What is the current situation with facial recognition in UK schools?

This situation with facial recognition technology use in UK schools is unknown, as is the case for the amount of schools using pupils biometric fingerprints.  

Using the Freedom of Information Act and catching the media on this as it happens seems to be the only way  to see how this technology is being rolled out, as schools are under no obligation to inform the Information Commissioner's Office (ICO), who oversees the Data Protection Act (DPA) 2018 and the General Data Protection Regulations (GDPR), that they are taking and processing children's biometric data.

As of this week it appears that North Ayrshire Council, Scotland, are in the process of implementing facial recognition in to its 9 high schools and West Lothian Council, also in Scotland, are looking at introducing facial recognition technology in its 11 high schools - a total of approximately 20,000 students.

In England there are:

Kingsmeadow Community Comprehensive School,  Gateshead

Canon Slade CofE School, Bolton

Murray Park Community School, Derby  - Update 20/10/21:  I have been contacted by Realsmart who have stated, "Realsmart do not provide any systems that work with biometrics". I welcome more clarification on this and will post accordingly.

Langley Park School for Girls, Beckenham

...another 5,000 students and I suspect there are quite a few more schools too.

Consent and Legalities

England and Wales - explicit consent from parents must be sought for a school to take and process a child's biometric, which was, up to now, mainly in the form of a fingerprint template, this now however extends to photographs used for a facial recognition system.  This is law and the legislation covering a schools obligation to gain consent is in the Protection of Freedoms Act 2012 (PoFA).

Both parents need to consent and so does the child.  Any child or parent not consenting overrules the consent of a parent that does consent.  An alternative to the biometric system must also be provided and this alternative option should be made aware to the parent/s child - see page 10 of the governments 'Protection of biometric information of children in schools and colleges' advice to schools.

Scotland and Northern Ireland - here the PoFA 2012 does not apply.  Scottish schools have tended to ask for consent in line with the PoFA but recently seem to have taken it upon themselves, from exactly whose advice is unknown at this time, to presume that S1-S3 pupils need parental consent and S4-S6 pupils can consent themselves.  See North Ayrshire's consent forms S1-S3 and S4-S6.  

S4 students are 14/15 years old, under PoFA no student under the age of 18 can consent to their biometrics being processed by schools.

However, this consent process becomes redundant as indications from Europe show that facial recognition in schools is in direct contravention of the EU legislation GDPR.  Rulings against using facial recognition in schools has been acknowledged by our UK ICO in their June 2021 report, page 22, 'The use of live facial recognition technology in public places':

The report went on to state that: "The research found support for the government imposing restrictions on the use of FRT [facial recognition technology] by the police (55%) and in schools (68%). The Ada Lovelace Institute recommends a voluntary pause on the sale of FRT to enable public engagement and consultation to take place." ...in which case why are UK schools spending tax payers money on this legally questionable technology?

The legalities of facial recognition in UK schools is unknown.  We are still subject to the EU GDPR and under that facial recognition use in schools has been in contravention of the strict use of biometrics with minors that the EU Act cites.  

Our ICO appears unable to answer what communications they have had with educational establishments or companies supplying facial recognition to schools.  A recent of Freedom of Information on this was refused on 30th September 2021, citing Section 12, exceeding costs and time - I am hopeful there may be a disclosure of some information though - see here.

See WhatDoTheyKnow for Freedom of Information requests on this topic.

Biometric Consent for Scottish children in schools

The Protection of Freedoms Act 2012,  Chapter 2 Protection of biometric information of children in schools etc. deals with consent required when schools process children's biometric data.  Unfortunately this part of the Act only applies to schools in England and Wales.  A Freedom of Information request sent to the Home Office clarifies this.

In order to help extend this consensual right to children in Scotland and Northern Ireland Freedom of Information requests were sent, in August 2018, to all 32 Local Government authorities in Scotland to ascertain how many schools were using biometric technology. 

Here are the results of the Freedoms of Information Request as of Early 2019:

There are plans in Scotland to introduce a Biometrics Commissioner 2019/2020 whose remit will only cover the justice sector in the country in the collection and processing of biometrics - Police Scotland and the Scottish Police Authority.

