Biometric consent for students in Scotland

Under the Protection of Freedom Act 2012 if schools want to use and process a child's biometric data
they must ask for consent from the pupils and parents.  Schools must also offer an alternative option to access systems if consent is not given to process a student's biometrics - such as a pin number or swipe card.

Schools use a student's biometrics to access facilities such as canteen, library, registration, etc, and the biometric of choice seems to favour the fingerprint.

The Protection of Freedom Act 2012, Chapter 2, details how schools must seek consent to hold and process student's biometric data.  However, this consent only applies to children in England and Wales and with Scottish authorities planning to roll out more biometric technology in schools to extend consent for Scottish students, around the use of their biometric data, is absolutely reasonable. 

In order to move towards consent for children in Scotland (and Northern Ireland) Freedom of Information requests have been sent to every local authority in Scotland to determine how prevalent the technology is in schools, whether consent is sought, type of biometrics used and for what purpose.  As it is school holidays, and given that the beginning of term is busy, we expect to this this information back by end October 2018 and then work to get this issue of consent raised in the Scottish Parliament.

Schools obligations to students biometric data

It's that time of year again, when parents with children going up to high schools are encountering biometric systems in their children's new schools and are unsure of their rights to consent and what responsibilities the school has to ensure school services are not withheld from students who do not participate in their biometric system.  Hopefully this will clarify schools, parents and children's position.  A PDF version can be found here.

A school’s responsibility

A school cannot take and process a student’s, under 18 years old, biometric data without the consent of the parent/s or the student.  Consent must be given in writing from the parent/s.  Consent can be withdrawn at any time.

CONSENT

·         If one parent consents and the other does not, the non-consent takes precedence. 

·         If the parent/s consent and the student does not, the students non-consent takes precedence. 

·         If the parent/s do not consent and the student does consent, the parents non-consent takes precedence.

If a consent is not given the school “must ensure that reasonable alternative means are available by which the child may do, or be subject to, anything which the child would have been able to do, or be subject to, had the child’s biometric information been processed.” as detailed in the Protection of Freedoms Act 2012,Chapter 2 Section 26 (7).

Parents

Parent/s must be informed by the school that they are using a biometric system and the school must gain written consent from the parent/s to take and process their child’s biometric data.  You may withdraw your consent at any time.

Schools do not always make it clear when asking for consent that an alternative to the biometric system is available and that non-consent ultimately lies with the student.

Students

Regardless of consent given by your parent/s you alone determine whether a school takes and processes your biometric data.   If you choose not to use a biometric system the school must provide an alternative and must not withhold any services from you that is available through their biometric system.  You may withdraw your consent at any time.

Schools asking for consent to process children's biometrics

I am getting a lot of emails from concerned parents of children leaving primary school to go to secondary school with the way that the secondary schools are asking for consent to use their child's biometrics - fingerprint, fingertip data - and not offering an alternative method to access the catering, library, registration, etc, system.  In this parents are feeling that their request for consent is coerced.

Schools MUST offer an alternative to biometrics.  The Protection of Freedoms Act 2012, Chapter 2, Section 27 (7) states that: 

The relevant authority must ensure that reasonable alternative means are available by which the child may do, or be subject to, anything which the child would have been able to do, or be subject to, had the child’s biometric information been processed.

Unfortunately some parents have been made to feel from schools that they are being unreasonable in not giving consent and that they are they only one objecting to biometric consent.  You are not a 'problem parent'.  You and your child have a right to not give the school biometric data - data that is absolutely unique, personal, highly precious and that needs to be secure for the child's life time.

Parents feeling isolated by a school is a story I have heard over the past 10 years so many times from so many parents - you are not alone at all.  I myself last year, when my child entered sixth form, was told by the Principal that I was the only parent objecting to them using my child's biometrics - I was not.

Quite often the supplier of the biometric system to the school will also offer alternative means of accessing the system they provide.  Examples are swipe card, PIN number and taking the names of the children at the point of sale at the till, so it shouldn't be an inconvenience for the school to offer alternative means of identification.

The new EU General Data Protection Regulations is law for every member state of the EU, including us.  It came into law 27th April 2016.  Schools are subject to this.

