Schools asking for consent to process children's biometrics

I am getting a lot of emails from concerned parents of children leaving primary school to go to secondary school with the way that the secondary schools are asking for consent to use their child's biometrics - fingerprint, fingertip data - and not offering an alternative method to access the catering, library, registration, etc, system.  In this parents are feeling that their request for consent is coerced.

Schools MUST offer an alternative to biometrics.  The Protection of Freedoms Act 2012, Chapter 2, Section 27 (7) states that: 

The relevant authority must ensure that reasonable alternative means are available by which the child may do, or be subject to, anything which the child would have been able to do, or be subject to, had the child’s biometric information been processed.

Unfortunately some parents have been made to feel from schools that they are being unreasonable in not giving consent and that they are they only one objecting to biometric consent.  You are not a 'problem parent'.  You and your child have a right to not give the school biometric data - data that is absolutely unique, personal, highly precious and that needs to be secure for the child's life time.

Parents feeling isolated by a school is a story I have heard over the past 10 years so many times from so many parents - you are not alone at all.  I myself last year, when my child entered sixth form, was told by the Principal that I was the only parent objecting to them using my child's biometrics - I was not.

Quite often the supplier of the biometric system to the school will also offer alternative means of accessing the system they provide.  Examples are swipe card, PIN number and taking the names of the children at the point of sale at the till, so it shouldn't be an inconvenience for the school to offer alternative means of identification.

The new EU General Data Protection Regulations is law for every member state of the EU, including us.  It came into law 27th April 2016.  Schools are subject to this.

Point 32 states:

Consent should be given by a clear affirmative act establishing a freely given, specific, informed and unambiguous indication of the data subject's agreement to the processing of personal data relating to him or her, such as by a written statement, including by electronic means, or an oral statement.

Point 42 states:

Consent should not be regarded as freely given if the data subject has no genuine or free choice or is unable to refuse or withdraw consent without detriment.

If anyone has any concerns or questions please don't hesitate to get in touch, I'm really happy to help if I can.

A parent's communication with school implementing biometrics

This month a concerned parent wrote to her child's school after finding out the school was planning to implement a biometric system.  She has kindly allowed the communications to be published so other parents wanting to use any of the information, the Freedom of Information request or the letter, sent to the school can see some questions to ask and points to consider.

Freedom of Information request sent to a school implementing a biometric system and a Letter raising concerns and links to aspects for the school to consider.

The law changes here in the UK.  Come September 2013 schools must have the written signature of one parent and the consent of the child in order to process a students biometric data. 

In light of this the UK Department of Education published these guidelines and template letters for schools to use in light of the pending leglislation:
Protection of Biometric Information of Children in Schools.
Government response to the consultation on draft advice on protection of information of children in schools

Gov does Impact Assessment on parental consent for processing childrens biometrics

Over on the Home Office's website is an Impact Assessment entitled:
"Requirement for schools to seek written parental consent before processing children's biometric data". 

It is good to see a document coming from government raising concerns and offering solutions to the controversial subject of processing children's biometrics without parents consent.

It is, in fact, it is the only document that has ever been issued by our government concerning biometrics in schools, in the 10 years the technology has been in used by children.

The previous 'advice' issued by the now defunct quango Becta was issued without any consultancy, knowledge or research into the subject of biometrics whatsoever, legal, academic or otherwise, etc.  This fact came to light in a Freedom of Information request.  

In contrast the above Home Office document outlines many aspects to be considered when using childrens biometrics without their parents consent.

Freedom Bill 2010-11

The Protection of Freedoms Bill was introduced in the House of Commons this morning and part of the BIll, Part 1 (Chapter 2) includes provisions to protect the biometric data of children in schools and colleges.

The Bill outlines the "Requirement for consent before processing biometric information" of children up to 18 years old.

A law pertaining to children using biometrics has been a long time coming and the whole Bill, including the regulation of biometric technologies and children, needs to be got right.  It will be an interesting few months ahead.

Biometric systems 100% safe?

Nunnery Wood High School in Worcester is planning to use children's fingerprints for logging pupils in and out of school and for cashless catering systems.

The system is on trial at the moment with a view to it being fully implemented in 12 months but there are concerns from parents, one parent, Angie Wilkes, stated that:

“Biometric data, when included on UK passports, was hacked within two weeks by Lukas Grunwald, a consultant with a German security company, using a piece of software costing £105,”

You can understand her concerns, yet the school insisted that "the system is 100 per cent safe" - mmm... no system is 100% safe.

"Headteacher Alun Williams said the school had taken advice from government agency Becta, and had carried out rigorous research. " If the Head has done rigorous research he will know that the systems are not 100% safe.