With the widening use of biometrics, especially the historic and current use in schools, concerns about the limiting scope of the forthcoming Scottish Biometrics Commissioner's role may be aired in the Scottish Parliament.

Any developments concerning this will be posted here.

Scottish schools Freedom of Information results so far...

This is an update on the Freedom of Information requests (FOIR) sent to all 32 Scottish local authorities in August to determine the use of biometrics in schools there.  This is with a view to extending the same rights that English and Welsh children have not to have their biometrics collected and processed in schools, with an entitlement to use an alternative way of accessing school services such a a PIN or swipe card.

Some interesting results have turned up in the two thirds of FOIRs that have been received back so far.  There seems to be two companies supplying the Scottish market with one most dominant.  The company that is most dominant also introduced the biometric fingerprint scanners in schools as early as 1999 and 2000.

This is a surprise to me as I was under the impression that schools in the UK started the introduction of fingerprint scanners for libraries in 2001when the below communications with a school biometric supplier, the Information Commissioner's Office (ICO), who oversees the Data Protection Act, and Department for Education (DfE) took place.  See bottom of this post.  So it would be interesting to see if the ICO and DfE knew about the earlier use of children using their biometrics and see any correspondence on that.

With the results from the FOIR so far it seems that currently around 5% of children in Scotland use their biometrics to access school systems, although I still have a third of the authorities yet to reply.  Even so this amounts to 35,000 plus children and that is only a snapshot of current usage.  Given that some authorities have been using biometrics in schools for nearly two decades, this significantly raises the amounts of children that have had their biometrics logged at schools in Scotland to the many tens of thousands, if not over the hundred thousand mark.  The current Scottish school population is just over 687,000 children.

When all of the Scottish authorities have responded I will post more here.

Biometric consent for students in Scotland

Under the Protection of Freedom Act 2012 if schools want to use and process a child's biometric data
they must ask for consent from the pupils and parents.  Schools must also offer an alternative option to access systems if consent is not given to process a student's biometrics - such as a pin number or swipe card.

Schools use a student's biometrics to access facilities such as canteen, library, registration, etc, and the biometric of choice seems to favour the fingerprint.

The Protection of Freedom Act 2012, Chapter 2, details how schools must seek consent to hold and process student's biometric data.  However, this consent only applies to children in England and Wales and with Scottish authorities planning to roll out more biometric technology in schools to extend consent for Scottish students, around the use of their biometric data, is absolutely reasonable. 

In order to move towards consent for children in Scotland (and Northern Ireland) Freedom of Information requests have been sent to every local authority in Scotland to determine how prevalent the technology is in schools, whether consent is sought, type of biometrics used and for what purpose.  As it is school holidays, and given that the beginning of term is busy, we expect to this this information back by end October 2018 and then work to get this issue of consent raised in the Scottish Parliament.

Biometrics for school toilets are here!

Even I thought I'd never biometrics in schools used for toilet access...

 "In one secondary school in West Lothian there is a hand pad system in place for primary school pupils housed there temporarily to gain access to toilets."

This link is now archived here:

https://web.archive.org/web/20110728095646/http://news.scotsman.com/scotland/Hundreds-of-school-children-fingerprinted.6672785.jp

Building Schools for the Future bidder builds biometric technology into schools

The Sunday Heralds reports that after the palm vein scanner was trailed in a Scottish primary school last October, Amey who introduced the vein scanner, developed by Yarg Biometrics and Fujutsu, have plans to introduce this in another 11 schools for lunch lines and possible entry into schools:

"The private firm Amey is now presenting biometric systems as part of its pitch for all new school building contracts. The company was keen to assure parents in Renfrewshire, where 11 more schools are set to adopt palm readers, that the technology was safe and data could not be stolen or misused."

Vein scanning is mildly more acceptable than fingerprint scanners, as a vein print cannot be casually left at a location as a fingerprint can and so implicate you at a certain location (other than at a vein scanner). But Amey's claim that the technology is safe and data cannot be misused or stolen is a very grand claim, as these children's biometric data needs to be secure for the rest of their life time - decades... or at the very least for the life time of a child's schooling from 4-18 years old, until 2021.

How can parents, governors and pupils be consulted on this if building these biometric systems into schools are done at local government contract level? And "opt out" alternatives should be provided.

