Professor Fraser Sampson

Commissioner for the Retention and Use of Biometric Material and Surveillance Camera Commissioner

My statutory functions as Biometrics and Surveillance Camera Commissioner were introduced by the Protection of Freedoms Act 2012 primarily to cover the use of biometric surveillance by policing and law enforcement. Biometric capabilities that were available only to state intelligence agencies at the time of enactment are now readily available on the open market. In this context the expansion of newly intrusive technologies since the Act was passed now raises daily questions even when being legitimately used to protect national security and prevent serious harm.

Adoption of those technologies in our schools is certainly no less contentious than it is in law enforcement and in some ways it is more challenging. For example, using technology to predict criminality has been controversial; using it to predict academic results fairly and accurately has proved highly sensitive and hotly disputed.

As the legislation reaches its 10th anniversary several clear trends can be seen. Video analytics have revolutionised surveillance which is no longer about where you put your camera but the purposes to which you're going to put the billions of available images and sounds captured on everybody's camera. Inferential algorithms that purport to identify alertness, emotions and even sincerity are gaining credibility while what to do with facial recognition is the surveillance question that refuses to pass unnoticed.

Biometric surveillance continues to be a fast-moving discipline offering the potential for emancipation and subjugation. In the context of my specific statutory functions, I approach its many facets from three perspectives: the technologically possible (what can be done), the legally permissible (what must/must not be done) and the societally acceptable (what we support being done). While the first two grab the headlines or drive policies, it is in the third area – what people are willing to support or even tolerate – where I believe the future of biometrics is being shaped globally.

Against that backdrop I would offer the following thoughts when considering any proposal for, or discussion of biometric technologies in schools.

1. Who's benefiting? Ask to what extent the best interests of the child are a primary consideration? This is the fundamental requirement in the UN Convention on the Rights of the Child. Parental preference, administrative convenience, cost reduction are all valid considerations, but Art 3 says that the best interests of the child shall “in all actions concerning children, whether undertaken by public or private social welfare institutions, courts of law, administrative authorities or legislative bodies, be a primary consideration”. It is surprising how often this is overlooked.
2. Who's watching? Somewhat ironically, biometric surveillance requires constant vigilance. To ensure its proper governance, avoid mission creep and irreversible erosion of freedoms this area calls for careful recognition – and anyone who believes it is simply about data protection hasn't been paying attention.
3. Whose company are you keeping? Accountable surveillance requires trusted partnership with trusted partners. Some surveillance companies have been clearly associated with human rights abuses of children, depriving them of fundamental rights to education, freedom from economic exploitation, assembly and even family life. Decisions to enter into commercial partnership with such companies therefore have significant due diligence considerations that extend far beyond ‘bottom line' issues of cost.
4. Where's the push? Technological development is often characterised as some inexorable and naturally occurring journey, but this is really invention masquerading as evolution. Biometric technology is creationism, pure and simple, and has the DNA of the designer all over it. The proper role for innovative surveillance technology is an important question but it is not a predetermined path.
5. Why the rush? Our enthusiastic adoption of biometric technology needs to balance material risk with measurable benefits, which presupposes we have identified both. Although there are some areas in policing where the adage may not always hold true, the saying “just because you can doesn't mean you should” is still a handy test to apply when balancing the possible with the permissible and the acceptable. Some – including, surprisingly, the Department for Education – appear to have taken the view that bare compliance with Chapter 2 of the Act is all that is required to ensure the lawful, ethical and accountable use of biometric surveillance in schools.

While Chapter 2 addresses one narrow legal issue (that of protecting biometric information of children in schools) and guidance on its practical implementation is vital, I do not believe that this excludes the need to address the many wider technological, legal and societal issues of biometric surveillance generally. If biometric surveillance is to have a legitimate role in places of education, both role and legitimacy will need a much broader approach than this.

I am grateful to have been asked to provide this Foreword and applaud the approach exemplified by Defenddigitalme. As biometric capabilities find their way into every aspect of our lives, keeping focused on a rights-respecting environment, built upon principles of pluralism, universality and ethics will become more important than perhaps even the architects of the Protection of Freedoms Act imagined.

Executive summary

Ten years on, the UK Protection of Freedoms Act 2012 and current UK Data Protection law are not enough to protect children's rights in educational settings. Emerging technology and scope creep have advanced since those laws were written, particularly around the use cases in education that sit outside the narrow definition of biometrics for ID purposes.

The EU AI Act includes as high risk, biometrics, and AI systems intended to be used in ways that have significant impact on children’s personal development, including personalised education or cognitive or emotional development. Will the UK law protect children less?

Recommendations

The ICO should find biometric data processing in educational settings in the UK incompatible with the increased protections in the GDPR and modernised Convention 108 for biometric data and for children. This decision should uphold the principles of necessity and proportionality. It should recognise the failure of consent in educational settings due to the power imbalance between individual and authority. This aligns with court and data protection authorities’ decisions in Sweden, France, and Poland since 2019.

All processing of biometric data from children for the purposes of building access, canteen, and library uses in educational settings should end, including fingerprints, and be replaced by using the current non-biometric solutions that must be offered already in parallel, under the Protection of Freedoms Act 2012. The ICO response must be “effective, proportionate and dissuasive” to end all routine use of biometrics through enforcement after a suitable notice period, due to the failures to comply with the principles of the GDPR, the Convention 108, and UK Data Protection Act 2018.

Legislation should expand i.e. to a UK Education and Digital Rights Act, or in the UK Data Protection Act, to protect children at scale from overreach in this sector that do not use bodily data for the unique purposes of identification defined as "biometrics" but use emerging technologies for purposes such as emotion and attentiveness detection, psychometric analytics, gait analysis, or mental health and well being ‘prediction’.

Data processing behind the cashless payment systems should be investigated for routine profiling of children’s library reading and canteen purchasing habits, in particular those from which the companies or staff, may be able to make inferences about sexual orientation or religion. (i.e. LGBT books and kosher or halal food.)

The Surveillance Camera Commissioner role should incorporate education where biometrics and surveillance camera systems are utilised under Section 29(6) of the Protection of Freedoms Act 2012. (While noting that the Act does not apply in Scotland and Northern Ireland, and the current DCMS proposals to reform the role.)

Background Introduction

Biometric technology in UK schools was first introduced around 2000. The first documented evidence of the technology’s use comes from the Information Commissioner’s Office in a communication in July 2001 to a company, Microlibrarian Systems, for use in primary school libraries:

“It is understandable that concerns will be raised over the use of such technology if it is believed that it involves the holding of a database of pupils’ fingerprints. However, from what I have understood of our discussions, although theoretically possible to use the information obtained from this system to match fingerprints taken from a scene of a crime, the resources this would require make this highly impractical. In light of this I do not believe that the use of Idenitkit fingerprint technology to identify library members raises any data protection concerns.”

Letter to MicroLibrarians from Robert Mechan, Senior Case Officer, ICO, 4th July 2001.

