parameters of acceptable levels.  

Other data regulators in the EU, under GDPR, have halted the use of FR and fingerprints scanners in schools, with fines issued to schools using biometric technology in Sweden, France, Bulgaria and Poland.

August - CRB Cunninghams removed a webinar, detailing the learning capabilities of the FR system they are supplying to schools, from their website and Vimeo.  In the spirit of transparency for students and parents to make an informed decision on consent as to whether they participate in this FR technology, this is how students facial biometric data is used and processed - the webinar exists here:

"the idea with the third template is that this will be updated every 3 months" 17mins 1s

"the algorithm grows with the child" 17mins 20s

"the system will match that for you by constantly evolving the algorithm to match the child's growth and change of appearance" 17mins 49s

----------------------------------------------------------

Our data regulator, the ICO, has yet to publish their opinion on schools processing students facial biometric data - or body movements to give emotional data to school leaders and Intel (if they even know about this?)

Though I’m not sure how an opinion can be had on the use of biometric technology in schools when legislations explicitly detail how this technology should not be used with children when other less data intrusive systems will suffice -  and less data intrusive systems do exist in a lot of UK schools... PINs, swipe cards, etc.  And especially when other equivalent EU data regulators follow those legislations and do not hold opinions on the 'right or wrong biometrics' to be used with children.

What is the current situation with facial recognition in UK schools?

This situation with facial recognition technology use in UK schools is unknown, as is the case for the amount of schools using pupils biometric fingerprints.  

Using the Freedom of Information Act and catching the media on this as it happens seems to be the only way  to see how this technology is being rolled out, as schools are under no obligation to inform the Information Commissioner's Office (ICO), who oversees the Data Protection Act (DPA) 2018 and the General Data Protection Regulations (GDPR), that they are taking and processing children's biometric data.

As of this week it appears that North Ayrshire Council, Scotland, are in the process of implementing facial recognition in to its 9 high schools and West Lothian Council, also in Scotland, are looking at introducing facial recognition technology in its 11 high schools - a total of approximately 20,000 students.

In England there are:

Kingsmeadow Community Comprehensive School,  Gateshead

Canon Slade CofE School, Bolton

Murray Park Community School, Derby  - Update 20/10/21:  I have been contacted by Realsmart who have stated, "Realsmart do not provide any systems that work with biometrics". I welcome more clarification on this and will post accordingly.

Langley Park School for Girls, Beckenham

...another 5,000 students and I suspect there are quite a few more schools too.

Consent and Legalities

England and Wales - explicit consent from parents must be sought for a school to take and process a child's biometric, which was, up to now, mainly in the form of a fingerprint template, this now however extends to photographs used for a facial recognition system.  This is law and the legislation covering a schools obligation to gain consent is in the Protection of Freedoms Act 2012 (PoFA).

Both parents need to consent and so does the child.  Any child or parent not consenting overrules the consent of a parent that does consent.  An alternative to the biometric system must also be provided and this alternative option should be made aware to the parent/s child - see page 10 of the governments 'Protection of biometric information of children in schools and colleges' advice to schools.

Scotland and Northern Ireland - here the PoFA 2012 does not apply.  Scottish schools have tended to ask for consent in line with the PoFA but recently seem to have taken it upon themselves, from exactly whose advice is unknown at this time, to presume that S1-S3 pupils need parental consent and S4-S6 pupils can consent themselves.  See North Ayrshire's consent forms S1-S3 and S4-S6.  

S4 students are 14/15 years old, under PoFA no student under the age of 18 can consent to their biometrics being processed by schools.

However, this consent process becomes redundant as indications from Europe show that facial recognition in schools is in direct contravention of the EU legislation GDPR.  Rulings against using facial recognition in schools has been acknowledged by our UK ICO in their June 2021 report, page 22, 'The use of live facial recognition technology in public places':

The report went on to state that: "The research found support for the government imposing restrictions on the use of FRT [facial recognition technology] by the police (55%) and in schools (68%). The Ada Lovelace Institute recommends a voluntary pause on the sale of FRT to enable public engagement and consultation to take place." ...in which case why are UK schools spending tax payers money on this legally questionable technology?

The legalities of facial recognition in UK schools is unknown.  We are still subject to the EU GDPR and under that facial recognition use in schools has been in contravention of the strict use of biometrics with minors that the EU Act cites.  

Our ICO appears unable to answer what communications they have had with educational establishments or companies supplying facial recognition to schools.  A recent of Freedom of Information on this was refused on 30th September 2021, citing Section 12, exceeding costs and time - I am hopeful there may be a disclosure of some information though - see here.