The government (BECTA) guidelines state that, "...schools should normally involve pupils and parents in their decisions to use biometric technologies as is the case with other decisions made during the school life of children ." page 7 of the "BECTA guidance on biometric technologies in schools"

- this Building Schools for the Future(BSF)/Private Finance Initiative (PFI) scenario seems to blatantly override the recent government guidelines here, unless there is a consultation process underway with parents and pupils that hasn't been reported in this case.

If their is no "involvement" with parents and pupils, there is no consequence for the companies/schools installing it. Well, hey ho, that's non legal/statutory guidance for you.

Biometric systems help visibly reduce wrinkle lines and bullying

At Viewlands Primary, Perth, Scotland, a fingerprint scanning system is trialled for school lunches:

...a spokesman for the council insisted fingerprinting youngsters is safe and has helped reduce bullying. - the council spokesperson shows no evidence to back this statement up. In fact there is no evidence whatsoever that proves that using biometric systems in schools reduces bullying.

The spokesman claimed 90 per cent of parents had given permission for their children to take part and it was impossible for the system to be accessed by "unauthorised" users.

"Impossible"?... a fantastical claim to be made in this day and age when peoples identities are being stolen from cash point machines, NHS records stolen - re-surfacing on e-bay and banks not disposing of customers details properly.

Police able to access primary school fingerprint system

The Highland News reports that Drakies Primary School in Inverness, Scotland, has spent £1000 on fingerprint scanners for their school library.

The below comment is, as far as I know, the first mention in the media of police having accessing school fingerprint databases. Police can use children's biometric databases in England and Wales without informing parents. It does state here that the police have to get permission from the school and parents, Scottish law is different to English and Welsh law so this may well be the case in Scotland - but not in England and Wales (see questions 50 and 51).

... a spokeswoman for the National Policing Improvement Agency said: "If the police have reason to suspect a child has committed a crime then as part of their investigation with permission of the school and the parent, the police can request access to the data if they have reason to believe it will help them with their investigation."

There is no relevance to the argument that fingerprints aren't stored - a biometric identifier is stored which carries the exact same implications as if a fingerprint was stored.

Early Day Motion support in Westminster and a Motion in the Scottish Parliament

Early Day Motion 686 has got cross party support regarding concerns about biometric technology, parental consent and unregulated data collection systems.

Signatures:
Conservative Party - 11
Democratic Unionist Party - 1
Independent - 1
Labour Party - 7
Liberal Democrats - 35
Social Democratic and Labour Party - 2

In Scotland the MSP Patrick Harvie has a motion S2M-5567 urging for guidance on biometric technology in schools with 10 signatures.

S2M-5567 Patrick Harvie: Biometric and Surveillance Systems in Schools—That the Parliament notes the recent decision by UK ministers to issue guidance to schools on the use of biometric systems; welcomes the acknowledgement that a completely unregulated approach to such technologies is inappropriate; notes that biometric systems are in place in some Scottish schools; is concerned that the Scottish Executive’s initial description of parental consent as an "essential pre-requisite" before children can be fingerprinted has now been rephrased as merely a matter of "good practice"; considers that there is a need for clear guidance from the Executive on the use of biometric and surveillance systems in schools before any increase in their use is contemplated; notes that section 8 of the Schools (Health Promotion and Nutrition) (Scotland) Bill is expected to lead to increased use of such systems; urges the Executive to produce guidance for education authorities on the implementation of section 8 and, in so doing, to give clear preference to systems other than those involving biometric and data-gathering technology; further notes that recent calls have been made for schools to introduce ID cards, CCTV, airport-style security scanners and random drug testing, and considers that wider debate is required on the role, if any, of such measures, the impact they may have on school culture and the limits within which they should operate.

Concerns over biometrics in Scottish schools

After the installation of a vein palmprint reader for the canteen at a Glasgow primary school this term, the issue of biometrics in schools has again been raised in the Scottish Parliament.

