Biometric consent for students in Scotland

Under the Protection of Freedom Act 2012 if schools want to use and process a child's biometric data
they must ask for consent from the pupils and parents.  Schools must also offer an alternative option to access systems if consent is not given to process a student's biometrics - such as a pin number or swipe card.

Schools use a student's biometrics to access facilities such as canteen, library, registration, etc, and the biometric of choice seems to favour the fingerprint.

The Protection of Freedom Act 2012, Chapter 2, details how schools must seek consent to hold and process student's biometric data.  However, this consent only applies to children in England and Wales and with Scottish authorities planning to roll out more biometric technology in schools to extend consent for Scottish students, around the use of their biometric data, is absolutely reasonable. 

In order to move towards consent for children in Scotland (and Northern Ireland) Freedom of Information requests have been sent to every local authority in Scotland to determine how prevalent the technology is in schools, whether consent is sought, type of biometrics used and for what purpose.  As it is school holidays, and given that the beginning of term is busy, we expect to this this information back by end October 2018 and then work to get this issue of consent raised in the Scottish Parliament.

Updated Advice for schools on using pupil's Biometrics

Last Month the Department for Education issued an updated advice for schools taking and processing students biometric data.

This useful advice is also a 'must' read for students and parents so they are fully aware of their rights of access to services should they choose NOT to participate in a biometric system.

A recent survey, carried out by DefendDigitalMe, revealed that:

"Over a third (38%) [of parents] of those who said their child’s school uses biometric technology said they were not offered a choice of whether to use this system or not and 50% have not been informed how long the fingerprints or other biometric data are retained for, or when they will be destroyed — despite the Protection of Freedoms Act 2012 requiring parental consent, and an alternative to be on offer, showing that practical guidance is needed to help schools understand how to implement the legislation."

This shows that there is still clearly a lack of understanding by schools of their legislative obligations to parents and students with regards to biometric data storage, processing and their consent.

Please do have a read of the above advice, any of the information here and make an informed choice about your/your children's biometric data.

Schools asking for consent to process children's biometrics

I am getting a lot of emails from concerned parents of children leaving primary school to go to secondary school with the way that the secondary schools are asking for consent to use their child's biometrics - fingerprint, fingertip data - and not offering an alternative method to access the catering, library, registration, etc, system.  In this parents are feeling that their request for consent is coerced.

Schools MUST offer an alternative to biometrics.  The Protection of Freedoms Act 2012, Chapter 2, Section 27 (7) states that: 

The relevant authority must ensure that reasonable alternative means are available by which the child may do, or be subject to, anything which the child would have been able to do, or be subject to, had the child’s biometric information been processed.

Unfortunately some parents have been made to feel from schools that they are being unreasonable in not giving consent and that they are they only one objecting to biometric consent.  You are not a 'problem parent'.  You and your child have a right to not give the school biometric data - data that is absolutely unique, personal, highly precious and that needs to be secure for the child's life time.

Parents feeling isolated by a school is a story I have heard over the past 10 years so many times from so many parents - you are not alone at all.  I myself last year, when my child entered sixth form, was told by the Principal that I was the only parent objecting to them using my child's biometrics - I was not.

Quite often the supplier of the biometric system to the school will also offer alternative means of accessing the system they provide.  Examples are swipe card, PIN number and taking the names of the children at the point of sale at the till, so it shouldn't be an inconvenience for the school to offer alternative means of identification.

The new EU General Data Protection Regulations is law for every member state of the EU, including us.  It came into law 27th April 2016.  Schools are subject to this.

Point 32 states:

Consent should be given by a clear affirmative act establishing a freely given, specific, informed and unambiguous indication of the data subject's agreement to the processing of personal data relating to him or her, such as by a written statement, including by electronic means, or an oral statement.

Point 42 states:

Consent should not be regarded as freely given if the data subject has no genuine or free choice or is unable to refuse or withdraw consent without detriment.

If anyone has any concerns or questions please don't hesitate to get in touch, I'm really happy to help if I can.

Florida moves to ban use of biometrics in schools

New kid on the block - infrared palm scanning

Palm Printing ...

Well, it was going to happen, see link: http://news.scotsman.com/index.cfm?id=1588142006id=1588142006

"Pupils at a Scots primary school have become the first in the world to pay for their lunches by having their palms scanned rather than by handing over cash. Biometric technology which allows them to be identified through their hands' unique vein patterns has been introduced at Todholm Primary in Paisley."

Amey the company behind the palm scanner, have a Private Finance Initiative (PFI) programme in Scotland with Glasgow City Council, the largest education partnership in Europe. Amey worked in conjunction with Yarg Biometrics and Fujitsu to develop this biometric technology.

From Yarg Biometrics homepage : "Unlike fingerprint biometrics it cannot be linked to any criminal records database and civil liberties issues are therefore not affected"
And from the Fujitsu (now on the Wayback Machine here: http://web.archive.org/web/20061103111054/http://www.fel.fujitsu.com/home/v3__press.asp?prid=531) site, near the bottom of the article: "Biometric solutions will increasingly allow us to move towards a cashless society and this project is one of the first real examples in the UK of an innovative and truly practical biometric solution in operation. I fully expect this to be the first of many similar implementations across Europe" said Mike Nelson, General Manager, Fujitsu Europe Limited.

(Fujitsu is also providing a managed service in a fifteen-year contract for a Unity City Academy in East Middlesbrough. The Unity City Academy is a charitable trust. Members of the board of the Trust represent Amey plc, amongst others).