From then to 2013 schools used a variety of biometrics, often without informing parents. If parents were informed, an ‘opt out’ rather than an ‘opt in’ was applied. Biometric technology, at that time, was not in the consumer or commercial marketplace, only used on a daily basis by students in UK schools. Whilst the UK was using biometrics on a regular daily basis in schools, the rest of the world was not routinely using the technology in educational settings. As far as is known the only other country to use biometrics in schools was the USA and their use, which was the fingerprint, wasn't until around 2006.

In 2006 already Wendy Grossman had summed up risks, “Why does it all matter? Because a password is something you have; a fingerprint is something you are. A password can be reset, reissued, forgotten, copied, written down, or changed. A fingerprint is for life. Like the ID card, as biometric systems pervade society they will be used to secure data of a serious nature. Identity theft will become far more dangerous.”

Numerous biometric systems have been ‘trialled’ in UK schools since 2000, including iris scanning in 2002, infrared palm scanning in 2006 and facial recognition in 2010¹. For cashless catering, library, registration, door access, photocopying, locker access, cashless monetary payments, vending machines and laptop access, the biometric of choice is the fingerprint which has firmly gotten hold of the UK education market.

The Association of School and College Leaders (ASCL) estimated that about 30% of secondaries in England were using fingerprint data in 2011². Other biometric technologies were abandoned within a year of their use, seemingly not deemed fit for purpose, until the recent reintroduction of facial recognition in 2020 for cashless catering.

By 2017, concerns with the biometric systems were summarised by researchers, in four areas: Pupil resistance, Pupil mistrust, Hygiene, and Parental surveillance. Researchers Leaton Gray and Phippen found that, “pupils were not inducted into biometric systems in the same way that they had been in 2006 when such systems were relatively novel. There were no talks on the purpose of the system and related data privacy issues (indeed we found that data privacy was not mentioned at all other than in the context of e-Safety.)”

And while we agree with the assumption that school staff intentions where these technology are employed are benign, we also support their finding that there was no reflection on the potential future impacts,

“staff and pupils are persuaded by the convenience of such systems to a point that they do not reflect on the potential social harms, or related legal issues. Schools did not have effective data protection policy or practice in place to be able to manage data such as biometrics effectively and in a legally compliant manner.” “Biometrics may be a great time-saver in the short term, [although unproven] but when it comes with the risk of serious long-term consequences for our students, is it worth it?”

In the 2019 ruling by the French Data Protection Authority, the CNIL also reflected on the wider chilling effect of facial recognition through ‘reinforced surveillance’ as contributing to its intrusiveness.³

Using biometric technology in schools opens up the debate on the necessary and proportionate use of high-risk technology in education when another form of identification, PIN or swipe card, would be enough for low-risk applications such as cashless payments or library card systems.

Where fingerprint readers are used, schools must offer alternatives such as a touch card, or simply giving their name at the canteen till or to the librarian. For pupils who choose to use the software provided by a leading UK supplier CRB Cunninghams (Constellation Inc.), there are four recognition methods to choose from within their Fusion cashless system: fingerprints, QR codes, contactless cards, and PINs⁴. Therefore the high bar of necessity for biometrics is already proven not to be met.

Although this provider claimed⁵ that around 70 schools had either ordered facial recognition systems, or were currently using it in October 2021, more may have started using similar systems from different providers that have not yet been identified in our sample via FOI. We are now starting to see new products emerging in the classroom, beyond canteens and libraries, that challenge the definition of biometrics and are more intrusive than ever on human dignity and affect children's behaviour.

This summary brings us to 2022, ten years after the introduction of the Protection of Freedoms Act 2012.

Chapter 1: The Protection of Freedoms Act 2012

The Protection of Freedoms Act 2012

In May 2012, after seven years of campaigning by parents⁶ and privacy groups, the Protection of Freedoms Act was passed. Chapter 2 deals with processing children's biometric data in schools in England and Wales and requires consent for educational establishments to process pupils’ biometrics. This does not apply to schools in Scotland or Northern Ireland.

The key points of the Act are:

• Each parent of the child should be notified by the relevant authority that they are planning to process their child's biometrics and be informed that they are able to object.
• In order for a school to process children's biometrics at least one parent must consent and no parent has withdrawn consent. This must be in writing.
• The child can object to the processing of their biometrics regardless of parental consent. Objection by a parent or the child invalidates consent from the other.
• Schools are also required by the law to offer an alternative solution to using a child's biometric and without detriment.

Prior to May 2012 other UK laws helped clarify processing of children's biometric data, without parental consent, such as the Data Protection Act, Human Rights Act, Education Act, Freedom of Information Act, the Children Act, and Gillick Competence. The duties of schools in the Protection of Freedoms Act 2012, set out in Department for Education guidance, came into effect from September 1, 2013. Since then the way that schools have asked for consent or not, and offered an alternative or not, has varied across educational settings. No government department or other bodies monitor whether schools adhere to the Protection of Freedoms Act instructions in Chapter 2, how many schools use biometric technology, how many pupils have their biometrics stored on school or supplier databases, or what schools activities that biometric data is used for. The BSI standard PAS 92:2011 referenced in the DfE 2018 guidance for schools has been withdrawn.⁷

In 2018, on our behalf, Survation polled 1,004 parents of children in state schools about their experience of technology in schools. 38% of parents whose children were using biometrics in school, said they had not been offered any choice, and over 50% had not been informed how long the fingerprints or other biometric data is retained for, or when they will be destroyed.

In 2022 we also asked ten unions across the UK with members in teaching and education, but none said they have any Code of Practice on this to assist staff about their own use and rights, or for pupils.

Chapter 2: Defining biometric data

What is biometric data?

Biometric data is defined in legislation. To sum up, biometric data is information gathered about a person's physical or behavioural traits that may be used to identify a living person, on its own, or when combined with other personal data of which the data processor is likely to come into possession.

As sensitive data, its processing for "uniquely identifying a natural person" is prohibited in UK data protection law based upon the GDPR with exceptions, one of which is consent expressly given in advance. The UK decision to leave the EU does not affect this, although at the time of writing the UK government has signalled its intention to reform the UK Data Protection Act, “to create an ambitious, pro-growth and innovation-friendly data protection regime.”⁸

The UK GDPR defines biometric data in Article 4(14):

“‘biometric data’ means personal data resulting from specific technical processing relating to the physical, physiological or behavioural characteristics of a natural person, which allow or confirm the unique identification of that natural person, such as facial images or dactyloscopic data”.

Convention 108+

Article 6 of the modernised Convention 108+ states that biometric data uniquely identifying a person shall only be allowed where appropriate safeguards are enshrined in law. It sets out that safeguards shall guard against the risks that the processing of sensitive data may present for the interests, rights and fundamental freedoms of the data subject, notably a risk of discrimination.The Explanatory Report⁹ further notes that biometric data is sensitive data, “Processing of biometric data, that is data resulting from a specific technical processing of data concerning the physical, biological or physiological characteristics of an individual which allows the unique identification or authentication of the individual, is also considered sensitive when it is precisely used to uniquely identify the data subject.”

Protection of Freedoms Act 2012 (for schools in England and Wales) Chapter 2 s.28

(2) “Biometric information” means information about a person’s physical or behavioural characteristics or features which—

1. is capable of being used in order to establish or verify the identity of the person, and
2. is obtained or recorded with the intention that it be used for the purposes of a biometric recognition system.