The Scottish Parliament Business Bulletin today lists:

*S2M-5171 Ms Rosemary Byrne: Biometric Scanning of Children—

That the Parliament condemns the decision of Renfrewshire Council to install a biometric scanner system in Todholm Primary School in Paisley; believes that this is an unnecessary intrusion into the private lives of children and their families; condemns the Scottish Executive for allowing this system to be installed without a debate in the Parliament to discuss the implications of such a measure and its apparent inability to answer parliamentary questions on the matter, including questions on what company is supplying the system, the cost of the system, who is paying for the system, who stores the personal data collected, what safeguards are in place with regard to the storage of the data and whether parents had an opt-out of the system; believes that the introduction of such a system may be in breach of the Convention on the Rights of the Child, and calls on the Executive to initiate a full debate in the Parliament as a matter of urgency on the issue. [my emphasis]

"what company is supplying the system"
The company supplying the system is Yarg Biometrics who have worked in conjunction with Fujitsu to develop this vein reading technology.

"cost of the system"
The cost of the system is unknown but I suspect it is not as cheap as a cash till or the system previously operated.

"who is paying for the system"
Amey have a Private Finance Initiative, PFI, programme in Scotland with Glasgow City Council - the largest education partnership in Europe. The Private Finance Initiative is paid for by us - the taxpayer. Amey were responsible for bringing the palm print vein scanner to the Todholm Primary in Paisley.

"who stores the personal data collected"
Unknown - probably the school but who else has access to it - ?
Presumably reports will be generated by the data stored against each child and those reports will probably be analysed by the LEA and Amey.

"parental opt out option"
Shouldn't it be an "opt in option" i.e. discussion first, purchase/commission technology later?

Scottish Council halts fingerprinting in schools

Whilst Dundee City Council (Scotland) have given assurance that the controversial fingerprinting of children is no longer being carried out in schools under their jurisdiction, neighbouring Stirling Council quotes "The Scottish Executive are committed to introducing cashless catering systems in all schools by 2007"

The Green Party in Scotland believe children should be taught the importance of civil liberties and have led a campaign in the Scottish Parliament on the use of biometric data with children.

Patrick Harvie, Green MSP for Glasgow says "children should be taught in an environment which respects their autonomy and privacy and, indeed, encourages them to hold their civil liberties in high regard".

It is clear that biometrics for children our schools are causing very differing views on whether it should be implemented. If this technology is needed in schools, clear guidelines are needed. In the meantime, without regulation, it is an open door to biometric companies in our educational “market”, especially with the Building Schools for the Future (BSF) programme getting into full swing over the next few years.

Our UK Data Protection Acts states:

The Data Protection Priciples, Part I, The Principles
3. Personal data shall be adequate, relevant and not excessive in relation to the purpose or purposes for which they are processed.

Children who’s biometric information is held on school databases is often held alongside their photograph, address, gender and ethnicity, to log meals eaten, books read, time in and out of classes – is this “excessive in relation to the purpose or purposes for which they are processed” ? – I would suggest so.

New kid on the block - infrared palm scanning

Palm Printing ...

Well, it was going to happen, see link: http://news.scotsman.com/index.cfm?id=1588142006id=1588142006

"Pupils at a Scots primary school have become the first in the world to pay for their lunches by having their palms scanned rather than by handing over cash. Biometric technology which allows them to be identified through their hands' unique vein patterns has been introduced at Todholm Primary in Paisley."

Amey the company behind the palm scanner, have a Private Finance Initiative (PFI) programme in Scotland with Glasgow City Council, the largest education partnership in Europe. Amey worked in conjunction with Yarg Biometrics and Fujitsu to develop this biometric technology.

From Yarg Biometrics homepage : "Unlike fingerprint biometrics it cannot be linked to any criminal records database and civil liberties issues are therefore not affected"
And from the Fujitsu (now on the Wayback Machine here: http://web.archive.org/web/20061103111054/http://www.fel.fujitsu.com/home/v3__press.asp?prid=531) site, near the bottom of the article: "Biometric solutions will increasingly allow us to move towards a cashless society and this project is one of the first real examples in the UK of an innovative and truly practical biometric solution in operation. I fully expect this to be the first of many similar implementations across Europe" said Mike Nelson, General Manager, Fujitsu Europe Limited.

(Fujitsu is also providing a managed service in a fifteen-year contract for a Unity City Academy in East Middlesbrough. The Unity City Academy is a charitable trust. Members of the board of the Trust represent Amey plc, amongst others).