Point 32 states:

Consent should be given by a clear affirmative act establishing a freely given, specific, informed and unambiguous indication of the data subject's agreement to the processing of personal data relating to him or her, such as by a written statement, including by electronic means, or an oral statement.

Point 42 states:

Consent should not be regarded as freely given if the data subject has no genuine or free choice or is unable to refuse or withdraw consent without detriment.

If anyone has any concerns or questions please don't hesitate to get in touch, I'm really happy to help if I can.

Legal advice for schools that feel the need to use children's biometric data

If UK schools feel the need to process children's biometric data they should take note of this very informative piece of legal advice from Browne Jacobson.  Schools cannot discriminate against pupils who are not participating in a biometric database and must offer an alternative.

My child has been home educated for the period of their high school education and recently entered back into mainstream education, now attending the local college to do AS levels.  The college botched an attempt to gain parental consent for a new biometric system, introduced September 2014 to make the college 'cashless'.  They swept the consent for biometrics into the medical and school trip consent.  Needless to say the college was informed how the consent process works after I did not sign the consent for anything.

My child can still eat as he is identified via his photograph on the school system.  We parents have to transfer money to the student account for him to pay for this.  We don't as...

• It is a hassle to transfer money - I do not need 'another' thing to do online
• I do not want a digital record to be held of his eating habits
• I am not certain where that information goes
• Food from the local sandwich shop is cheaper, fresher and it feeds the local economy

He, along with his friends, enjoys the fresh air of lunch time walking to the local sandwich shop to eat.  However, my child is still discriminated against in the college as he is unable to use the biometric vending machines (which in itself may not be a bad thing given the food contained).  I will be following this up with the college as a point.

Interestingly, through hearsay from students attending the college, the biometric system has been an epic fail with many students not participating.  Apparently the lunch sales have to dipped to only 11% of what it was previously, so much so that the lure of a mountain bike has been offer to those students buying a 'meal deal' with their fingerprint - their name goes into the draw for the bike.  Pavlovian?

I just wonder who is paying for this incentive to fingerprint the students?

Defiant 13 year old - "stand up for what they believe in, even if it means standing alone"

Melody, 13, protesting the
 United Kingdom's policy of
 obtaining biometric data
 from minors at school.
Photo: Kirstie

After reading about a 13 year old's plucky stance objecting to her school using a biometric fingerprint system last week, by wearing an Anonymous Mask, it gave me some hope that having a choice in this matter is filtering through to children.  Children that do not want to be part of a biometric system ultimately have the last say on this - if they do not want to participate their decision overrides consent given by their parents (though in this case the parent did not consent).

The school involved in this, should have made clear to the students that they have a choice in this.  The Department of Education's template letter for schools to send to parents states:

'Even if you have consented, your child can object or refuse at any time to their biometric information being taken/used. [His/her] objection does not need to be in writing. We would appreciate it if you could discuss this with your child and explain to them that they can object to this if they wish.'

Not knowing the name of the school Melody attends, the student who objected, I am not able to ask the school or check their website, to see if they made this fact known to students or their parents.  Maybe they didn't judging by Melody's comments to the Digital Journal. 

"Many didn't want their fingerprints taken, but on the day when the fingerprinting was to take place, there was only me and a friend. And she has now had her fingerprints taken."

The next statement made by Melody is quite concerning:

"The dinner lady got my finger and tried to move it onto the scanner even while I was wearing my mask, I had already explained I'm not doing it and didn't have my mum's consent [to be fingerprinted]. I just pulled my hand away and refused again."

Really?  Isn't that assault, an adult trying to move a child's finger onto a scanner when they have already expressed their legal right to refuse?  This is highly irregular and indicates the staff have no idea of the child's rights in law as contained in the Protection of Freedoms Act 2012, Chapter 2, 26 (5) which reads:

But if, at any time, the child— 

(a) refuses to participate in, or continue to participate in, anything that involves the processing of the child’s biometric information, or 

(b) otherwise objects to the processing of that information,  

the relevant authority must ensure that the information is not processed, irrespective of any consent given by a parent of the child under subsection 

Good for Melody that she held out from this intimidation.  She knows her rights and that of her parents and is exercising them.  If only more children had this conviction maybe biometric technology would not be viable in schools.  As it seems that schools are not telling students they have this right, then in a compliant environment which school is, students are going to feel compelled to conform and give up their biometric identifier if they do not know they have the right to say 'no'.  As Melody's Mum stated in the Digital Journal's article, "You can either be part of the solution or remain part of the problem".   Parents can be "part of the solution" and not consent to this and so can the students - if they are given that choice by the knowledge they too can refuse.

