What is the current situation with facial recognition in UK schools?

This situation with facial recognition technology use in UK schools is unknown, as is the case for the amount of schools using pupils biometric fingerprints.  

Using the Freedom of Information Act and catching the media on this as it happens seems to be the only way  to see how this technology is being rolled out, as schools are under no obligation to inform the Information Commissioner's Office (ICO), who oversees the Data Protection Act (DPA) 2018 and the General Data Protection Regulations (GDPR), that they are taking and processing children's biometric data.

As of this week it appears that North Ayrshire Council, Scotland, are in the process of implementing facial recognition in to its 9 high schools and West Lothian Council, also in Scotland, are looking at introducing facial recognition technology in its 11 high schools - a total of approximately 20,000 students.

In England there are:

Kingsmeadow Community Comprehensive School,  Gateshead

Canon Slade CofE School, Bolton

Murray Park Community School, Derby  - Update 20/10/21:  I have been contacted by Realsmart who have stated, "Realsmart do not provide any systems that work with biometrics". I welcome more clarification on this and will post accordingly.

Langley Park School for Girls, Beckenham

...another 5,000 students and I suspect there are quite a few more schools too.

Consent and Legalities

England and Wales - explicit consent from parents must be sought for a school to take and process a child's biometric, which was, up to now, mainly in the form of a fingerprint template, this now however extends to photographs used for a facial recognition system.  This is law and the legislation covering a schools obligation to gain consent is in the Protection of Freedoms Act 2012 (PoFA).

Both parents need to consent and so does the child.  Any child or parent not consenting overrules the consent of a parent that does consent.  An alternative to the biometric system must also be provided and this alternative option should be made aware to the parent/s child - see page 10 of the governments 'Protection of biometric information of children in schools and colleges' advice to schools.

Scotland and Northern Ireland - here the PoFA 2012 does not apply.  Scottish schools have tended to ask for consent in line with the PoFA but recently seem to have taken it upon themselves, from exactly whose advice is unknown at this time, to presume that S1-S3 pupils need parental consent and S4-S6 pupils can consent themselves.  See North Ayrshire's consent forms S1-S3 and S4-S6.  

S4 students are 14/15 years old, under PoFA no student under the age of 18 can consent to their biometrics being processed by schools.

However, this consent process becomes redundant as indications from Europe show that facial recognition in schools is in direct contravention of the EU legislation GDPR.  Rulings against using facial recognition in schools has been acknowledged by our UK ICO in their June 2021 report, page 22, 'The use of live facial recognition technology in public places':

The report went on to state that: "The research found support for the government imposing restrictions on the use of FRT [facial recognition technology] by the police (55%) and in schools (68%). The Ada Lovelace Institute recommends a voluntary pause on the sale of FRT to enable public engagement and consultation to take place." ...in which case why are UK schools spending tax payers money on this legally questionable technology?

The legalities of facial recognition in UK schools is unknown.  We are still subject to the EU GDPR and under that facial recognition use in schools has been in contravention of the strict use of biometrics with minors that the EU Act cites.  

Our ICO appears unable to answer what communications they have had with educational establishments or companies supplying facial recognition to schools.  A recent of Freedom of Information on this was refused on 30th September 2021, citing Section 12, exceeding costs and time - I am hopeful there may be a disclosure of some information though - see here.

See WhatDoTheyKnow for Freedom of Information requests on this topic.

Biometric consent for students in Scotland

Under the Protection of Freedom Act 2012 if schools want to use and process a child's biometric data
they must ask for consent from the pupils and parents.  Schools must also offer an alternative option to access systems if consent is not given to process a student's biometrics - such as a pin number or swipe card.

Schools use a student's biometrics to access facilities such as canteen, library, registration, etc, and the biometric of choice seems to favour the fingerprint.

The Protection of Freedom Act 2012, Chapter 2, details how schools must seek consent to hold and process student's biometric data.  However, this consent only applies to children in England and Wales and with Scottish authorities planning to roll out more biometric technology in schools to extend consent for Scottish students, around the use of their biometric data, is absolutely reasonable. 

In order to move towards consent for children in Scotland (and Northern Ireland) Freedom of Information requests have been sent to every local authority in Scotland to determine how prevalent the technology is in schools, whether consent is sought, type of biometrics used and for what purpose.  As it is school holidays, and given that the beginning of term is busy, we expect to this this information back by end October 2018 and then work to get this issue of consent raised in the Scottish Parliament.

Schools obligations to students biometric data

It's that time of year again, when parents with children going up to high schools are encountering biometric systems in their children's new schools and are unsure of their rights to consent and what responsibilities the school has to ensure school services are not withheld from students who do not participate in their biometric system.  Hopefully this will clarify schools, parents and children's position.  A PDF version can be found here.

A school’s responsibility

A school cannot take and process a student’s, under 18 years old, biometric data without the consent of the parent/s or the student.  Consent must be given in writing from the parent/s.  Consent can be withdrawn at any time.

CONSENT

·         If one parent consents and the other does not, the non-consent takes precedence. 

·         If the parent/s consent and the student does not, the students non-consent takes precedence. 

·         If the parent/s do not consent and the student does consent, the parents non-consent takes precedence.

If a consent is not given the school “must ensure that reasonable alternative means are available by which the child may do, or be subject to, anything which the child would have been able to do, or be subject to, had the child’s biometric information been processed.” as detailed in the Protection of Freedoms Act 2012,Chapter 2 Section 26 (7).