As far as BECTA carrying out rigorous research on biometric systems in schools - they simply haven't. Their advice given July 2007 was given with no research into these systems whatsoever, I know that as a fact as the Freedom of Information Act was used to see what research they had done - zilch.

So for all you Head Teachers out there thinking that BECTA know about these systems, think again.

Building Schools for the Future bidder builds biometric technology into schools

The Sunday Heralds reports that after the palm vein scanner was trailed in a Scottish primary school last October, Amey who introduced the vein scanner, developed by Yarg Biometrics and Fujutsu, have plans to introduce this in another 11 schools for lunch lines and possible entry into schools:

"The private firm Amey is now presenting biometric systems as part of its pitch for all new school building contracts. The company was keen to assure parents in Renfrewshire, where 11 more schools are set to adopt palm readers, that the technology was safe and data could not be stolen or misused."

Vein scanning is mildly more acceptable than fingerprint scanners, as a vein print cannot be casually left at a location as a fingerprint can and so implicate you at a certain location (other than at a vein scanner). But Amey's claim that the technology is safe and data cannot be misused or stolen is a very grand claim, as these children's biometric data needs to be secure for the rest of their life time - decades... or at the very least for the life time of a child's schooling from 4-18 years old, until 2021.

How can parents, governors and pupils be consulted on this if building these biometric systems into schools are done at local government contract level? And "opt out" alternatives should be provided.

The government (BECTA) guidelines state that, "...schools should normally involve pupils and parents in their decisions to use biometric technologies as is the case with other decisions made during the school life of children ." page 7 of the "BECTA guidance on biometric technologies in schools"

- this Building Schools for the Future(BSF)/Private Finance Initiative (PFI) scenario seems to blatantly override the recent government guidelines here, unless there is a consultation process underway with parents and pupils that hasn't been reported in this case.

If their is no "involvement" with parents and pupils, there is no consequence for the companies/schools installing it. Well, hey ho, that's non legal/statutory guidance for you.

Gloucestershire County Council rethinking recent UK Government guidelines

Despite the UK Government recently issuing guidance for schools using biometric systems Gloucestershire County Council are deciding whether to issue their own guidance to schools in their area.

With a total of 8,400 children already fingerprinted in the Gloucestershire area, some just four years old, members of all political parties in the county council have created draft guidelines to help schools decide whether to use fingerprinting.

This article reports that Gloucestershire County Council, "...strongly recommends schools should consider the implications of the biometric data before making a decision.Liberal democrats at Gloucestershire County Council have welcomed the draft guidelines, but say they should go further.

Lib Deb leader councillor Jeremy Hilton, said:

"Using biometric technology in schools introduces a number of serious and unnecessary risks.

"Personally I would encourage schools not to introduce fingerprinting."

Jackie Hall, lead cabinet member for children and young people, will decide whether to endorse the [government] guidelines in September.

Dubai to issue guidance to schools

From Gulfnews.com - "Educationists and pupils in Dubai feel that schools should not be allowed to fingerprint students even though it would make some tasks much easier in the educational institutions. Senior officials are expected to issue guidelines to install fingerprint scanners and collect biometric data from children as young as five."

The guidance is to be issued as "they were responding to a report from the UK that schools are seeking government's permission to fingerprint pupils"

Laws should determine that, not a government. Sadly our UK laws are woefully out of date where this technology is concerned and very open ended.

Schools seemingly got the go ahead here in the UK when the non-statutory guidance was issued by the government last month, via BECTA's website.

UK non statutory guidelines issued....

Non statutory (non legally binding) guidelines were issued yesterday by the British Educational Communications and Technology Agency, BECTA, regarding biometrics in schools, nicely coinciding with the House of Commons Adjournment debate on the subject.

'Guidence on the use of Biometric systems in schools' from BECTA and 'The use of biometrics in schools' came from the Information Commissioner's office, ICO, yesterday.

Balanced points of view are required to make informed judgements.

From the BECTA advice: 6 ...Schools should also reassure parents and pupils that they will not pass the data on to any third parties.

But are parents and pupils aware that the UK Police can access school biometric databases without parental permission if a crime can be solved? See Q50 and Q51 and subsequent answers from David Smith, the Deputy Information Commissioner, at the House of Common Home Affairs Committee "A SURVEILLANCE SOCIETY?" (May 2007).

Police "fingerprint" databases are not just ink fingerprints on sheets of paper with people peering at them with magnifying glasses when a crime needs to be solved - Police now use algorithmic fingerprint databases (Automated Fingerprint Identification Systems - AFIS) as detailed in the above mentioned ICO document third paragraph, just like the ones used in schools. These algorithms, via M1, can be interchangeable between differing systems.

