Facial recognition arrives in UK schools

Facial recognition is emerging in UK schools for canteen payments.  The promise of the technology is "to keep pupils safe from allergies and keep the school Covid secure" and to speed up lunch lines, reducing times from however many seconds it was before, to only 5 seconds per pupil 'serve time' with facial recognition technology.  This new biometric technology is, according to the Business Manager at Kingsmeadow School in Gateshead:

 "...just fast!  Better than fingerprints"

The fortuitous supplier of the emerging facial recognition technology is CRB Cunninghams.

Gosh, even faster than fingerprints!  Wasn't that one of the main reasons to introduce biometric technology two plus decades ago?  Because pupils can't forget a thumb but can forget a 4 digit pin or swipe card, hence a thumb on a scanner is faster, right?  Epic fail fingerprint technology - you're obviously just not fast enough.  (Erm... if students can forget a 4 digit PIN what hope have they of passing any exams if their memory is that bad!   Anyway...)

Then is there is the 'Covid secure' reason.  No need to touch anything at the point of sale.  But then a swipe card ticks those boxes too.  The facial recognition technology even works with a mask/face covering... but then so does a PIN or a swipe card.  Plus the hundreds of students passing through a lunch line will have walked through school corridors, placing their hands on the corridor swing doors to get to the dining hall, etc, so I'm not sure the 'Covid secure' reason stacks up.

Then there's the old bullying issue.  According to Ed Tech providers of cashless catering systems, cash in schools = bullying issues.  Well, if that happens the school must sort it out.  Having cashless catering systems in schools won't solve any bullying issues.  As one Reddit user asks 'how can the computer tell if the person isn't being held there by a bully'?  Good question.

History

According to this article, describing CRB Cunninghams recent introduction of facial recognition to school lunch lines, "CRB Cunninghams have used biometric data since 2008 on the cashless catering system".  Erm not quite so.  Cunninghams have been supplying fingerprint biometric systems to schools in Angus, Scotland, since 1999 according to a Freedom of Information request (FOIR) answer from Angus Council.  As far as is known, this the first use of biometric technology with children in schools in the UK, Europe, USA, Canada, and the western world.

Angus Council FOIR response, September 2018:

Cunninghams introduced biometric technology in schools 22 years ago, before the technology was being used anywhere else regularly in society.  Now it's seems they are at the forefront today pioneering facial recognition technology. 

Lucky Cunninghams, first for both biometric fingerprint and now commercially viable biometric facial recognition technology for kids in schools.  Though by no means the only supplier now.  

Innovate, supplying Langley Park School for Girls in Bromley.   

Canon Slade School Parent Facial Recognition Pdf in Bolton using Cunninghams, and Murray Park Community School Parent Facial Recognition Pdf in Derby using Realsmart  - Update 20/10/21:  I have been contacted by Realsmart who have stated, "Realsmart do not provide any systems that work with biometrics". I welcome more clarification on this and will post accordingly 

I stated commercially viable earlier, as facial recognition was trialled in 2010 in ten UK schools by Aurora, for registration purposes, in Northamptonshire, Cambridgeshire and Hertfordshire.  It was quickly ditched as it just wasn't fit for purpose.  Clearly the technology has matured and is now deemed fit for use on children in schools.

Legalities and consent

Well, this is where it gets interesting and complex and warrants another post really but for a quick view see here.  I'll expand on this more in another post.

Fine for processing students’ fingerprints imposed on a school

A statement, issuing a fine, to a school from Poland’s Personal Data Protection Office (UODO), the equivalent to our Information Commissioner's Office (ICO), found the school to be in breach of the General Data Protection Regulations (GDPR) for using children's fingerprint data to allow access to their canteen.  The ruling stated that:

"The school processed special categories of data (biometric data) of 680 children without a legal basis, whereas in fact it could use other forms of students identification."

and

"...it is important to stress that the processing of biometric data is not essential for achieving the goal of identifying a child’s entitlement to receive lunch. The school may carry out the identification by other means that do not interfere so much in the child’s privacy. Moreover, the school makes it possible to use the services of the school canteen not only by means of fingerprints verification, but also electronic cards, or by giving the name and contract number. Thus, in the school, there are alternative forms of identification of the child’s entitlement to receive lunch."

Here in the UK biometric fingerprint readers have been used in schools since 1999.  Up to 2012 schools were using children's fingerprints quite often without informing parents or asking their permission, as a consequence after some pressure upon the UK Government to address this, legislation was passed in 2012 requiring schools to obtain parental permission to process their child's biometric data and offer an alternative means to the biometric system. 

However, a survey done by children's data privicacy group defenddigitalme found that even after the 2012 legislation parents were still unaware of options not to use the fingerprint system.

