5 salient points about biometric technology used in schools is listed in the infographic in this post.
Using one's biometric data is a more data intrusive way of accessing schools services than a PIN or swipe card. This has been recognised by legislation and schools therefore are legally obliged to offer students an alternative means to access such services and must have consent, from both parents and students, if biometric data is to be taken and processed.
Schools in the UK have been using biometrics since 1999. Often this was done without informing parents due to the fact that the Data Protection Act 1998 did not list biometrics as 'sensitive' personal information, hence parents permission or even knowledge that their children's biometric were being taken happened.
Many different types of biometric technology have been used in schools. The biometric most used is fingerprint.
Campaigning by parents lobbying Members of Parliament culminated, 13 years after schools started using the technology, with legislation covering consent to biometric processing in the Protection of Freedoms Act 2012, Chapter 2.
It is prudent to minimise personal data given. We have no idea if a child's biometrics given in the education system is compromised or shared, with other agencies or companies, the effect this may have later in their life.
Know your facts and consider keeping your child's biometric digital data from unnecessary use when an alternative means of identification will suffice.
This is an update on the Freedom of Information requests (FOIR) sent to all 32 Scottish local authorities in August to determine the use of biometrics in schools there. This is with a view to extending the same rights that English and Welsh children have not to have their biometrics collected and processed in schools, with an entitlement to use an alternative way of accessing school services such a a PIN or swipe card.
Some interesting results have turned up in the two thirds of FOIRs that have been received back so far. There seems to be two companies supplying the Scottish market with one most dominant. The company that is most dominant also introduced the biometric fingerprint scanners in schools as early as 1999 and 2000.
This is a surprise to me as I was under the impression that schools in the UK started the introduction of fingerprint scanners for libraries in 2001when the below communications with a school biometric supplier, the Information Commissioner's Office (ICO), who oversees the Data Protection Act, and Department for Education (DfE) took place. See bottom of this post. So it would be interesting to see if the ICO and DfE knew about the earlier use of children using their biometrics and see any correspondence on that.
With the results from the FOIR so far it seems that currently around 5% of children in Scotland use their biometrics to access school systems, although I still have a third of the authorities yet to reply. Even so this amounts to 35,000 plus children and that is only a snapshot of current usage. Given that some authorities have been using biometrics in schools for nearly two decades, this significantly raises the amounts of children that have had their biometrics logged at schools in Scotland to the many tens of thousands, if not over the hundred thousand mark. The current Scottish school population is just over 687,000 children.
When all of the Scottish authorities have responded I will post more here.
It's that time of year again, when parents with children going up to high schools are encountering biometric systems in their children's new schools and are unsure of their rights to consent and what responsibilities the school has to ensure school services are not withheld from students who do not participate in their biometric system. Hopefully this will clarify schools, parents and children's position. A PDF version can be found here.
A school’s responsibility
A school cannot take and process a student’s, under 18 years old, biometric data without the consent of the parent/s or the student. Consent must be given in writing from the parent/s. Consent can be withdrawn at any time.
CONSENT
·If one parent consents and the other does not, the non-consent takes precedence.
·If the parent/s consent and the student does not, the students non-consent takes precedence.
·If the parent/s do not consent and the student does consent, the parents non-consent takes precedence.
If a consent is not given the school “must ensure that reasonable alternative means are available by which the child may do, or be subject to, anything which the child would have been able to do, or be subject to, had the child’s biometric information been processed.” as detailed in the Protection of Freedoms Act 2012,Chapter 2 Section 26 (7).
Parents
Parent/s must be informed by the school that they are using a biometric system and the school must gain written consent from the parent/s to take and process their child’s biometric data. You may withdraw your consent at any time.
Schools do not always make it clear when asking for consent that an alternative to the biometric system is available and that non-consent ultimately lies with the student.
Students
Regardless of consent given by your parent/s you alone determine whether a school takes and processes your biometric data. If you choose not to use a biometric system the school must provide an alternative and must not withhold any services from you that is available through their biometric system. You may withdraw your consent at any time.