Quote from the front page of the ICO advice: "Fingerprints are not essential to the applications but unlike swipe cards they cannot be lost"

This from a primary school using thumb scans (top right, second column): "The only issues we’ve had have been caused by us changing our hardware and a burglary when our main computer was stolen. [The biometric provider] helped us to resolve them all," (Perhaps biometric data was 'lost' here?)

Non legal advice - nothing resolved.

House of Commons Adjournment Debate

There was a House of Commons Adjournment debate Monday 23rd July with Greg Mulholland, Lib Dem Shadow Education Spokesperson, leading the debate and Jim Knight, Labour Minister from the Department of children, schools and families, answering.

At long last debate time in parliament has been given over to the taking of children's biometric data without parental consent.

The debate can been seen here, it is the last item to be debated and can be found at 06.35.25 on the slider.

Luckily for Jim Knight, in order to answer Greg Mulhollands points and not to loose face, he had to have some advice from the ICO and BECTA - well and what do you know... after nearly a year of waiting for advice, the long awaited guidance from BECTA and the ICO just happened to be issued today.

Phew that was lucky for Jim Knight - what were the odds against that then?!!

Schools have the right to collect biometric data in the UK with out parents permission

Independent Sunday 17th June

"Ministers will issue guidance telling schools they have the right to collect biometric data and install fingerprint scanners."

"It is understood that schools will not have to gain written permission from each parent before their child's fingerprints are taken."

"Schools will be able to place fingerprint scanners at the entrances to classrooms, the school gates and even in cafeterias."

Quite unbelievable. Doesn't the government take world leading experts seriously on this matter? Obviously not. This 'guidance' should make interesting reading when/if it is ever issued.

See the England Expects blog for more comment on this.

Biometric guidance for schools due before end June

This from correspondence received today from the Information Commissioner's Office (ICO):

"I believe the DfES are expecting the Becta guidance to be published before the end of June.

The ICO will be issuing its own statement on the issue at the same time. This will express fairly briefly our view on the use of fingerprint templates in schools."

Local Council issues guidelines to schools

Portsmouth City Council are the first council in the UK to issue guidelines to their schools regarding using biometric fingerprint technology with pupils.

Titled "Finger scanning technology in schools", the full guidance can be found here.

The concerns expressed have in the main focused on 2 main issues:

• That parental consent might not be obtained in a consistent way.
• That the supporting data might in some way enter the criminal justice system to the disadvantage of the children involved.

The guidance has seven points for schools act on, highlighting a school's legal obligations surrounding this technology.

Well done to Portsmouth Council and in particular Councillor Luke Stubbs who was instrumental in this guidance being written.

Guidelines arriving "shortly"

Jim Knight responded yesterday, in the Dept of Education's usual true concise manner in this matter, to a very simple question put to him by Sarah Teather, Lib Dem MP Shadow Education Secretary, regarding the use of fingerprint technology in schools:

From Handsard June 4th 2007

Sarah Teather: To ask the Secretary of State for Education and Skills when he expects to publish guidance to schools on the use of biometric technologies.

Jim Knight: The Department aims to publish guidance to schools on the use of biometric technologies shortly.

This to me doesn't look like a factual answer - not the type of answer that would get brownie points in a SATs test.

Anyway, to try to understand a School Minister's speak let us refer to Rogets Thesaurus, no doubt used in Jim Knights Deptartment's schools nationwide. So, Rogets Thesaurus's definition for "shortly" is "right away".

All this said, when the guidelines are issued they are not statutory and unfortunately schools do not need to heed or read them.

Guidelines for schools elusive

This from The Sun : "Last night [June 3rd 2007] Schools Minister Jim Knight agreed to draw up strict guidelines"

He also agreed to this in February this year, from Hansard 5 Feb 2007:

Jim Knight: "The Department is working with the British Educational Communications and Technology Agency which is revising its current guidance on data protection to include specific guidance on biometric technology. Becta aims to make the guidance available on its website by the end of March 2007 after consultation with the Office of the Information Commissioner."


So the Department of Education has been working on guidelines since February, delayed publication to March, then May and still Jim Knight is working on guidelines......mmm, there are a number of possibilities here:

1. Either the guidelines are going to be issued in the form of a trilogy, due to length of time taken to write, and will appear not just on BECTA's website but also on Amazon.

2. There are no guidelines being written.

3. There were guidelines but Jim Knight's dog chewed them up, honest.

4. It's a legal nightmare and the Department of Education, the ICO and BECTA are simply not issuing them yet due to legal complications.