See WhatDoTheyKnow for Freedom of Information requests on this topic.

Biometric fingerprint readers ditched for hygiene reasons... to be replaced by contactless biometric systems?

On Twitter schools have been spotted ditching biometric fingerprint readers for contactless cards due to hygiene reasons, which completely makes sense as this was one of the issues raised initially over 15 years ago when fingerprint scanners started appearing in schools.  

Though some biometric suppliers have been keen to stress that sterilising fingers before using biometric scanners is good to keep children 'safe'.

So as good as it is to see fingerprint scanners be replaced by less personally intrusive methods it does open the way for a contactless biometric system, i.e. facial recognition, to replace the touch fingerprint pad.

Which seems to be, somewhat, what has happened here at a UTC school in Leeds, UK, where Years 10 (14/15 year old) and Year 12 (17/18 years old) students have started school after having been shut since mid March 2020.  

A combined facial recognition and thermal imaging system has been installed to check student's temperature to identify each student whose temperature is taken.  However it has to be said they have ditched their fingerprint scanners for contactless cards, which was used for building entry, class registration and lunch payment.  The newly installed facial recognition has not directly replaced, on first glances, the fingerprint system but it is still registering the students with their biometric data.

We have also installed a high spec thermal camera in the reception area. This camera uses facial recognition technology to enable unobtrusive thermal imaging and temperature measurements of students and staff. An alert is issued to the Principal if someone’s temperature is above a certain level.

Every school in England and Wales that wishes to process an under 18 year old's biometric data, including facial recognition, needs explicit written parental consent to do so and it is uncertain whether this particular UTC has done that.  When questioned specifically on whether they had gained parental consent, as per the Protection of Freedoms Act 2012, the UTC replied:

Albeit it this is a reply on Twitter (which now looks to be unavailable) but it is not glaringly obvious that the school is operating this biometric system in line with UK legislation specifically aimed at schools processing children's biometric data - The Protection of Freedoms Act 2012.  

The use of facial recognition in UK schools is also questionable under GDPR, the EU General Data Protection Regulations 2018.  Schools in France have been advised not to use facial recognition and a school in Sweden was fined for using the technology.  GDPR does not change at country borders or whether we are Brexiting so the use of facial recognition technology is certainly questionable in this UK school.

There are good reasons legislations are specifically put in place to protect children biometric data being unnecessarily processed and they should be adhered to.  

Fine for processing students’ fingerprints imposed on a school

A statement, issuing a fine, to a school from Poland’s Personal Data Protection Office (UODO), the equivalent to our Information Commissioner's Office (ICO), found the school to be in breach of the General Data Protection Regulations (GDPR) for using children's fingerprint data to allow access to their canteen.  The ruling stated that:

"The school processed special categories of data (biometric data) of 680 children without a legal basis, whereas in fact it could use other forms of students identification."

and

"...it is important to stress that the processing of biometric data is not essential for achieving the goal of identifying a child’s entitlement to receive lunch. The school may carry out the identification by other means that do not interfere so much in the child’s privacy. Moreover, the school makes it possible to use the services of the school canteen not only by means of fingerprints verification, but also electronic cards, or by giving the name and contract number. Thus, in the school, there are alternative forms of identification of the child’s entitlement to receive lunch."

Here in the UK biometric fingerprint readers have been used in schools since 1999.  Up to 2012 schools were using children's fingerprints quite often without informing parents or asking their permission, as a consequence after some pressure upon the UK Government to address this, legislation was passed in 2012 requiring schools to obtain parental permission to process their child's biometric data and offer an alternative means to the biometric system. 

However, a survey done by children's data privicacy group defenddigitalme found that even after the 2012 legislation parents were still unaware of options not to use the fingerprint system.

Children's biometric data needs to be secure for the child's lifetime - decades.  It does seem excessive to use biometric data for daily mundane tasks in school, when another form of ID is perfectly acceptable - we have expressed that view since 2005.

This point was also expressed in the UODO report according to Venturebeat:

'The final decision cited numerous facets of GDPR, including recital 38, which refers to specific provisions made for data protection of children, "it should be emphasised that children require special protection of personal data, as they may be less aware of the risks, consequences, safeguards, and rights they have in connection with the processing of personal data" the report found.'

If the Polish Data Protection Office have ruled this use of children's fingerprint biometrics as a violation of GDPR then presumably the same would apply to any school using such systems in the UK.

This is absolutely a GDPR issue we will be following up here in the UK.

The English text of the UODO decision is here and the Polish version here.