Infrared palm scanning Irish students for registration

A school in Ireland, Coláiste an Chraoibhin in Fermoy, is considering infrared palm scanning for their pupils in order to register them at school.  How widespread is this infrared palm scanning in Irish schools or schools in the UK?

Back in 2006, Amey & Fujitsu introduced infrared palm scanning to a Scottish primary school, Todholm Primary school.  However, infrared palm scanning technology never spread here in the UK and emerged in schools in the USA around 2011.  After extensive Googling (yes I know I shouldn't use it) I can see no companies here in the UK or Ireland selling infrared palm scanning technology for registration or otherwise.

However the various reporting in the press of Coláiste an Chraoibhin School considering infrared palm scans is ambiguous.  One report states that:

"Almost 100 schools around the country, including 12 in Cork, are already using swipe card technology to record pupil attendance.  However only six schools nationwide are using biometric scanning technology."

So only 6 schools use biometric scanning technolog... or do they? - this from the Head Teacher, Mr Healy:

"To be honest, I don't know what all the fuss is about. This is a system that is already widely used across the country. In fact one supplier I spoke to said he is working with more than 100 schools"

So who is supplying biometric palm scanners to 6 or is it 100 schools in Ireland?  Clearly (or unclearly in this case) a company or companies that decide to have little or no web presence about the fact they offer infrared palm scanning solutions for schools - strange? 

Will schools in the UK be offered infrared palm scanning technology too? And will infrared palm scanning be an easier sell  to schools and parents, now that parents and child consent is required in the UK, as a 'softer' biometric technology rather than harvesting a child's biometric fingerprint?

Gathering biometrics from the population whether it be fingerprint or palm vein scanning is still reaping incredibly personal data about a person.   With less data invasive methods around, using biometric technology in schools is completely unnecessary.  If the argument being used (which this is in this case) is that swipe cards have a cost to replace, then use a pin system or password system instead.  It could be argued that a swipe card's ability to be lost actually teaches a child to look after the card/identity and that there are consequences if carelessly loosing it.  

Mr Healy states that "there will be no data protection issues involved" and "says he's been told they [infrared palm scans] don't contravene data protection laws".  Mr Healy may well be right and that data gathering such personal information does indeed have the potential to be fine - but it also has the potential not to be fine if it falls in the wrong hands or abused.  

After recent news about Prism, our society does not have a great track record of honesty regarding data collection, keeping data safe and secure or using it for good.   Personally, I would refuse to use.

Another concerned parent blogging about fingerprinting children

Another parent has set up a blog after their high school in Derry, Northern Ireland, fingerprinted pupils WITHOUT parental consent - worth a read - http://stopfingerprintingschoolchildren.blogspot.com/

"Oakgrove College Derry, a secondary school in the north of Ireland has fingerprinted most of its pupils to "help speed up school meals". Parental consent was not sought before this mass fingerprint piracy was launched. This sneak attack on civil liberties should be opposed by every parent who cares for the personal data of their children"

With no surprise at all the DCSF's (DfES) guidance is being totally ignored by schools (if they even know it exists). The Information Commissioner's Office states that schools doing this, not involving parents, is "heavy-handed".

Heavy-handed it may be but schools do it. Until the law is changed this children's biometric market grows - with every penny of it being generated by the taxes we pay.

There is a growing band of annoyed, concerned parents voicing their anger and worries on this.

The NO2ID message board on biometrics in schools is getting busier with more parents outraged that their children have been fingerprinted and posts on there from concerned students too with lots of good advice there too.

Good for the parent who's started that blog - more people should know about this.

Irish workers refuse to use biometric system

Workers at The Abbey Theatre in Dublin have refused to give up their personal biometric data for a biometric system that "concerns the health and safety of the Abbey’s 100 full-time staff working in the buildings at various times across the course of the morning, day and night."

How can giving up your personal biometric data improve your health and safety working in a theatre? The biometric system is in it's first phase with the second phase being rolled out monitoring time and attendance according to the Sunday Business Post.

If adult workers are not happy with using such systems - why is it used with children without gaining parental permission or even letting parents know?

There are obviously concerns amongst the adult population about the uses of such technology and the level of personal data we as adults wish to give up, yet as a society we are creating a "do as I say not as I do" situation with biometrics in schools and children's privacy rights.