Children's biometric data needs to be secure for the child's lifetime - decades.  It does seem excessive to use biometric data for daily mundane tasks in school, when another form of ID is perfectly acceptable - we have expressed that view since 2005.

This point was also expressed in the UODO report according to Venturebeat:

'The final decision cited numerous facets of GDPR, including recital 38, which refers to specific provisions made for data protection of children, "it should be emphasised that children require special protection of personal data, as they may be less aware of the risks, consequences, safeguards, and rights they have in connection with the processing of personal data" the report found.'

If the Polish Data Protection Office have ruled this use of children's fingerprint biometrics as a violation of GDPR then presumably the same would apply to any school using such systems in the UK.

This is absolutely a GDPR issue we will be following up here in the UK.

The English text of the UODO decision is here and the Polish version here.

'Who knows what about me?'

The publication of the "Who knows what about me?" report today by the office of The Children's Commissioner for England highlights the huge amount of data gathered on children, including the use of biometric technology in schools.

5 salient points about biometric technology used in schools is listed in the infographic in this post.

Using one's biometric data is a more data intrusive way of accessing schools services than a PIN or swipe card.  This has been recognised by legislation and schools therefore are legally obliged to offer students an alternative means to access such services and must have consent, from both parents and students, if biometric data is to be taken and processed.

Schools in the UK have been using biometrics since 1999.   Often this was done without informing parents due to the fact that the Data Protection Act 1998 did not list biometrics as 'sensitive' personal information, hence parents permission or even knowledge that their children's biometric were being taken happened.

Many different types of biometric technology have been used in schools. The biometric most used is fingerprint.

Campaigning by parents lobbying Members of Parliament culminated, 13 years after schools started using the technology, with legislation covering consent to biometric processing in the Protection of Freedoms Act 2012, Chapter 2.

It is prudent to minimise personal data given.  We have no idea if a child's biometrics given in the education system is compromised or shared, with other agencies or companies, the effect this may have later in their life.

Know your facts and consider keeping your child's biometric digital data from unnecessary use when an alternative means of identification will suffice.

Biometric consent for students in Scotland

Under the Protection of Freedom Act 2012 if schools want to use and process a child's biometric data
they must ask for consent from the pupils and parents.  Schools must also offer an alternative option to access systems if consent is not given to process a student's biometrics - such as a pin number or swipe card.

Schools use a student's biometrics to access facilities such as canteen, library, registration, etc, and the biometric of choice seems to favour the fingerprint.

The Protection of Freedom Act 2012, Chapter 2, details how schools must seek consent to hold and process student's biometric data.  However, this consent only applies to children in England and Wales and with Scottish authorities planning to roll out more biometric technology in schools to extend consent for Scottish students, around the use of their biometric data, is absolutely reasonable. 

In order to move towards consent for children in Scotland (and Northern Ireland) Freedom of Information requests have been sent to every local authority in Scotland to determine how prevalent the technology is in schools, whether consent is sought, type of biometrics used and for what purpose.  As it is school holidays, and given that the beginning of term is busy, we expect to this this information back by end October 2018 and then work to get this issue of consent raised in the Scottish Parliament.

Updates coming... new developments

Since I started this blog over 10 years ago the state of surveillance, monitoring and application of biometric technology used in schools on our children, the next generation, has increased beyond imagination.  Okay, there may be arguments that his 'improves' their education, enables better educational analysis, reduce admin time/costs, etc... but personally, I've not seen a dramatic increase in the next generations intellectual ability or schools being more affluent because of technology.  Certainly here in the UK we currently have a national funding crisis in education. 

Credit: https://www.pinterest.co.uk
/pin/68539225552401806/

It is a different education that is needed for today's kids.  Access to information is greater to an individual than ever before.  Knowing and retaining information in this age maybe is not a necessity as much as it was.  Moreover how to apply that knowledge in this ever changing society perhaps is a skill children should learn.  Discernment, where one's digital footprint is left and the data left again one's digital identity should also be considered.  How, who and what may be assumed by a children's online activities on the Internet - and within a school network - is a burgeoning area that needs urgent consideration, especially for those it could potentially affect in decades to come. 

With governments, private education tech companies and private companies running schools having access to individual educational data from the age of 2 years old (in the UK) to 19 and beyond gives an enormous potential for profiling.  I could write about this for an age, as these are all points that have been raised with the proliferation of technology in education for the past decade plus.

What to do?  I have been absent somewhat from blogging here as the transfer of biometric technology tested used on children in the UK has now widened into the rest of society.  My concern is when the state uses biometric technology without consent, much as schools did from 2001 - 2013 in the UK.  I set up a sister blog a couple of years ago to keep the two developments of biometric technology, schools / wider society, separate - see my State of Surveillance website.

