Schools’ biometrics trials fined in Poland, launched in NJ, and criticized in Australia
A school in Gdansk, Poland, has been fined PLN 20,000 (roughly US$5,300) by the European Data Protection Board over a biometric data processing breach that affected 680 children in the 2019-2020 school year.
The school used a biometric reader to process student’s fingerprints as a form of identification and lunch payment verification, however the President of the Personal Data Protection Office (UODO) said there was no legal basis for the measure, as other forms of identification could have been used at the school canteen such as electronic cards or name and contract number. Not only was the school fined, but all personal data is to be erased and data collection discontinued.
The school had received written consent from parents or legal guardians to implement the measure, and has been doing this since April 1, 2015.
Students that did not give consent for biometric identification had to wait at the end of the line, which, according to the President of the UODO, was unequal treatment that favored students with biometric identification. The President further said children’s personal data needs enhanced protection because biometric systems collect unique and permanent features that do not change over time. A biometric data leak could affect people’s rights and freedoms.
U.S. school rolls out biometric lunch lines
On the other side of the pond, however, a school in the Gloucester City School District in Camden County, New Jersey, is doing the exact same thing: it is looking into installing what seems to be a biometric finger vein reader for meal payments to reduce time spent in line, and parents are not happy, reports NJ.com.
“Our school has selected the Biometric Finger Scanning Identification System because it is secure, accurate, cost-effective and non-intrusive,” Kate Kerney, principal of the Cold Springs school said in a note to parents. “This is not a fingerprint scanner. Biometric scanning will help to reduce errors related to forgotten user PIN numbers.”
The students in school are pre-k to third-grade, and the plan is to roll out the system district wide. The data would be kept in the school’s database.
While concerned parents asked for further clarification, Gloucester City Superintendent Dennis Vespe did not comment on whether the system has a privacy statement, how long the data is kept or who it is shared with.
Australia trials raise concern
Australian schools are implementing similar methods, although concerns about children’s data security have been raised, writes Gizmodo.
In Melbourne, for example, a startup called LoopLearn is testing its biometric facial recognition technology in classrooms, but schools have been trialing this type of technology for nearly two years. Not only has this startup’s technology benefited from the lack of regulation, but it has also received federal and local government grants to be developed.
Following a detailed journalistic report on how Australian schools have been trialing facial recognition to track attendance, the Victorian government’s Minister for Education James Merlino banned the technology from use in public schools in absence of explicit and informed consent from parents, students and the education department.
Concerns were also voiced about LoopLearn’s data protection strategy for sensitive biometric information.
Australian Human Rights Commissioner Edward Santow said the technology affects people’s privacy and there is not enough justification for these efforts.
Repeated criticism led to a number of schools withdrawing from the project, except for Waverley College’s Waterford campus in Sydney’s Eastern Suburbs where the technology is used in five classrooms. The project started at the end of 2019 and is expected to end in 2020. The school says parents and students were informed about the trial. When the college’s Parents’ Association was contacted by Gizmodo for confirmation, it did not comment.
The school is looking into expanding the trial to music classes, the library and the health center, and even mobile kiosks to enroll more students.
LoopLearn says the data is only temporarily stored on school servers, it is not shared with third parties and parents have been given all the necessary details to make an informed decision.
“Instead of a teacher calling out student names to manually mark attendance, a single image is taken by a secure LoopLearn sensor situated on the wall of the classroom,” a LoopLearn spokesperson told Gizmodo Australia. “This sensor is connected to the school’s closed network, and facial recognition technology is used to accurately and instantly match the students’ presence against de-identified numerical values.”
“Data is de-identified and fully encrypted, and stored on secure servers based in Australia. Data is privately owned by each school, and is not shared with or accessible by any third party, including government bodies,” LoopLearn said in statement provided to Gizmodo Australia. “Any image that may be captured is for the specific purpose of enabling schools to record attendance, and is deleted once the roll call is complete.”
Clarendon College in Victoria found the technology to be “inconclusive” and stopped using the hardware in 2019. During this trial, parents were given all the details but did not sign specific permission slips. Geelong’s Sacred Heart College is allegedly another school involved in the trial, but denied it when asked by Gizmodo Australia.
To move forward with the trial, schools in Victoria have to make sure it is in line with Victorian Protective Data Security Standards and make a privacy impact assessment to understand what happens to the data.
In a conversation with the Victorian Education Department in November 2019, Gizmodo Australia found that the schools had not yet asked for permission to start these trials. In NSW, the education department said it did not have plans to roll out the technology and did not know about schools being interested in deploying it.
LoopLearn did not release a list of schools joining the trial, and is working on expanding its product line.
biometric data | biometrics | data protection | European Data Protection Board (EDPB) | facial recognition | fingerprint recognition | payments | schools | time and attendance