Let's hope the message Melody sends out by her opting out inspires other children to do the same.

When Melody was asked what do you think will happen next and a message to give, she replied:

"In all honesty, I don't know. But I hope my actions have encouraged my generation to stand up for what they believe in, even if it means standing alone... We shouldn't be scared of giving our opinion or not following the rules."

Words of wisdom and strength of heart coming from a 13 year old.  We should take stock of what this teenager is saying here.  There is incidious surveillance creeping into schools which is slowly desensitising the next generation into a Big Brother state, so it is heartening to see that Melody has refused to use by wearing an Anonymous mask conveying her opinion on "taking children's privacy away." 

Biometrics not so flavoursome for school catering

Over on What Do They Know, a UK website for Freedom of Information requests (FOIR), there have been some requests made to schools about biometric systems used.

Some interesting figures are emerging.  For example, Falmouth School in Cornwall has a biometric system for school meals, the take up after asking for parental consent is 34%.  Only 355 children are using the biometrics system out of a school role of 1044.

The school recently put a plea out to parents to use the biometric system: "Please could I ask as many students as possible to register to pay using the biometric system." 

Falmouth School's appeal to parents for consent to
 their children's biometrics used for cashless catering

Another school, Honiton Community College, has a biometric system where only 628 pupils and parents have consented to their biometrics being used - a 68% take up rate, with 203 not consenting, 22% .  As there are 926 students on their schools role, quite what the remaining the remaining 95 children are doing for lunch is not detailed in the Freedom of Information request reply from the college - maybe they are opting for packed lunch?

So why are schools buying identification systems for food that are only 34% - 68% effective, then having by law, in the recent Protection of Freedoms Act 2012, to provide an alternative means of identifying oneself in order to access food - surely this is a waste of taxpayers hard earnt money?

Why don't kids use use money?  Children use money out of school... oh yes, according to schools, it encourages bullying apparently.  Does it really?

Are the Headteachers and Principles so incompetent that they cannot sort out bullying issues? - if there is really an issue here at all.  If a leader of a school has to resort to buying an inefficient technology in order to eliminate bullying in a lunch line should that Principle or Headteacher be in the job, as presumably they cannot sort out bullying elsewhere too?  Also is it not the duty of a healthy society to encourage children to know how to handle money, keep it safe, not steal other's money and behave responsibly around cash?

The argument for having biometric technology in schools is weakening.  Complaints need to to be made to schools Governors, who have a responsibility to spend the public's money wisely.  On the governments Audit Commission's website (Protecting the Public's Purse)  there is an booklet entitled - Fraud risks in schools advice for school governors where it states:

"School governors share a responsibility for protecting taxpayers’ money:  As a school governor you have a special additional role. As governors you are individually and collectively responsible for proper control of your school’s finances. The buck does not stop with the financial administrator."

Maybe, in these times of austerity, we need to start holding these governors to account, spending our money on biometric systems that are clearly not fit for purpose in a school environment.

What happens if UK schools do not comply with written parental consent for children's biometrics?

This new school term in the UK presents parents with a new transparency regarding the data a school holds and processes on their children.  A transparency that parents in the UK have not had before.  Since 2001 schools have been taking, storing and processing children's biometric data and have been able to do with without consent or consultation with the parent/s. This nearly happened to my children in 2005 when they were six and seven years old, hence this blog.

After campaigning, lobbying parliament and working with other committed parents and privacy organisations The Protection of Freedoms Act 2012 was passed in May 2012 and as of September 1st 2013 schools by law need to gain written parental permission before taking a child's biometric data.