(3) Biometric information may, in particular, include—

1. information about the skin pattern and other physical characteristics or features of a person’s fingers or palms,
2. information about the features of an iris or any other part of the eye, and
3. information about a person’s voice or handwriting.

(4) In subsection (2) “biometric recognition system” means a system which, by means of equipment operating automatically—

1. obtains or records information about a person’s physical or behavioural characteristics or features, and
2. compares the information with stored information that has previously been so obtained or recorded, or otherwise processes the information, for the purpose of establishing or verifying the identity of the person, or otherwise determining whether the person is recognised by the system.

A problem with the definition of biometric data?

We are at grave risk in the digital environment of using data rights as a proxy for the entirety of human rights when it comes to challenging infringements of rights in the digital environment. Data laws can find unethical practice compatible with data processing law. The Danish DPA (Datatilsynet) conducted an audit of the IT University of Copenhagen (ITU) and their use of an online proctoring service for one of their online exams, and found it in line with the GDPR and national legislation.

This is inadequate to protect children from the intrusiveness of technology irrespective of its use for the purposes of their identification, if the classroom teacher already knows who is who it is personal data, and nonetheless in practice the products can have chilling effects on participation, speaking up, influence behaviours, demanding able and competent norms of bodily control that not every child may have.

Perhaps the question should not be whether a tool is ‘legal enough’ to use in educational settings, but whether it is respectful of human dignity and the aims of education, meeting the full range of human rights; freedom of expression, freedom of thought, and aims of the right to education. The starting point must be necessity and proportionality whether a tool using biometrics can be lawfully used at all, and only then seek a basis for how the data processing requirements should be met.

Enabling access

Further research is needed into positive exceptions in the use of biometric technology in educational settings for accessibility needs (e.g. eye controls of systems for children with disabilities). We are also continuing to research to assess the discriminatory effect on take up for children eligible for Free School Meals. To date the number of children not using biometrics where it has been introduced is too small to be indicative.

Emerging Technologies

Recent developments in the educational sectors use of biometric technology

The urgent need for better protections for children and young people is heightened by the rapid adoption of facial detection coupled with age verification now growing beyond school canteen tills to supermarket tills. But the Westminster government’s policy direction is not towards an increase but a reduction in the safeguards on human rights, as outlined in the DCMS consultation on changes to the UK Data Protection regime,Data: A new direction.¹⁰

Facial recognition

Despite being found unlawful and since removed from schools in France, Sweden and parts of the U.S., facial recognition is growing across UK schools. There is widespread recognition of research evidence that facial detection, facial recognition and biometric systems are discriminatory. In 2019, researchers for the U.S Department of Commerce National Institute of Standards and Technology (NIST) found, “elevated false positives in the elderly and in children; the effects were larger in the oldest adults and youngest children, and smallest in middle aged adults.”

“children… are disadvantaged …by being excluded by policy, or by encountering higher false negatives. Age itself is a demographic factor as accuracy in the elderly and the young differ for face recognition (usually) and also for fingerprint authentication. This applies even without significant time lapse between two photographs.”¹¹

On gender and race they concluded that Buolamwini and Gebru’s 2018 research found some facial analysis algorithms misclassified Black women nearly 35 percent of the time, while nearly always getting it right for white men.

Facial recognition in England

In September 2020 facial recognition was introduced into a secondary school Kingsmeadow Community School in Gateshead, England to use at the point of sale in their canteen. The supplier claims it was one of the first. It was “part of a pilot scheme and “no funds were spent on the system,” according to the school.¹² The take up for the system was 904 students out of 909. Since then, the same system supplier has stated that they supply over 70 schools with this technology.

Facial recognition in North Ayrshire, Scotland

In October 2021 the ICO intervened in a mass roll out to nine schools—over 8,000 pupils¹³—of this type of biometric technology in North Ayrshire, Scotland¹⁴, where the system was put on hold pending a decision of its use under current legislation. We do not know how many other schools continue using their technology elsewhere.

An ICO spokesperson said in May 2022:

“Organisations using facial recognition technology (“FRT”) must comply with data protection law before, during and after its use. In addition, data protection law provides extra protections for children, and organisations need to carefully consider the necessity and proportionality of collecting biometric data before they do so. Organisations should consider using a different approach if the same goal can be achieved in a less intrusive manner.

“We understand that North Ayrshire Council decided to pause using FRT in schools following our initial enquiries. Our aim is to ensure that children’s data is protected in line with the law and we will continue engaging with the Council on this issue.

“Anyone who feels that their personal data has been processed in a manner that is unlawful can raise a complaint directly with the ICO.”

The ICO guidance on the use of FRT and surveillance is found at: https://ico.org.uk/for-organisations/guide-to-data-protection/key-dp-themes/guidance-on-video-surveillance/additional-considerations-for-technologies-other-than-cctv/#frt

There are over 22,000 schools in the state sector. Without dissuasive enforcement action poor practice will not change. Solving the lack of oversight for educational settings is unlikely to improve without dedicated oversight. DCMS and Home Office propose moving the role of the Biometrics Commissioner under the ICO. The Commissioner’s response¹⁵ in 2021 set out why this would be a backwards step.

Facial recognition Case Study: Stonyhurst College l Suprema

Suprema marketing uses Stonyhurst College as an example of where “staff can now freely come and go through more than 50 doors using convenient Mobile Access and Facial Recognition.” But while they claim that the app and FaceStation F2 biometric terminals eliminate the need for cards¹⁶ entirely, we wonder what alternative they are using, since one must be offered by law, and without detriment.

Behavioural sensing and monitoring attentiveness

More emerging technology in schools uses children’s bodily data but may not be obviously thought of by schools as biometrics in the way that fingerprints or facial recognition is today. Cameras that monitor pupils' engagement in real time during lessons are being used or trialled in some schools and claim to enable teachers and management to see pupil engagement.

ViewSonic Corp., ‘a leading global provider of visual solutions’, published its partnership with Intel and the Smestow Academy in Wolverhampton in March 2022. It claims it is the first school in the UK to deploy the AI-powered myViewBoard Sens analysis tool in the classroom that can infer and present a variety of data from the ViewBoard, which sits at the front of a classroom, and includes mood and attentiveness, and “indicate the factors that may affect students' focus.”¹⁷

Fig.1 Snapshot of “mood” and behavioural monitoring demonstrated by myViewBoard Sens at the Bett Show 2022

Facial detection and emotional recognition: e-Proctoring

Remote exam invigilation technology is out of scope for the purposes of this report, and or research, however emerging technology is growing more widespread and we are already behind in the protection of users from its overly intrusive effects. Essentially, they use the exam candidate’s device camera to monitor the candidates' eye and bodily movements and expressions, the system may assess keystrokes for anomalies, and tabs that are open on the electronic device—all to determine “suspicious’ behaviour.” Those who move their eyes away too much, have the wrong facial expressions or move their bodies in ways that trigger a flag, may then be penalised. While companies argue that they do not use facial recognition or “biometric analysis”, such tools clearly use bodily data such as face detection and gaze detection, and a person may do the ID verification through the tool. The definition here is moot.