Under the Protection of Freedom Act 2012 if schools want to use and process a child's biometric data
they must ask for consent from the pupils and parents. Schools must also offer an alternative option to access systems if consent is not given to process a student's biometrics - such as a pin number or swipe card.
Schools use a student's biometrics to access facilities such as canteen, library, registration, etc, and the biometric of choice seems to favour the fingerprint.
In order to move towards consent for children in Scotland (and Northern Ireland) Freedom of Information requests have been sent to every local authority in Scotland to determine how prevalent the technology is in schools, whether consent is sought, type of biometrics used and for what purpose. As it is school holidays, and given that the beginning of term is busy, we expect to this this information back by end October 2018 and then work to get this issue of consent raised in the Scottish Parliament.
Since I started this blog over 10 years ago the state of surveillance, monitoring and application of biometric technology used in schools on our children, the next generation, has increased beyond imagination. Okay, there may be arguments that his 'improves' their education, enables better educational analysis, reduce admin time/costs, etc... but personally, I've not seen a dramatic increase in the next generations intellectual ability or schools being more affluent because of technology. Certainly here in the UK we currently have a national funding crisis in education.
It is a different education that is needed for today's kids. Access to information is greater to an individual than ever before. Knowing and retaining information in this age maybe is not a necessity as much as it was. Moreover how to apply that knowledge in this ever changing society perhaps is a skill children should learn. Discernment, where one's digital footprint is left and the data left again one's digital identity should also be considered. How, who and what may be assumed by a children's online activities on the Internet - and within a school network - is a burgeoning area that needs urgent consideration, especially for those it could potentially affect in decades to come.
With governments, private education tech companies and private companies running schools having access to individual educational data from the age of 2 years old (in the UK) to 19 and beyond gives an enormous potential for profiling. I could write about this for an age, as these are all points that have been raised with the proliferation of technology in education for the past decade plus.
What to do? I have been absent somewhat from blogging here as the transfer of biometric technology tested used on children in the UK has now widened into the rest of society. My concern is when the state uses biometric technology without consent, much as schools did from 2001 - 2013 in the UK. I set up a sister blog a couple of years ago to keep the two developments of biometric technology, schools / wider society, separate - see my State of Surveillance website.
However, there is now an issue of facial recognition creeping into US and Chinese schools for a variety of reasons. Here in England and Wales (not Scotland or Northern Ireland) facial recognition is not viably an option for schools with under 18 year olds, as per the consent required under the Protection of Freedoms Act 2012. The argument for the use of biometrics in schools - whether fingerprint or facial recognition - is basically unproven, as other, less invasive, less 'valuable', means of identification will suffice. This is an issue I intend to raise again here.
So, hopefully, (in a rather large nutshell) I've explained my absence and fully intend at least once a week to start again back here. T'will be nice to get back to it!
Last Month the Department for Education issued an updated advice for schools taking and processing students biometric data.
This useful advice is also a 'must' read for students and parents so they are fully aware of their rights of access to services should they choose NOT to participate in a biometric system.
A recent survey, carried out by DefendDigitalMe, revealed that:
"Over a third (38%) [of parents] of those who said their child’s school uses biometric technology said they were not offered a choice of whether to use this system or not and 50% have not been informed how long the fingerprints or other biometric data are retained for, or when they will be destroyed — despite the Protection of Freedoms Act 2012 requiring parental consent, and an alternative to be on offer, showing that practical guidance is needed to help schools understand how to implement the legislation."
This shows that there is still clearly a lack of understanding by schools of their legislative obligations to parents and students with regards to biometric data storage, processing and their consent.
Please do have a read of the above advice, any of the information here and make an informed choice about your/your children's biometric data.
It's that time of year again, when parents with children going up to high schools are encountering biometric systems in their children's new schools and are unsure of their rights to consent and what responsibilities the school has to ensure school services are not withheld from students who do not participate in their biometric system. Hopefully this will clarify schools, parents and children's position. A PDF version can be found here.