This is what the Department of Education stated in reply to a recent Freedom of Information Act request when asked:

Q -  What action will be taken by which body if any school is in breach of its statutory duty to comply with the Act?

A - As you are aware, the new provisions in the Act will come into force from 1 September 2013.  The provisions will apply to any school, sixth form college or further education institution using biometric systems where education is provided to children under 18. 

These new duties require schools and colleges to notify all parents that they intend to take and process their child’s biometric information and, as long as no one objects in writing, the written consent of only one parent will be required.  

It is important that consent is actively sought and received and that it is informed consent: requiring schools and colleges to gain written consent makes sure that parents are aware both that their child’s school uses an automated biometric system and that it is up to them whether or not their child’s biometric data is taken.   
In addition, as you have highlighted, a pupil can object or refuse to participate in the processing of his or her biometric information. The child’s right to refuse applies both to the giving and the on-going storage and processing of biometric data. If at any time the child objects to the processing of biometric data the school or college must stop doing so.   

Where pupils do not use automated biometric recognition systems, either because their arents have refused consent or they themselves have refused to participate, schools are required to provide reasonable alternative arrangements for them.

The Department of Education's second reply to the initial question goes on to state that (as the above first response did not answer the querient's request): 

There are two bodies that have the remit and powers to investigate a complaint concerning a breach of a school’s duties under the Protection of Freedoms Act 2013, when this Act comes into force for schools in September 2013, and the existing Data Protection Act 1998.

I should first say that if, in the first instance, you believe that a school has failed to comply with the requirements of the Act, you should first complain to the school using the formal complaints process. Each school in England is required by law to have a complaints procedure and to publicise that procedure. If, having exhausted the full complaints process (including appealing), you are not happy with the outcome of your complaint, then two further options are available to you. 

If the school has failed to comply with its duties under the Protection of Freedoms Act (e.g. failing to notify each parent of a child of the school’s intention to use the child’s biometric data), and the school concerned is a maintained school, the Secretary of State may consider and investigate the complaint directly with the school’s governing body.  If it was decided that the school had not complied with their statutory duties under the Act, the Secretary of State could issue a direction to the school.   

On the other hand, if the school fails to comply with the Data Protection Act (e.g. processing or handling the data inappropriately), the  Information Commissioner’s Office (ICO) may investigate the complaint.

So if you are not happy in the way consent has been sought, from you or your child, or you may be a parent who has not been informed by the school of its intent to process your child's biometric data, these are the procedures you can go through to hold the school to account.

Schools have been informed by the Department of Education how to comply with the law but I have already had a number of communications with parents who have forwarded me 'consent' communication/forms received from their children's school which do not comply with Department of Education guidelines.  

Some schools are not offering an alternative for children not using biometric systems, some schools hinting that if the consent form is not signed they will assume consent, schools making false assurances stating that no one else has access to that biometric data - which is incorrect because police can access school fingerprint biometric databases by making an access request (see Q50 and51) and not necessarily tell the parent or child.  Some schools claim that the data stored is not a fingerprint, which is true in the sense it is not a replica of their child's print, and not part of the Department of Education Guidelines - but the digital biometric data stored form a child acts like a fingerprint, it can identify like a fingerprint and can convict like a fingerprint.

One parent telephoned to say that her child, upon an induction day to high school, had been told by school staff that if Mummy did not sign the consent form the child would not be allowed in the canteen over dinner time to sit with their friends.  The child was understandably distressed by this and the parent obviously concerned. 

I hope these are isolated instances of bad practice but if you are not happy with how your school has acted in this, you have the above information to help decide the next course of action you wish to take or email me.

Who exactly supplies schools with biometric databases?

Think again when you are told that school biometric systems cannot exchange information or be compatible with other databases or that no one else has access to your child's biometric data. 

Northrop Grunman, a leading global security company that runs the UK Police fingerprint and DNA database and "works with governments, the Armed Forces, civil agencies and private sector companies around the world" also supplies biometric systems for children in schools. 

"AD&S provides biometric machines for companies ranging from defense contractors like Northrop Grumman Corp. to a small Atlanta airliner to more than 40 schools districts."  Mississippi Business Journal 14 June 2013

It is of no matter that this story comes from the US. Our UK government has no idea of the biometric technology used in UK schools, how secure it is or who supplies it. No checks are carried out at all, we know this through Freedom of Information requests.