University of London moved away from Proctortrack after a change.org petition by students.

Separately, concerns about data security were realised in 2020 when ProctorU confirmed a data breach after a database leaked online.¹⁸

Students around the world united in protests against e-proctoring, agree that data protection laws are not enough to prevent discrimination and protect learners’ human dignity.

The BMA has called for a review into the handling of online exams following reports of students being denied toilet breaks and tests being abruptly terminated (Tonkin, 2021).

Voice data: Case study | Cameras outside and in | Onvu Lessonvu

We first cited this example in our State of Data 2020 report. The university technical college in Birmingham was the first school in the country to install always-on, 360-degree cameras in all of its 28 classrooms. Aston University Engineering Academy, which caters to just over 600 fourteen to nineteen year-olds, officially launched the equipment at an event at the UTC. ONVU’s Lessonvu is described as a “non-intrusive classroom video lesson observation system that is controlled by teachers. Its unique technology allows for the complete recording of 360-degree video and audio, giving a comprehensive view of the entire lesson.”

Lessons are captured using a high definition 360-degree fisheye camera and via high definition microphone. The recording is then converted using ONVU’s proprietary software into a more traditional view. By default all recorded material is stored locally on the school’s network, and schools can opt to store video clips to the cloud if required while controlling permissions.

Lessonvu’s FAQ states, “Most schools will already have parental approval to photograph students but a school should review its policy on video use. Approval from parents may be required.” In our opinion, this is must, not may, and because this processing may be of biometric data, the law requires a different approach from static photographs. As such processing this personal data from anyone,—children, staff and visitors on film and including their voice data—falls under not only data protection and privacy laws, but the Protection of Freedoms Act 21012 and Chapter 2(26) ‘the requirement to notify and obtain consent before processing biometric information’. That requires active, explicit consent and if either the child or either parent objects, processing must not go ahead. But consent may be irrelevant since other schools perform the public task of teacher improvement without using always-on cameras, therefore this fails to meet a high bar for sensitive data under the necessity test.

Furthermore, personal data that is processed must be adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (data minimisation) whereas these cameras can be on all the time so collect excessive data. It follows from recital 39 that personal data from children may only be processed if the purpose of the processing cannot be achieved in a satisfactory manner using other methods.

“360-degree HD cameras (with studio mics) mean that your teachers will never miss anything. Our cameras are designed to be discreet and always on.”

(Onvu, 2022)¹⁹

Chapter 3: England

Most of the UK’s schools are in England. There are 24,413 schools in England – including 388 nurseries, 16,791 primary schools, 3,458 secondary schools, 2,366 independent schools, 1,005 special schools, 57 non-maintained special schools and 348 pupil referral units (PRUs) (BESA, 2022). The questions asked via FOI to state schools in England was in-effect a pilot of the questions in a small subset of schools which we hope to continue to research. We are still in the process of asking those that did not respond to comply with their FOI obligations and provide answers, to get a more complete picture.

An authoritative estimation would require a larger and more comprehensive research project and complete dataset. However, the data provided points to significant adoption of fingerprint readers in secondary schools and very high uptake where they are in schools.

Data sources

To get this snapshot of the adoption of biometric technology in schools we considered a selection of schools across England: a mix of rural, urban, from the north to the south of England. From the schools that provided data, we analysed the percentage of schools using biometrics technology, and from those, we looked at how many pupils were in each school to get an impression of take-up rate. We asked 144 individual secondary schools plus 12 of the largest Multi Academy Trusts -- a total of 374 schools during 2021 and 2022. Response rates were 41% from individual schools and 50% from the Multi Academy Trusts, but some answered only in part with sufficient comparable data from only four MATs. 

Within the figures are some small sixth form registration biometric systems which have 100% usage whilst the rest of the schools’ age groups do not use it. Some schools indicated they used biometric systems but did not tell us how many pupils were using it, some schools said they had a higher number of people using the biometric system than students on school roll as they included staff. However, these figures were so small they were not significant.

Key findings

• From a sample of 142 secondary schools in England using fingerprint readers in school, with 136,293 total pupils on roll, 117,122 pupils use them (85% of all on roll). 
• Despite the Protection of Freedoms Act 2012 obligations on parental / child consent, some educational settings continue to make biometrics use obligatory for all.²⁰
• Others appear to discriminate against children in receipt of Free School Meals by making it seem obligatory for pupils who qualify for FSM to be signed up to the biometric system in order to continue to receive their lunch, while others can choose not to use it.²¹
• Others describe nothing on rights but make the burden on the school seem overwhelming to dissuade opt out despite the legal obligation to offer parallel systems if the school chooses to use biometrics at all. If a school wants to have only one system, the answer should instead be to choose the least intrusive tool for children to use. “Administration of additional systems could create an unnecessary administrative burden and incur additional costs to the School from funds which could be used more effectively elsewhere towards providing your child’s education.”

The state of adoption in England

This is information from 374 schools, including nursery, primary, secondary and sixth forms via Freedom of Information requests. None of the MATS that responded had primary schools that use biometric technology. The biometric technology in use is fingerprint based, being used predominantly for canteen use, with a small amount of library, door access, general payment and photocopier access. No schools that responded said they use facial recognition.

From 374 nursery, primary, secondary and sixth forms, a total of 216,296 pupils, 142 schools (38%), 118,445 pupils, were using biometric technology (54%).

If the nursery/primary schools figures are removed, and look only at secondary schools and sixth forms (11+), from a total of 189 secondary settings (188,748 pupils) 142 secondary schools responded stating they use biometric technology (75%).

Take up within the 142 secondary schools using biometric technology is 85%. The total pupils on roll in the 142 secondary schools is 136,293 students, of which 117,122 pupils use the biometric system.

Chapter 4: Scotland

The state of adoption in Scotland

Scotland has 32 local authorities. From Freedom of Information requests in 2018 and 2021 - fifteen of the LA schools were using biometric technology, fourteen of those LAs are supplied by CRB Cunninghams and one by Civica. Seventeen LA schools are not using biometric technology. The biometric technology used in Scotlan’s schools is fingerprints The biometric systems procurement is at LA level, rather than by individual schools which is different compared with the rest of the UK. Biometric systems in Scottish schools are used for canteen purchases and have been used in Scottish schools since 2000.

Total pupils on roll in the 15 LA secondary schools using biometric systems are 49,700 with 41,000 pupils using the biometric system. In those secondary schools that are using biometric technology the take up within those schools is 83%, near to the 85% the take up as schools in England.

Recent developments

Biometric facial recognition technology was briefly introduced in North Ayrshire Local Authority secondary schools with West Lothian Local Authority planning to use the same FR system for canteen point of sale transactions. North Ayrshire schools, approx 8,000 secondary pupils, started using facial recognition in October 2021 for around a week, then suspended the system due to adverse public relations and intervention from the Information Commissioner’s Office. To date the ICO has not ruled whether or not the facial recognition technology use is lawful under GDPR and DPA2018. North Ayrshire put its rollout on pause, on October 22nd, 2021. At the time of writing there has been no decision taken yet by the ICO.