However, there is now an issue of facial recognition creeping into US and Chinese schools for a variety of reasons.  Here in England and Wales (not Scotland or Northern Ireland) facial recognition is not viably an option for schools with under 18 year olds, as per the consent required under the Protection of Freedoms Act 2012.   The argument for the use of biometrics in schools - whether  fingerprint or facial recognition - is basically unproven, as other, less invasive, less 'valuable', means of identification will suffice.   This is an issue I intend to raise again here.

So, hopefully, (in a rather large nutshell) I've explained my absence and fully intend at least once a week to start again back here.   T'will be nice to get back to it!

Schools asking for consent to process children's biometrics

I am getting a lot of emails from concerned parents of children leaving primary school to go to secondary school with the way that the secondary schools are asking for consent to use their child's biometrics - fingerprint, fingertip data - and not offering an alternative method to access the catering, library, registration, etc, system.  In this parents are feeling that their request for consent is coerced.

Schools MUST offer an alternative to biometrics.  The Protection of Freedoms Act 2012, Chapter 2, Section 27 (7) states that: 

The relevant authority must ensure that reasonable alternative means are available by which the child may do, or be subject to, anything which the child would have been able to do, or be subject to, had the child’s biometric information been processed.

Unfortunately some parents have been made to feel from schools that they are being unreasonable in not giving consent and that they are they only one objecting to biometric consent.  You are not a 'problem parent'.  You and your child have a right to not give the school biometric data - data that is absolutely unique, personal, highly precious and that needs to be secure for the child's life time.

Parents feeling isolated by a school is a story I have heard over the past 10 years so many times from so many parents - you are not alone at all.  I myself last year, when my child entered sixth form, was told by the Principal that I was the only parent objecting to them using my child's biometrics - I was not.

Quite often the supplier of the biometric system to the school will also offer alternative means of accessing the system they provide.  Examples are swipe card, PIN number and taking the names of the children at the point of sale at the till, so it shouldn't be an inconvenience for the school to offer alternative means of identification.

The new EU General Data Protection Regulations is law for every member state of the EU, including us.  It came into law 27th April 2016.  Schools are subject to this.

Point 32 states:

Consent should be given by a clear affirmative act establishing a freely given, specific, informed and unambiguous indication of the data subject's agreement to the processing of personal data relating to him or her, such as by a written statement, including by electronic means, or an oral statement.

Point 42 states:

Consent should not be regarded as freely given if the data subject has no genuine or free choice or is unable to refuse or withdraw consent without detriment.

If anyone has any concerns or questions please don't hesitate to get in touch, I'm really happy to help if I can.

Compulsory fingerprinting for primary school children in Australia

Fingerprinting children in school, especially primary school children, is a contentious issue - with parents and children having the right in the UK not to participate.  Schools must seek written consent to take and process a child's biometric data.

Not so in Australia it seems.

In this article it reported that East Para Primary School has told parents they have "no choice" in the matter for a school registration system that will eventually be introduced for parents too if they want to enter the school.  The school's current newsletter states the same blerb parents have had here in the UK reassuring that no image of the fingerprint will be stored, it cannot be reconstructed and the biometric data will not be given to government or agencies... but put plainly it is a biometric mark/measure of your child's body, in this case a fingerprint, that has to stay secure, safe and never be compromised.

Giving up ones biometric may not be considered a proportionate use of personal data.  Parents should be able to decide what level of privacy they want for themselves and their children in this respect.

The article 'East Para Primary School pupils to have fingerprints scanned as part of new student attendance record-keeping program' goes on to report:

School mother Sandra Tomasin said she was disgusted by the move and immediately rang the school to ask that her Year 1 son be exempt from the program.

“They have told me that I have no choice,’’ Ms Tomasin said.

“It is an invasion of privacy. I don’t want to let it happen but I want to keep him at the school.’’

Ms Tomasin said regardless of whether or not finger prints were stored by the system, primary school children having to scan their fingers when they came and went to school was outrageous.

Sandra Tomasin is rightly outraged and should have a right for her child to attend school and NOT having to give up their biometric data.

In the UK schools fell short of giving this ultimatum as it was thought to breach Human Rights legislation by denying a service to a child because they chose not to give up their biometric data, any ultimatum of this sort was also on shaking grounds with Article 16 of the UN Convention on the Rights of the Child  (right to privacy) "Every child has the right to privacy. The law should protect the child’s private, family and home life." - which does apply to Australia.

The below statement was made by Privacy International in 2002 about library systems that used children's fingerprint biometrics in the UK to log books in and out.  It is still applicable now.