So when you are asked for written consent for a school to store and process your child's fingerprint identifier (this becomes law in September 2013 in the UK) just bear in mind what you are giving up and to whom you may giving it to.  

Oh yes, we do have a Data Protection Act but we also have a situation where potentially police may have access to your child's biometric data too in UK schools - without parents knowledge.  There are protocols to follow I'm sure but here in the UK we do not have a great track record on storing data we do not need and then being fair in destroying it.  We only have to look at the UK Police National DNA database IDENT1 for that. 

"The DNA of thousands of innocent children is being taken by police and stored on the national database, campaigners say on Monday, citing new figures.  Police have taken the DNA of 120,000 children in the last two years" The Guardian 20th May 2013

Accountability for school implementing biometrics

A school in Salford, Manchester, UK, has recently implemented a fingerprint biometric system. 

The method by which the school has communicated with parents and how the system has been implemented has concerned one parent enough, after gaining some information via a Freedom of Information request, to set up a Facebook page detailing how the system is being introduced in the school with children and about biometric systems in schools in general. 

The forthcoming legislation, coming into force this September 2013, it seems, is providing a good and long needed neccessary platform to enable parents and the public to ensure schools act responsibly when using such biometric systems that process children's biometric data.

Current news from parents concerning biometric systems in schools are listed the social media links on this topic, on this page's right hand menu bar.

A parent's communication with school implementing biometrics

This month a concerned parent wrote to her child's school after finding out the school was planning to implement a biometric system.  She has kindly allowed the communications to be published so other parents wanting to use any of the information, the Freedom of Information request or the letter, sent to the school can see some questions to ask and points to consider.

Freedom of Information request sent to a school implementing a biometric system and a Letter raising concerns and links to aspects for the school to consider.

The law changes here in the UK.  Come September 2013 schools must have the written signature of one parent and the consent of the child in order to process a students biometric data. 

In light of this the UK Department of Education published these guidelines and template letters for schools to use in light of the pending leglislation:
Protection of Biometric Information of Children in Schools.
Government response to the consultation on draft advice on protection of information of children in schools

Biometrics at Blacon

Blacon High School, West Cheshire, UK, implemented a fingerprint biometric catering system in June last year, 2012.

A letter was sent out Tuesday 12th June telling parents that the system would be going 'live' the following Thursday of the next week, 21st June.  With Blacon High School taking the children's biometrics on Monday 18th June.

That gave parents just 3 - 4 working days to read the letter (we parents do not always read letters the day we get them), do some research into biometrics in schools (which throws up a myriad of issues) and contact the school if they did "not want your child to be included in the system".

Mmmm... a hurried state of affairs here it seems.  Blacon High School's speedy communication in relation to biometric registration is very similar to how other schools have operated.

In most instances of parents contacting this blog and the Leave Them Kids Alone site, this type of hurried biometric implementation has also been experienced.  One could argue that this method allows less time for parental objection, so that a higher, more covert, proportion of pupil biometric take up is ensured.

Certainly in my experience more than 3 working days notice is commonly given for normal school activities, dates to be put in diaries, to allow consent for school trips, food tasting, swimming, collection of monies, vaccinations, sports days, etc.

Not so in this instance.

Understandably some parents and the wider community were shocked at the notion of schools taking, storing and processing their children's biometrics - and at Blacon High School's speedy implementation of the fingerprint biometric system.

This resulted in articles and letters in the local papers with parents contacting political parties for support and accountability.  Parents have taken legal advice, set up a Facebook Group "Refuse to use" and are contacting the wider community to spead awareness and gather support against the biometric system.

Apart from all the privacy and civil liberties issues surrounding children submitting their biometrics for school functions, as this blog has detailed before, the question has to be asked:

Why would a school with 449 pupils (see 6th March  2012 Ofsted Inspection) buy a biometric system in 2012 when come September 2013 all UK schools have to by law, as detailed in the Protection of Freedoms Act 2012, collect one parental signature per child to enable the school to take and process a child's biometrics?