Parents

Parent/s must be informed by the school that they are using a biometric system and the school must gain written consent from the parent/s to take and process their child’s biometric data.  You may withdraw your consent at any time.

Schools do not always make it clear when asking for consent that an alternative to the biometric system is available and that non-consent ultimately lies with the student.

Students

Regardless of consent given by your parent/s you alone determine whether a school takes and processes your biometric data.   If you choose not to use a biometric system the school must provide an alternative and must not withhold any services from you that is available through their biometric system.  You may withdraw your consent at any time.

Legal advice for schools that feel the need to use children's biometric data

If UK schools feel the need to process children's biometric data they should take note of this very informative piece of legal advice from Browne Jacobson.  Schools cannot discriminate against pupils who are not participating in a biometric database and must offer an alternative.

My child has been home educated for the period of their high school education and recently entered back into mainstream education, now attending the local college to do AS levels.  The college botched an attempt to gain parental consent for a new biometric system, introduced September 2014 to make the college 'cashless'.  They swept the consent for biometrics into the medical and school trip consent.  Needless to say the college was informed how the consent process works after I did not sign the consent for anything.

My child can still eat as he is identified via his photograph on the school system.  We parents have to transfer money to the student account for him to pay for this.  We don't as...

• It is a hassle to transfer money - I do not need 'another' thing to do online
• I do not want a digital record to be held of his eating habits
• I am not certain where that information goes
• Food from the local sandwich shop is cheaper, fresher and it feeds the local economy

He, along with his friends, enjoys the fresh air of lunch time walking to the local sandwich shop to eat.  However, my child is still discriminated against in the college as he is unable to use the biometric vending machines (which in itself may not be a bad thing given the food contained).  I will be following this up with the college as a point.

Interestingly, through hearsay from students attending the college, the biometric system has been an epic fail with many students not participating.  Apparently the lunch sales have to dipped to only 11% of what it was previously, so much so that the lure of a mountain bike has been offer to those students buying a 'meal deal' with their fingerprint - their name goes into the draw for the bike.  Pavlovian?

I just wonder who is paying for this incentive to fingerprint the students?

Florida Gov signs legislation to ban biometrics in schools & SIBA's reaction

Florida Gov Rick Scott

Florida Governor Rick Scott signed SB188 on May 12th 2014 which banned biometrics in schools. Groundbreaking legislation, the first of its kind globally.

This now sets a precedent for other like minded states to follow in the same vein.  Governor Scott signed the legislation, as a part of a number of measures to "prevent unnecessary collection of data from our students", to more free up Florida's commitment to the controversial Common Core education initiative.

In the meantime the newly formed Security Identity and Biometrics Association (SIBA), born out of Washington DC in February 2014 (coincidentally in the month the Florida legislature voted overwhelmingly in support of the biometric ban), is very keen to see a halt to schools banning biometrics.

So much so, they have devoted a sizable proportion of their website detailing how SIBA plans to  produce four Fact Sheets, under a promotion named KickStart, to be aimed presumably at schools "to dispel myths; advance positive legislative solutions; report on school uses, successes and challenges; and support schools and their vendors seeking positive change for their communities" costing $2,500 each.  These facts sheets will be advertising the companies that sponsor the sheets.

I could write some fact sheets about biometric technology used by children in schools, with their use both in the UK and US over the past decade for considerably less money, that would be carefully referenced with facts, via citations.   So I await with baited breath to see what 'facts' these four Fact Sheets costing $10,000 will contain.  Hopefully the sheets will have independent, credible evidence to back up any facts made and I look forward to reading them - that is if SIBA publishes them on their website.

SIBA's drive to get schools on board is subtly said in a photograph on this page carrying the statement that "Schools need our help!", when in reality the education system is working absolutely fine without children authenticating themselves via a measurement of their body to eat, register or take a book from a library.

Do adults use biometric technology in order to eat?  No.  In fact there is distrust about biometrics in adult society and is there any wonder with this recent headline from Biometric Update "Canadian academics, privacy groups issue statement against mass spying".  When data protection and privacy laws are not enforceable and general unease lies with biometric technology, why is there a drive to encourage children in schools to use their biometrics?  

Some might say that it is not in the government's interest to have schools ban biometrics when really their agenda is to soften the next generation to the technology, using a compliant environment to do so?

An upcoming event SIBA are having in June 2014 is "closed door" with two speakers, Alan Bersin, Acting Assistant Secretary for policy for the US Department of Homeland Security and Vice-president for the Americas Interpol and Bob Mocny, Director in the Office of Biometric Management, part of the  US Department of Homeland Security.  It is not boding well for transparency when one of SIBA's first events is 'closed door' and the speakers are from a US government department which is widely perceived as having largely eroded the privacy of the people of the United States.

I feel, for me and others concerned about the use of biometric technology with children, SIBA looks like a US government led organisation bent on promoting biometrics in schools, worried by the recent legislation passed in Florida.  I have asked SIBA how they are funded, who their members are and where and when they were conceived as this information is not on their website.

Openness and clarity from SIBA is vitally important on this so that we, as parents, are aware of who is driving the agenda for our children to authenticate themselves with biometric identifiers for day to day services in education...  I await SIBA's answer.