West Lothian Council have also put their project on hold²². The council had, “begun to consider cashless catering in secondary schools using facial recognition, but this has not been progressed.”

Data sources

Figures are taken from Freedom of Information requests made in 2018 and 2021 to all Scottish Local Authorities. The Freedom of Information response rate was over 95%.

Chapter 5: Wales

Data sources

These schools were asked about adoption in 2018, and the response rate was 50%. We are pending responses from 2021-22 and will update this information in the published report online, once available.

There are 1,553 schools in Wales – including 9 nursery schools, 1,219 primary schools, 23 middle schools, 182 secondary schools, 80 independent schools and 40 special schools. (BESA, 2022)

The State of adoption in Wales

In 2008 Caldicott Comprehensive School in Newport, Wales, saw one of the first protests from parents about fingerprint systems, who had not been consulted about its rollout.

In 2018 we made 24 FOI requests to secondary schools in Wales and we found that those that responded used fingerprints for canteen services. The 12 responses indicated that 7 schools used biometrics and 5 did not.

Non-statutory guidance for schools was last updated in Wales in 2021²³. There are no circumstances in which a school or college can lawfully process a learner’s biometric data, without having notified each parent of a child and received the necessary consent.

Since May 2014, the Welsh Ministers must, when exercising any of their functions, have due regard to the requirements of the UNCRC. Under the UNCRC Article 16: “No child shall be subjected to arbitrary or unlawful interference with his or her privacy.” As per Article 16(2), “The child has the right to the protection of the law against such interference.”

We believe that facial recognition for the purpose of payment is in violation of the Human Rights Act 1998, where the law states that the privacy invasion must be proportionate to the threat, and a potential infringement of rights under the UNCRC and the ECHR.Furthermore, the UNCRC Committee on the Rights of the Child General comment No.16 (2013) para B(1)(27) says that States should not invest public finances and other resources in business activities that violate children’s rights. In order to meet this standard, we suggest that a human rights impact assessment is required.

Chapter 6: N. Ireland

The state of adoption in Northern Ireland

There are 1,123 schools in Northern Ireland, including 94 nursery schools, 784 primary schools, 192 secondary schools, 39 special schools and 14 independent schools. (BESA, 2022)

FOIRs were sent to 26 secondary schools in 2022 and data was received from 6 schools. 4 schools were not using biometric technology and 2 schools were. From the data received, the total roll of pupils from the 6 schools is 4,905. The two schools are using fingerprint biometrics for canteen services with a total on roll 1,333 pupils, of whom 1,323 were pupils using biometrics. Take up rate in schools based on these figures is over 99%.

 Because of the limited nature of the data from these recent requests we will look back at previous requests to the same schools in 2018. Requests were sent to the same schools in 2018 where the response rate was higher, revealing very different data from 2022 replies. From 14 responses (48% FOIR response rate) 8 schools were using biometrics and 6 were not. All use was fingerprint for canteen use. Based on those response figures from 2018 it showed that 58% of secondary schools were using biometric systems, with a near 100% take up within those schools.

Data sources

Figures are taken from Freedom of Information requests sent in 2022 and 2018.

Chapter 7: Company data

Whose company are you keeping? asked Fraser Sampson in the foreword. Our research from a total of 550 schools covering a quarter of a million pupils, sets out some of the commercial background of biometrics in schools.

Twenty years ago, in the early days of companies commonly supplying biometric systems to schools there were 14 names, largely independent UK companies. However, the biometric supply market to schools, still with some of the same names, has changed considerably since then. Larger multinational companies have bought out smaller entities and significant UK school biometric providers are now also owned in the US, Canada, and Israel.

Suppliers in the market currently

Fig. 2 Supplier information to England, Wales and Northern Ireland from the individual schools and MATs that replied to FOI and confirmed they are using fingerprint technology. ‘Other’ include Vericool, Spie, Sharp and Infineer. ‘Paysystems’ includes ParentPay and WisePay and suggests a poor understanding of schools between suppliers that provide only cashless payment systems and / or the linked biometric technology.

Fig. 3 Data for Scottish suppliers of the market. Data by Local Authority. Fourteen out of fifteen Local Authorities in Scotland (all LAs using biometrics out of the total 32) are supplied by the same company.

The biometric technology

FIngerprint

The fingerprint reader two decades ago was not an ‘off the shelf’ purchase as it is today and UK schools were the forerunners in the global education sector to use biometric fingerprint readers.

The companies supplying biometric systems to schools are evenly split between long established companies supplying point-of-sale (POS) for over twenty years, to newer companies set up since 2000 to supply the biometric schools market. The companies that supply the schools market specialise in POS delivery in the form of cards, PIN, biometrics, tills, stock inventory, accounts, etc. They did not initially develop biometric hardware and software. 

In the early days of biometrics being supplied to schools the vendors were more transparent about where the technology had come from, essentially originally developed for military uses. Where exactly the biometric tech comes from today, is largely unpublished. 

We can look at Vericool's introduction of fingerprint readers in the 2000s, part developed by Anteon UK (of which Vericool was a trademark) described on Vericool’s website from 2008:

“VeriCool biometric software utilises the Digital Persona U r U 4000B optical scanner in conjunction with the Neurotechnolojica and Anteon (UK) developed biometric software application. The algorithm used by Digital Persona is unique to them.”

The Digital Persona fingerprint reader was the technology used by Micro Librarian Systems in the early 2000s. Micro Librarian Systems was later acquired by Education Software Solutions (“ESS”) of Capita plc. It was reported in 2021²⁴ that Montagu Private Equity (“Montagu”), a leading European private equity firm, had agreed to acquire the Education Software Solutions business (“ESS”) and also agreed to invest in ParentPay Group (“ParentPay”).

These commercial decisions and vertical market integration, open up a range of questions for the control of pupil images and personal data held in core information management systems and their use in biometric systems, and whether there are Chinese Walls between data uses.

Facial Recognition

With the emergence of facial recognition, and the sophistication of the recent addition that CRB Cunninghams is supplying to schools, again²⁵ it is unclear who is supplying CRB Cunninghams with this particular facial recognition technology. This type of technology seems new or unique in the way the company describes it as it learns “updated every 3 months” from a changing child's face, continually updating the FR templates to accommodate the growing face changes.

“...algorithm grows with the child”, “the system will manage… by constantly evolving the algorithm to match the child’s growth and change of appearance”.

We asked the ICO whether they were aware where else this type of facial recognition software is used (that rescans the child's face every 3 months for the algorithm to 'learn'), outside CRB Cunninghams use in the UK, with children.They responded that they don’t hold information regarding facial recognition software used on children that specially rescans a child’s face every 3 months. We can also advise that the software provided by CRB Cunningham’s to North Ayrshire Council didn’t use facial templates to train its algorithms.” (From email exchanged between the ICO and Pippa King 9th February 2022)

There appears to be a conflict of what the supplier is claiming and what the UK regulator understands the case to be. Whose company is our children’s biometric data keeping?