A school’s responsibility
A school cannot take and process a
student’s, under 18 years old, biometric data without the consent of the
parent/s or the student. Consent must be
given in writing from the parent/s.
Consent can be withdrawn at any time.
CONSENT
·If
one parent consents and the other does not, the non-consent takes precedence.
·If
the parent/s consent and the student does not, the students non-consent takes precedence.
·If
the parent/s do not consent and the student does consent, the parents
non-consent takes precedence.
If
a consent is not given the school “must ensure that reasonable alternative
means are available by which the child may do, or be subject to, anything which
the child would have been able to do, or be subject to, had the child’s
biometric information been processed.” as detailed in the Protection of Freedoms Act 2012,Chapter 2 Section 26 (7).
Parents
Parent/s must be informed by the school that they
are using a biometric system and the school must gain written consent from the
parent/s to take and process their child’s biometric data. You may withdraw your consent at any time.
Schools do not always make it clear when asking
for consent that an alternative to the biometric system is available and that
non-consent ultimately lies with the student.
Students
Regardless of consent given by your parent/s you
alone determine whether a school takes and processes your biometric data. If you choose not to use a biometric system
the school must provide an alternative and must not withhold any services from
you that is available through their biometric system. You may withdraw your consent at any time.
I am getting a lot of emails from concerned parents of children leaving primary school to go to secondary school with the way that the secondary schools are asking for consent to use their child's biometrics - fingerprint, fingertip data - and not offering an alternative method to access the catering, library, registration, etc, system. In this parents are feeling that their request for consent is coerced.
The relevant authority must ensure that reasonable alternative means are available by which the child may do, or be subject to, anything which the child would have been able to do, or be subject to, had the child’s biometric information been processed.
Unfortunately some parents have been made to feel from schools that they are being unreasonable in not giving consent and that they are they only one objecting to biometric consent. You are not a 'problem parent'. You and your child have a right to not give the school biometric data - data that is absolutely unique, personal, highly precious and that needs to be secure for the child's life time.
Parents feeling isolated by a school is a story I have heard over the past 10 years so many times from so many parents - you are not alone at all. I myself last year, when my child entered sixth form, was told by the Principal that I was the only parent objecting to them using my child's biometrics - I was not.
Quite often the supplier of the biometric system to the school will also offer alternative means of accessing the system they provide. Examples are swipe card, PIN number and taking the names of the children at the point of sale at the till, so it shouldn't be an inconvenience for the school to offer alternative means of identification.
The new EU General Data Protection Regulations is law for every member state of the EU, including us. It came into law 27th April 2016. Schools are subject to this.
Point 32 states:
Consent should be given by a clear affirmative act establishing a freely given, specific, informed and unambiguous indication of the data subject's agreement to the processing of personal data relating to him or her, such as by a written statement, including by electronic means, or an oral statement.
Point 42 states:
Consent should not be regarded as freely given if the data subject has no genuine or free choice or is unable to refuse or withdraw consent without detriment.
If anyone has any concerns or questions please don't hesitate to get in touch, I'm really happy to help if I can.
'Turning fingers into keys' Credit: kaprik/shutterstock.com
There is a great article written by Brian Patton, University of Oxford, entitled "The trouble with taking biometric technology into schools", that appeared in The Conversation earlier this month, which every parent and student should read before considering using their biometrics in schools.
Other than copy most of the article into this post I would urge a read of the article which succinctly discusses security, effectiveness, implications of a data breach and consent.
Schools and biometric companies supplying schools are keen to reassure parents and students that it is not a (pictorial) fingerprint that is being stored but simply a number string - a number string completely unique and specific to your child's 'bio' body 'metric' measure.
Patton makes the valid point that:
"For other biometric data it's important to remember
that what is being matched within the computer is not, say, one fingerprint
against another. It is a set of data drawn from the features of the scanned
body part – a numerical abstraction. Steal this key and you have effectively
stolen that part of the person."
He also goes on to say that,
"...a data breach will mean these type of scans
will be untrustworthy for the pupils – for the rest of their lives.