Irish schools eager to fingerprint children

According to this article 50 schools in Ireland have expressed an interest in installing biometrics in the past month. Costs are between 10-20,000 euros dependent on the size on the school.

John Beckett, managing director of Byamsys, the company selling the fingerprint systems, states:

“There’s no way to reproduce the data we store as a fingerprint. We don’t store the data as a fingerprint. When students check in their fingerprint is scanned and converted into a string of letters and numbers which is encrypted and then compared to the encrypted file that we have already for that person. There’s never a decryption process."

How can he state there is never a decryption process? Has he got the ability to scry into the future? See Kim Cameron's site "Just lie to sell your product" ...

Digital Rights Ireland have rightly expressed their concerns over the increase of the use of biometric technology in schools, their Chairman TJ McIntyre states:

“There is a standard that’s used across the industry for biometrics to ensure different systems are compatible... but what they [biometric vendors] don’t explain is that the information used there is capable of being reconstructed to give you soft fingerprint information and it’s still possible to be used in police work."

Bernie Goldbach of Digital Rights Ireland, “With a card you’re not exactly sure it’s the same person but most kids don’t give up cards that have money on them and they don’t lose them. They learn a bit of responsibility without losing a part of their identity."

Responsibility and ownership of ones identity is a crucial lesson for children to learn as they grow up in a digital age.

However the messages they receive from using biometrics without question in schools is a potentially dangerous lesson that we, in our ignorance, are teaching them.

The Data Protection Commissioner in Ireland has issued guidelines about the use of biometric fingerprinting in schools. The main stipulation was that parents and children over 18 had to give their consent to use the system and that schools also carry out a detailed 38 point Privacy Impact Assessment before installing biometric fingerprint systems to limit any legal claims for damages in the future from students.

The guidelines are not statutory and are simply advice.

Regulation deadline has not been met by Government for millions of children's biometrics held on school PC's

Both the Liberal Democrats and Conservatives are vocalising their serious concerns about using biometric fingerprint scanners in schools (see blog side bar of parliamentary questions asked), and experts such as Kim Cameron express worries about this practise.

Even BECTA recognises the "concerns of parents" and internationally Roderick Woo, Justice of the Peace at the Hong Kong Office of the Privacy Commissioner, states about the use of biometrics in schools:

"I considered the consent of the staff and pupils rather dubious, because primary school's consent in law cannot be valid and there's undue influence. If the school says, 'give up your fingerprint', there's no way of negotiating.

"Also it's not a good way to teach our children how to give privacy rights the consideration they deserve,"

The Irish Data Commissiors Office has this guidance issued and warns schools about the danger of legal action, "claim for damages from a student", if they don't implement a detailed Privacy Impact Assessment.

There are laws in the USA regulating this technology and children.

But when schools send letters like this school in Doncaster did to parents, and another example over on Tarique Naseem's blog something is radically wrong.

What is going on when we parents have to sign slips for our child's image to be taken but yet when it comes to their bodily biometric data lying on a school PC - no consent, no even letting us know, no nothing!

Why, when ALL the above people and more are expressing serious concerns with fingerprinting children in schools, is the government not moving on the promised guidelines,as stated from 10 Downing Street , it said it would issue at the end of March?

Irelands advice to schools when employing biometrics

The Data Protection Commissioner in Ireland has this advice for educational establishments to consider before purchasing biometric technology for use with children. Under the term biometric it includes a fingerprint, an iris, a retina, a face, outline of a hand, an ear shape, voice pattern, DNA, and body odour. Biometric data might also be created from behavioural data such as hand writing or keystroke analysis.

It details consent, proportionality, fair obtaining and processing, fair obtaining of sensitive data (i.e. photographs, health and race), transparency, accuracy, security and retention of data.

The Irish Data Protection Commissioner stipulates that the obtaining of consent is of paramount importance when schools consider the introduction of a biometric system.

The document details points for schools to consider before installing such systems, it then goes on to say:

Before a school or college installs a biometric system, the Data Protection Commissioner recommends that a documented privacy impact assessment is carried out.

This is an important procedure to adopt as a contravention may result in action being taking against a school or college by the Commissioner, or may expose a school or college to a claim for damages from a student. Data protection responsibility and liability rests with the school or college, not with the person who has supplied the system.

The lack of guidance from the UK Information Commissioners Office or government is now becoming conspicuous in it's absence, especially when the percentage of children using biometrics in schools in the UK is probably higher than any other European country.