Chapter 9: Children's rights and family rights

Children and parents have rights set out in law that go beyond the Protection of Freedoms Act 2012 and data protection laws.

The rights-protecting articles in the UN Children's Convention on the Rights of the Child can be grouped under three categories, often known as the "three Ps" – participation, protection and provision.

The right to privacy

Article 16 of the UNCRC makes clear that children have a specific human right to protection in law from, “arbitrary or unlawful interference with his or her privacy, family, or correspondence, nor to unlawful attacks on his or her honour and reputation”. These standards imply that children should be given the same levels of protection in their right to privacy as adults.

The right to be heard
Institutional decision-making at school level when it comes to technology rarely involves children, or even families. Despite the UNCRC Article 12 right to express their views, especially in justice and administrative matters, the Committee on the Rights of the Child, recognised in 2013²⁶ that children are often politically voiceless and…have little influence, to have their rights realised. This makes it hard for them to have a say in decisions regarding laws and policies that impact their rights.” 

The UK Office for Statistics Regulation conducted a review of a selection of the key published data available on children and young people during the COVID-19 pandemic. They used the lens of 3V’s on vulnerability, visibility, and voice; and concluded that children are rarely heard on data about them, or adequately represented in UK data (The Office for Statistics Regulation, 2022).

There is rarely a route for everyday families' involvement in decisions that affect their school procurement such as cashless catering systems and lack of consultation on the installation of CCTV in school bathrooms. The sector today has no consistent social contract to enable and enforce expectations between schools and families. 

To enable views to be expressed on data management for example, educational settings need mechanisms like the NHS code system to express consent where it is required for repurposing beyond direct education. Today it is simply ignored by schools and the Department for Education and personal data is repurposed for secondary uses beyond a child’s own education, that few understand. (Survation, 2018)

Parental rights
How children’s rights can be exercised must also take the rights and duties of parents into consideration, as supported in principle by Articles 5, 18 and the second part of Article 3 in the UNCRC.

In the educational context, parents have a prior right to choose the kind of education that shall be given to their children, grafted onto the child’s right to education in the Universal Declaration of Human Rights, and in the European Convention on Human Rights.

This intersection of the rights of the child and rights of the parent in the educational environment needs particular consideration and mechanisms for decisions to be explained, challenged and exercised like opt in and objections. 

Cashless payment systems

Children and families are deprived of participation, agency and voice in this debate, which means their own views and rights are under-represented in procurement decision-making. 

Cashless payment providers are well established in the UK. Parentpay alone, for example, claims that “11,000 UK schools rely on us for best-in-class cashless payments”. They can use a variety of verification tools at the canteen checkout including the PIN number / card systems offered alongside fingerprints. Cashless payment systems are also being used increasingly alongside facial recognition. Some companies provide this integrated as part of the cashless payment services, others may be chosen by schools from entirely separate companies.

Cashless payment systems are normalising the expectations and financial norms of online banking, the processes are controlled by companies and not schools. Any associated costs, both monetary and in time, are borne by families which may be convenient for some, but disadvantages those who cannot afford the Internet access to do so. This creates the social stigma that few talk about in this debate, perhaps no longer seen in the school lunch queue, but for parents who must use PayPoints²⁷ in shops instead. It makes protection from harm; recourse for redress for mistakes much harder to manage, by involving third parties and removing the accountability of the school. We believe that cashless payment systems, all tied into digital systems, widens the gap in the everyday school experience of fair provision of services, between the haves and have-nots but while the digital divide has been analysed in other sectors (Baker et al, 2020) it has not been assessed in such school administration systems. 

Since the systems are private and proprietary, we are unable to ascertain how many parents use in-shop paypoint systems instead of their own devices. We have contacted IRIS Software Group Ltd, ParentPay, Squid, Tucasi, and WisePay to ask questions on this, and will update the information in this report online, if and when we receive any answers.

Questions over the digital divide, discrimination and ability to exercise rights in families with children in receipt of Pupil Premium or Free School Meals, remain to be explored for the next of stage of this research.

Chapter 10: Myths and mistakes

When schools deal with the term biometric data in communications to parents or children, claims are made that ‘we are not storing a fingerprint / face’, ‘it is a long number string’. In fact it is a number string that is specific to a child’s unique bodily information, ‘bio’ - life ‘metric’ - measure. The stored number is completely individual to the child and relates to their biometric data for the time it is stored and processed on a school or supplier company database. Comparison can be made to the fact a digital photograph is not an actual photograph but a series of coloured pixels, informing the user what the accumulated data is. True for an image - or a number string biometric identifier.

No claims made from industry or school have ever been substantiated in that using a biometric system improves school services, stops bullying, theft of cash/cards and that healthy eating is encouraged by children using their biometric data. There could possibly be an ease of administrative services if lost cards do not need to be replaced but this potential problem could be solved by implementing a PIN system.

A school’s communication to parents:

Why Biometrics

• Convenient way of paying for school meals. No more looking for change every morning
• Discourages the misuse of school dinner money through spending in shops outside of the school grounds
• Alleviates many of the associated problems with the use of cash in schools. i.e.: Loss, theft and bullying
• Specific food allergy ingredients can be barred automatically
• Healthy eating is encouraged
• Queuing times are reduced through increased speed of service

Claims from suppliers:

Fingerprints - “Enable and revoke user permissions instantly, implement flexible permissions dependent on individual requirements, including offices, classrooms and lockers, monitor and report on user behaviour”²⁸

Fingerprints and facial recognition - “...eliminated the occurrences of lost cards and security system complications in an example of how biometrics can reduce plastic pollution as well as increase efficiency.”²⁹

Facial recognition - “Facial Recognition is fast!In addition to offering a truly contactless solution, one of the main benefits to UK schools is an increased speed of service, with the average serve time currently at 5 seconds per pupil! This truly contactless identification method allows catering teams to safely increase the speed of service by simplifying the payment process for students who no longer need to carry any form of identification such as a card or even enter a PIN.”³⁰

FOIR to North Ayrshire Council on their use of facial recognition³¹:

Please provide the cost benefit analysis of the new facial recognition system, in other words:

i) time it took on the previous catering system to process children through the lunch line

ii) what that system used i.e. PIN, swipe card

iii) the time it is thought to take with the new facial recognition system

vi) costs saved by each school or by North Ayrshire Council, (annually or monthly) and any plans to incorporate that time to benefit children in school, I.e lunch club extensions, etc.

Response : No cost benefit analysis completed as the speed of processing was not deemed a deciding factor.

Conclusion

Our key findings from enquiries to schools with over a quarter of a million pupils in total, suggests that around 75% of secondary schools are using fingerprint technology (or other biometrics), and where used, uptake is routinely as high as 85% or more where use is restricted to only certain year groups. Use is still being made obligatory despite the law.

In line with recent decisions on facial recognition in France and Sweden, and fingerprints in Poland, as well as various parts of the U.S. it is time to ban the broad use of biometrics in UK schools, from facial recognition and fingerprints in canteens to AI using bodily data to make inferences of emotional detection and attentiveness through articulated human pose estimation.