Where is the guidance?

Well maybe I'm being tough, it's only 1 day late.

For any of you that want to search BECTA's website for the guidance that has been long promised by the Government due out end March 2007, then put back to May 4th until after the local elections (because biometric technology and it's little known, unregulated, haphazard use with children in schools mostly without parents knowledge, is presumably a big enough "bat" for opposition to use to affect voters decisions?), just type the below in to Google:

site:http://www.becta.org.uk biometric - here's Google's result for this,

or

site:http://www.becta.org.uk fingerprint - and this search result here.

Lots of 'products' listed but no guidance for teachers on this yet... if anyone finds any please let me know!

Guidance out in May

I was advised yesterday, by the Department of Education, that guidance for schools and PFI bidders incorporating biometric systems in schools is now due to be released after the local elections on May 3rd 2007.

The guidance will be released on BECTA's website.

Regulation deadline has not been met by Government for millions of children's biometrics held on school PC's

Both the Liberal Democrats and Conservatives are vocalising their serious concerns about using biometric fingerprint scanners in schools (see blog side bar of parliamentary questions asked), and experts such as Kim Cameron express worries about this practise.

Even BECTA recognises the "concerns of parents" and internationally Roderick Woo, Justice of the Peace at the Hong Kong Office of the Privacy Commissioner, states about the use of biometrics in schools:

"I considered the consent of the staff and pupils rather dubious, because primary school's consent in law cannot be valid and there's undue influence. If the school says, 'give up your fingerprint', there's no way of negotiating.

"Also it's not a good way to teach our children how to give privacy rights the consideration they deserve,"

The Irish Data Commissiors Office has this guidance issued and warns schools about the danger of legal action, "claim for damages from a student", if they don't implement a detailed Privacy Impact Assessment.

There are laws in the USA regulating this technology and children.

But when schools send letters like this school in Doncaster did to parents, and another example over on Tarique Naseem's blog something is radically wrong.

What is going on when we parents have to sign slips for our child's image to be taken but yet when it comes to their bodily biometric data lying on a school PC - no consent, no even letting us know, no nothing!

Why, when ALL the above people and more are expressing serious concerns with fingerprinting children in schools, is the government not moving on the promised guidelines,as stated from 10 Downing Street , it said it would issue at the end of March?

Irelands advice to schools when employing biometrics

The Data Protection Commissioner in Ireland has this advice for educational establishments to consider before purchasing biometric technology for use with children. Under the term biometric it includes a fingerprint, an iris, a retina, a face, outline of a hand, an ear shape, voice pattern, DNA, and body odour. Biometric data might also be created from behavioural data such as hand writing or keystroke analysis.

It details consent, proportionality, fair obtaining and processing, fair obtaining of sensitive data (i.e. photographs, health and race), transparency, accuracy, security and retention of data.

The Irish Data Protection Commissioner stipulates that the obtaining of consent is of paramount importance when schools consider the introduction of a biometric system.

The document details points for schools to consider before installing such systems, it then goes on to say:

Before a school or college installs a biometric system, the Data Protection Commissioner recommends that a documented privacy impact assessment is carried out.

This is an important procedure to adopt as a contravention may result in action being taking against a school or college by the Commissioner, or may expose a school or college to a claim for damages from a student. Data protection responsibility and liability rests with the school or college, not with the person who has supplied the system.

The lack of guidance from the UK Information Commissioners Office or government is now becoming conspicuous in it's absence, especially when the percentage of children using biometrics in schools in the UK is probably higher than any other European country.

Australian Biometrics Institute Privacy Code

The Biometrics Institute in Australia have a voluntary Privacy Code, approved by the Australian Privacy Commissioner Karen Curtis, which applies to organisations that have agreed to be covered by the Code. The code came into effect September 2006.

The Code includes privacy standards that are at least equivalent to the National Privacy Principles (NPPs) in the Privacy Act and also incorporates higher standards of privacy
- sounds like the sort of boost our UK Data Protection Act could do with regards to biometrics, certainly in the area of using fingerprint softwear in schools.

On the third page of the Privacy Code, point 2 states that:

The Biometrics Institute Privacy Code seeks to build upon the National Privacy Principles (NPPs) in a manner that provides the community with the assurance needed to encourage informed and voluntary participation in biometrics programs. Biometrics Institute members understand that only by adopting and promoting ethical practices, openness and transparency can these technologies gain widespread acceptance.

The "informed and voluntary participation" and "adoption and promoting of ethical practices, openess and transparency" are points the biometric companies, schools and government in the UK could do with taking on board, at the very least in circumstances where children are involved.