And therein lies another issue: with the potential for
life-long consequences, are pupils, some below the age of 16, competent to opt
in to such a scheme? And what of those who opt out? It's one thing to ask
adults to weigh up the balance between convenience and risk, but there are two
likely issues that would make this harder in schools. There is an inbalance of
power between those wanting to implement the technology and those subject to
it. This raises serious concerns about informed consent – perhaps one of
the reasons why in 2012 using biometrics was banned in English state schoolswithout parents' consent."
There are potentially long term, unknown consequences to this biometric technology used on the youngest generation in society - we are experimenting with it on our children in schools for daily activities that can be easily undertaken, quite adequately, without the use of biometrics.
I guess an individual will only know when their biometric data has been compromised when in the future they hit a problem regarding their biometrics. How will they know when it was compromised, by whom and where their very personal digital identity has gone?
In the words of Brian Drury, IT Security Consultant:
"Once a child
has touched a [biometric] scanner they will be at the mercy of the matching
algorithm for the rest of their lives."
How utterly ridiculous! If children cannot remember a few passwords to log into an iPad how on earth is a school to hope children will retain lesson content?
What is more worrying is that teachers also "dedicate a lot of time to logging
in". Apparently with this new facial recognition programme it is a “walk through one door and you’re into everything,”...erm, isn't that what an iPad password does anyway?
The whole sales pitch on this was completely flawed - in fact it was a load of rubbish and parents were not falling for it. A solution to a problem that simply did not exist and parents rightly saw through this.
It's strange isn't it? Outside school children are quite capable of remembering passwords for computers, tablets and mobile phones. As a parent I can absolutely say that I have never heard another parent moan about their child's inability to remember a password or had any conversation with another parent about their child's passwords being stolen or compromised. So it's very odd that when a child enters school this sudden amnesia becomes a problem that potentially costs the tax payer $189,000. I would say that is unbelievable.
If maybe, possibly, this peculiar amnesia is true, then surely $189,000 could be better spent to fund research into this strange phenomenon of kids forgetting passwords... I don't think we'll see that happen because this sudden loss of memory in our children does not exist - and we parents know it.
A petition was set up by a parent that gained over 360 signatures and was successful in swaying opinion that biometric facial recognition is a completely unnecessary and inappropriate technology to use with children.
"At a time when biometric technology is increasingly finding applications in schools – from deployments as innocuous as cafeteria lunch administration to more serious security systems
– the EUSD fiasco signals how precarious this area can be, given the
privacy and security concerns that often seem to come up with public
biometric deployments, and parents’ particularly strong interest in
protecting their kids."
Facial recognition is a biometric technology not much used
in education.If it is to be used it has been
mooted that it will track children’s facial expressions to gauge response to
lessons or on screen learning but it is now starting to creep into identifying
and verification of students.
In the UK, facial recognition systems are not used in
schools with the exception of one small instance of facial
recognition being used in education in 2010 at the City of Ely Community
College for registration purposes.The
college no longer uses the facial recognition system as it wasn’t suitable for
the purpose intended; the scheme ran for around an academic year before being
scrapped.
U-T San Diego file photo
Now the technology has matured over the past 5 years, facial
recognition is coming back into education.Encinitas Union School District, in California, students will log
in to their iPads via facial recognition technology for a first-of-its-kind
pilot project.This involves the iPad
scanning the child’s face every 60 seconds claiming to help kids log on to
technology and for them not to forget their passwords.If a child cannot be taught to remember their
password then what hope is there for the schools to actually educate them!This is not about remembering passwords or
saving time logging on.This is about
constantly verifying the student so that the data controllers running the
educational software can accurately gather data on that individual. So here
facial recognition is being used to identify and continuously verify.Not without controversy though, parents are
not happy with this constant biometric facial scanning for a number of reasons,
invasion of privacy of minors and a that it a waste of money, with a
petition set up against the facial recognition technology being used in
this schools district.