Harm is already very real; from discrimination and infringement on human dignity in e-proctoring to the imposition of biometrics policy on disadvantaged children in receipt of free school meals. Further risks to the rights and freedoms, and full and free development of the child, may not be fully realised yet. The normalisation and chilling effects of surveillance are already seen in trials. The effects of undermining the importance of biometrics for later in life, in security and identity theft, are foreseeable.

The UK Regulator, the ICO must step in to better protect children’s rights and freedoms as recognised under the GDPR, the UK Data Protection Act 2018 and Convention 108. These tools rarely meet the high bar of necessity and proportionality required, since other tools can be used to achieve their aims in less intrusive ways. That should have been a barrier to routine use which consent could have permitted in exceptional circumstances. The intentions of the 2012 Protection of Freedoms Act were strong and should have been a vehicle to drive the increased protection of children’s rights in educational settings. But in practice in the ten years since, consent in data protection terms has failed to protect children's rights.

Consent fails (1) as a suitable basis for children to use as a lawful basis in data protection law for biometric data processing in schools, due to the coercive imbalance of power between the child, the family and school authority affecting its freely given nature. (2) Consent fails where biometrics used in the learning environment is not optional, through home-school agreements, or make opting out difficult or with a cost, again making consent invalid, even where you tick ‘agree’. And (3) Tools using biometrics such as facial detection in e-proctoring or emotions detection can infringe upon human rights and human dignity, which data laws fail to adequately address.

The failure to address rights in the field of biometrics in schools is part of a larger failure to understand and implement duty bearers’ obligations in the wider application of technology in schools. This must be addressed in initial teacher training and children’s digital citizenship curricula as well as in quality standards for school procurement. Stoilova et al concluded in 2020, that, “since the complexity of the digital environment challenges teachers’ capacity to address children’s knowledge gaps, businesses, educators, parents and the state must exercise a shared responsibility to create a legible, transparent and privacy-respecting digital environment in which children can exercise genuine choice and agency”. 

We first propose a moratorium on all biometric technology and use of bodily data in schools until September 2023 or until the Information Commissioner carries out an assessment of the use of children’s data across UK educational settings, whichever occurs later. (Face, fingerprints, eye scans, brain, vein and palm patterns, gait, pose and emotional detection and processing.)

Appendix A: FOI requests analysis from schools 2021-22

Appendix B: Parent views

Survation poll (2018)

Methodology

The data used in this report has been obtained under Freedom of Information Act requests to schools over the past 10 years first in 2010 during pre-legislative discussion for the Protection of Freedoms Bill. Following this a second set of FOI asked similar questions in 2018, and the most recent round was made to the same schools in 2021-22, as well as addressing FOI to twelve of the largest Multi-Academy Trusts (MATs).

The structure of the education system in England has changed considerably over this time period as the result of academisation which changes the nature of the legal entity of the school and its reporting structure. This makes public scrutiny and accountability through FOI requests more difficult because Local Authorities no longer have oversight or responsibility for academies and can no longer be asked for information on all schools within their region

We are alert to the challenges of obtaining quality data in this subject area. The returns per country / devolved nation reflect poor response rates despite their public sector obligations under the FOI Act and at the same time, in the COVID-19 pandemic we are alert to the unique challenges that schools and the education sector have faced in recent months. It is difficult to make assertions of trends or shares of schools using biometrics with absolute certainty, due to the closed nature of the data but any opinions in the report reflect the nature of the available data and expertise of the authors, to gives as good a picture of the current situation at the moment as possible.

Next steps

We are keen to continue to research three main areas of work in this subject.

(1) positive exceptions in the use of biometric technology in educational settings for accessibility needs (e.g. eye controls of systems for children with disabilities);

(2) to assess the discriminatory effect on take up for children eligible for Free School Meals and the effects of cashless payment systems on families in disadvantaged areas;

(3) the commercial infrastructure of the industry and its changing ownership through mergers and acquisitions, in particular vertical takeovers, is of significance to the future stability of the provision of school services and deserves more attention.

We intend to continue this work and welcome questions or ideas for collaboration.

Footnotes

¹ Daily Mail (2010) School installs £9,000 facial recognition cameras to stop students turning up late... and teachers could be next target https://www.dailymail.co.uk/news/article-1317520/School-installs-9k-facial-recognition-cameras-stop-students-turning-late.html

² BBC (2012) Biometric data: Schools will need parents' approval https://www.bbc.co.uk/news/education-18073988

³ Expérimentation de la reconnaissance faciale dans deux lycées : la CNIL précise sa position https://www.cnil.fr/fr/experimentation-de-la-reconnaissance-faciale-dans-deux-lycees-la-cnil-precise-sa-position

⁴ CRB Cunninghams https://www.crbcunninghams.co.uk/case-studies/fusion

⁵ Sky News (2021) More than 60 schools set to deploy the no-contact payments system as a result of the COVID-19 pandemic, but campaigners warn that it could be undermining children's privacy rights. https://news.sky.com/story/27-schools-in-england-using-facial-recognition-to-take-lunch-payments-12439330

⁶ Pippa King (2018) https://pippaking.blogspot.com/2018/08/biometric-consent-for-students-in.html

⁷ BSI standard PAS 92:2011 Code of practice for the implementation of a biometric system https://shop.bsigroup.com/products/code-of-practice-for-the-implementation-of-a-biometric-system/standard/preview

⁸ Consultation: Data a New Direction https://www.gov.uk/government/consultations/data-a-new-direction

⁹ Council of Europe (2018) ‘Modernised Convention 108. Convention for the protection of individuals with regard to the processing of personal data’. (Article 6) Explanatory Report pages 21-22. https://rm.coe.int/convention-108-convention-for-the-protection-of-individuals-with-regar/16808b36f1

¹⁰ DCMS consultation Data: a new direction (DCMS) September, 2021 https://www.gov.uk/government/consultations/data-a-new-direction

¹¹ 2019 report for the U.S Department of Commerce National Institute of Standards and Technology (Face Recognition Vendor Test (FRVT) Part 3: Demographic Effects) https://nvlpubs.nist.gov/nistpubs/ir/2019/NIST.IR.8280.pdf

¹² Freedom of Information request to Kingsmeadow Community School Gateshead (June 2021) https://www.whatdotheyknow.com/request/facial_recognition_9

¹³ Freedom of Information request to North Ayrshire Council (September 2021) https://www.whatdotheyknow.com/request/biometric_facial_
recognition_use

¹⁴ Financial Times, Facial recognition cameras arrive in UK school canteens (2021) https://www.ft.com/content/af08fe55-39f3-4894-9b2f-4115732395b9

¹⁵ Response by the Biometrics and Surveillance Camera Commissioner to the Department for Digital, Culture, Media and Sport consultation (2021) https://www.gov.uk/government/publications/data-a-new-direction-commissioners-response

¹⁶ Choi, T. (2022) Biometrics Update | Suprema enable UK school to cut back plastic waste from access cards https://www.biometricupdate.com/202204/suprema-face-biometrics-enable-uk-school-to-cut-back-plastic-waste-from-access-cards