Why is there no mention of the new biometric system on Blacon High School's website or their Data Protection Register entry?  See the Information Commissioner's Office quote about the register "The main purpose of the public register is transparency and openness".

Not only does Blacon High School have to collect one parent's signature in order to collect a child's biometric data but the school has to be seen to make an effort to contact both parents.  In Blacon High School's case 998 parents for the new cashless catering system and the school need to also have in place a duplicate, alternative system for those parents and children who do not consent.

How efficient is that a spend of our UK tax payers monies?  Two systems.  A bad school management decision? Who is accountable?

On a lighter note...

What is betting that Blacon High School give parents more than 3 - 4 working days to give their written consent in order for the school to run their newly purchased biometric system?   If one child's biometric data resides on Blacon High School's biometric system without a signed parental consent form come September 1st 2013, the school will be breaking the law,

I suspect there may be a few eyes watching how Blacon High School complies with the forthcoming enforceable legislation over the coming months.  I think more to come on this.

Parental consent now a legal requirement in UK

In May 2012 the Protection of Freedoms Act was given Royal Assent and passed into law in the UK.  Chapter 2 of the Act, clauses 26-28, deals with consent when processing a child's biometric data:

Chapter 2 Protection of biometric information of children in schools etc.
26. Requirement to notify and obtain consent before processing biometric information
27 Exceptions and further provision about consent and notification
28. Interpretation

The salient points of the Act are: 

• Each parent of the child should be notified by the relevant authority that they are planning to process their child's biometrics and notified that they are able to object.  
• In order for a school to process children's biometrics at least one parent must consent and no parent has withdrawn consent. This needs to be in writing.
• The child can object to the processing of their biometrics regardless of parents consent.
• The child is under 18 years old.

The requirement for parental consent as defined in this Act becomes enforceable In September 2013.

The UK is the first country in the world to address the issues of informing parents and requiring their consent when their children’s biometrics are being taken, stored and processed by a school or any such institution.

Further scrutiny will be needed to see how enforceable this law is and how 'informed' parental consent is.  Informed consent is a complex issue.  If the biometric vendor, as the sole supplier of information via the school to the parent, is the sole source of information that the school gives to the parent, fully informed consent could be questionable.

It is interesting to note that not one academic, educationalist, industry developer have given their support for children using biometrics, in fact many experts have have voiced their concerns.  Only biometric vendors and schools seems to think biometrics use without parental consent with children is acceptable.  I know whose advice I'd take.

It's a good job that if parents Google "Biometrics in Schools" then this blog appears on Google's first results page.  Parents should also check out the Leave them Kids Alone website.

Children's Biometrics in the House of Lords

The Protection of Freedoms Bill had it's second reading in the House of Lords last week and some peers spoke in a positive manner about gaining consent of parents before schools take and process children's biometrics.

Lord Henley -

"it is right that parents should be asked to make an informed decision about whether to accede to the processing of such information. It is also proper that pupils should have a say."

The Lord Bishop of Bristol -

"I back the protection of biometric information on children in schools, with parental consent being required for processing information"

Lord Kennedy of Southwark -

 "Proposals regarding the express parental consent for the use of children's fingerprints are welcome"

The Association of School and College Leaders (ASCL) tweeted that "Pleased to see Lord Lucas supporting ASCL's objections to restricting biometrics in schools in yday's Lord's debate. http://t.co/TlxwoxxR"

As the ASCL rightly state there was one peer, Lord Lucas, who indeed spoke of the section on biometrics in school as a "daffy overreaction".  (daffy?)  Lord Lucas also commented that biometrics in schools...

"...have great benefits. They improve safety. They improve privacy. They greatly improve efficiency."

If biometrics in schools do have such above beneficial effects what has the ASCL or Lord Lucas to be frightened about gaining parental consent.  Surely given the above claims, parents should willingly embrace this technology and thereby give consent.  Schools gain consent for all manner of activities, it is a process they are familiar with.

I would be interested to see validation of Lord Lucas's claims.  Claims that remind me of the previous Labour Government waffle justifying using childrens biometrics in schools for mundane tasks, and of course, claims made by companies selling access, registration and security systems to schools.