“Encinitas Union launched its iPad
program in 2012, equipping each third-through sixth-grade student with a device
to use for school work and lessons. Since then, the district has put iPads into
the hands of all of its 5,400 students, at a cost of $2.7 million.
“It’s creepy to take a photograph of a kid every 60 seconds,” said Gil Saidy,
who has a third grade son at Flora Vista Elementary School. “I don’t trust
them. I don’t want these roving cameras in my house.”
“It’s a momma-bear’s
instinct to protect their child. I just don’t know who has access to the face
scans,” said another parent, Darcy Brandon. “Where is the data being stored?”
The pilot program
would start with 100 students and, if successful, the technology could
ultimately be added to all district iPads. Parents must opt-in to have their
child use biometrics.”
At the very least it is an opt-in scheme so hopefully most
parents will have the common sense to say ‘no’ to this unnecessary use of
facial recognition, desensitising our kids to constant monitoring.
Unlike fingerprint or palm scanning biometrics used in
schools, facial recognition is a non-participatory biometric with the ubiquitous
scanning happening without conscious involvement. What else is the facial
scanning revealing?
Educational companies are lining
up with emotional face biometrics coming into education gauging how a student
is feeling, where their eyes are looking, how they are reacting.An article from September
2013 reports that SensorStar Labs have a product that records “When the student is looking up at the
teacher, the teacher score goes up. If she looks down at the computer, the
computer score goes up. So we’re tracking facial expressions. If she makes a
smile, it might be indicative that is enthusiastic about the topic.”
Facial recognition has also been introduced at St Mary's High School, St Louis, for 'safety' reasons only allowing in to school registered members on the database. This is thought to be the first instance of facial recognition being used in this way in the States. There is also a 'watch list' of peoples faces not allowed in the schoolthat alerts law enforcement if those persons of interest try to enter.Presumably opting out of this facial recognition system is not an option for pupils as it would deny them entry to education.
Facial recognition seems to be emerging as the new educational biometric. Not for the student convenience or safety, more about verification of data capture... who is where, doing what and when.
Children are the most data mined section of our society. Biometric facial verification more accurately authenticates the data grab and profiling of our kids.
Fingerprinting children in school, especially primary school children, is a contentious issue - with parents and children having the right in the UK not to participate. Schools must seek written consent to take and process a child's biometric data.
Not so in Australia it seems.
In this article it reported that East Para Primary School has told parents they have "no choice" in the matter for a school registration system that will eventually be introduced for parents too if they want to enter the school. The school's current newsletter states the same blerb parents have had here in the UK reassuring that no image of the fingerprint will be stored, it cannot be reconstructed and the biometric data will not be given to government or agencies... but put plainly it is a biometric mark/measure of your child's body, in this case a fingerprint, that has to stay secure, safe and never be compromised.
Giving up ones biometric may not be considered a proportionate use of personal data. Parents should be able to decide what level of privacy they want for themselves and their children in this respect.
School mother Sandra Tomasin said she was disgusted by the move and immediately rang the school to ask that her Year 1 son be exempt from the program.
“They have told me that I have no choice,’’ Ms Tomasin said.
“It is an invasion of privacy. I don’t want to let it happen but I want to keep him at the school.’’
Ms Tomasin said regardless of whether or not finger prints were stored by the system, primary school children having to scan their fingers when they came and went to school was outrageous.
Sandra Tomasin is rightly outraged and should have a right for her child to attend school and NOT having to give up their biometric data.
In the UK schools fell short of giving this ultimatum as it was thought to breach Human Rights legislation by denying a service to a child because they chose not to give up their biometric data, any ultimatum of this sort was also on shaking grounds with Article 16 of the UN Convention on the Rights of the Child (right to privacy) "Every child has the right to privacy. The law should protect the child’s private, family and home life." - which does apply to Australia.
The below statement was made by Privacy International in 2002 about library systems that used children's fingerprint biometrics in the UK to log books in and out. It is still applicable now.
The publication of the "Who knows what about me?" report today by the office of The Children's Commissioner for England highlights the huge amount of data gathered on children, including the use of biometric technology in schools. 