¹⁷ ViewSonic's myViewBoard Sens Brings UK's First AI-powered Classroom to Smestow Academy (March 2022) https://www.prnewswire.com/in/news-releases/viewsonic-s-myviewboard-sens-brings-uk-s-first-ai-powered-classroom-to-smestow-academy-896798309.html

¹⁸ BleepingComputer (2020) ProctorU confirms data breach after database leaked online https://www.bleepingcomputer.com/news/security/proctoru-confirms-data-breach-after-database-leaked-online/

¹⁹ https://www.onvulearning.com/video-lesson-observation-software/

²⁰ “We need your specific consent for your child(ren)’s biometric data to be used. You will be asked to complete the consent form when your child joins the school. Children in Nursery do not use the finger scan but have meals recorded manually. Printed statements are available from the Bursary on request. All other pupils, including those entitled to free school meals, will operate the system by using their finger.” https://www.whgs-academy.org/parent-info/day-to-day-matters/school-meals

²¹ “Accounts must be topped up in advance using the ParentPay system and this can be done either online or via a PayPoint. Students who qualify for FSM will need to be signed up to the biometric system in order to continue to receive their lunch.” https://www.buxtonschool.org.uk/542/biometric-system

²² FOI request to West Lothian Council (January 2022) https://www.whatdotheyknow.com/request/biometric_facial_
recognition_use_2#incoming-1947239

²³ https://gov.wales/protection-biometric-information-schools-and-colleges-html

²⁴ https://www.ess-sims.co.uk/

²⁵ ESS (2021) Montagu to acquire ESS business and invest in ParentPay Group | Education Software Solutions. https://www.educationsoftwaresolutions.co.uk/resources/article/
montagu-acquire-ess-business-and-invest-parentpay-group

²⁶ Parliament (March 2007) Schools: Biometric Data debate https://publications.parliament.uk/pa/ld200607/ldhansrd/text/70319-0002.htm#0703193000078

²⁷ “Accounts must be topped up in advance using the ParentPay system and this can be done either online or via a PayPoint. Students who qualify for FSM will need to be signed up to the biometric system in order to continue to receive their lunch.” (London) and (Cheshire) https://www.weaverhamhighschool.com/wp-content/uploads/2019/10/Biometrics-Policy-2019.pdf https://www.buxtonschool.org.uk/542/biometric-system

²⁸ PayPoint Barcodes for Cashless Catering https://parentmail.zendesk.com/hc/en-us/articles/360010494099

²⁹ Committee on the Rights of the Child General comment No. 16 (2013) on State obligations regarding the impact of the business sector on children’s rights https://www2.ohchr.org/english/bodies/crc/docs/CRC.C.GC.16.pdf

³⁰ https://www.iris.co.uk/solutions/area/biometrics/

³¹ https://www.biometricupdate.com/202204/suprema-face-biometrics-enable-uk-school-to-cut-back-plastic-waste-from-access-cards

³² https://www.crbcunninghams.co.uk/news/crb-cunninghams-launch-facial-recognition-to-uk-schools

³³ https://www.whatdotheyknow.com/request/800701/response/
1914635/attach/html/3/Response%20101003991085.docx.html

³⁴ https://www.weaverhamhighschool.com/wp-content/uploads/2019/10/Biometrics-Policy-2019.pdf

References

Baker, C. et al. (2020) COVID-19 and the digital divide. UK Parliament rapid response briefing. https://post.parliament.uk/covid-19-and-the-digital-divide/

BESA (2022) Key UK education statistics. https://www.besa.org.uk/key-uk-education-statistics/

Bulgarian data protection authority (2020) Opinion on the unlawfulness of facial recognition in schools https://www.cpdp.bg/?p=element_view&aid=2261

Council of Europe (2018) Modernised Convention 108. Convention for the protection of individuals with regard to the processing of personal data. https://rm.coe.int/convention-108-convention-for-the-protection-of-individuals-with-regar/16808b36f1

Council of Europe (2020) Guidelines for the protection of personal data in educational settings. Committee on Convention 108. https://www.europarl.europa.eu/meetdocs/2014_2019/plmrep/
COMMITTEES/LIBE/DV/2018/09-10/Convention_108_EN.pdf

Department for Education (2018) Protection of children’s biometric information in schools. https://www.gov.uk/government/publications/protection-of-biometric-information-of-children-in-schools

Department for Education (2022) Schools, pupils and their characteristics 2020/21 https://explore-education-statistics.service.gov.uk/find-statistics/school-pupils-and-their-characteristics

European Data Protection Board (2019) Facial recognition in school renders Sweden’s first GDPR fine. https://edpb.europa.eu/news/national-news/2019/facial-recognition-school-renders-swedens-first-gdpr-fine_en

European Data Protection Board (EDPB) and EDPS (2021) Call for ban on use of AI for automated recognition of human features in publicly accessible spaces, and some other uses of AI that can lead to unfair discrimination. https://edpb.europa.eu/news/news/2021/edpb-edps-call-ban-use-ai-automated-recognition-human-features-publicly-accessible_en

House of Lords debate November 4 Biometric Recognition Technologies in Schools

Hansard, Volume 815 https://hansard.parliament.uk/lords/2021-11-04/debates/26FB2DF4-8D5A-456B-AFDA-73501D1CCBD3/BiometricRecognitionTechnologiesInSchools

ICO (2021) What is special category data? https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/special-category-data/what-is-special-category-data/

Scottish Parliament (28 October 2021) Meeting of the Parliament: Facial Recognition Technology (Schools) Official Report https://archive2021.parliament.scot/parliamentarybusiness/report.aspx?r=13373&mode=html#iob_121339

Stoilova, M., Livingstone, S. and Nandagiri, R. (2020) ‘Digital by Default: Children’s Capacity to Understand and Manage Online Data and Privacy’, Media and Communication, 8(4), pp. 197–207. doi:10.17645/mac.v8i4.3407.

Survation (2018) Poll on behalf of defenddigitalme in February 2018 of 1,004 parents with children in state schools https://defenddigitalme.com/2018/03/only-half-of-parents-think-they-have-enough-control-of-their-childs-digital-footprint-in-school/ Full tables https://survation.com/wp-content/uploads/2018/03/Defend-Digital-Me-Final-Tables-1.pdf

Tonkin (2021) Call for Review into SJTs: online proctoring. The BMA called for a review into the handling of online exams following reports of students being denied toilet breaks and tests being abruptly terminated. https://www.bma.org.uk/news-and-opinion/call-for-review-into-sjts

Contributors

Authors
Pippa King
Jen Persson

Artwork by
Hannah Mallory

Funded by
the Joseph Rowntree Reform Trust

Citation: The State of Biometrics 2022: a review of policy and practice around biometric data in UK education, defenddigitalme (2022)

Permission to share this work is distributed under the terms of the Creative Commons Attribution 4.0 international licence attribution share-alike which permits unrestricted use, distribution and reproduction in any medium, provided the original authors and source are credited and does not suggest endorsement. (CC BY-SA 4.0) This excludes artwork but it may be available on request.

Where we have identified any third party copyright information you will need to obtain permission from the copyright holders concerned.

Any enquiries should be sent to [email protected]