Wales issues new guidance on biometrics in schools, clarity welcomed

The Welsh government has released new, clear guidance on how schools should prepare for implementing any technology that would handle children’s biometrics. The non-statutory guidance explains the “legal duties schools and colleges have if they use ‘automated biometric recognition systems.’”

‘Protection of biometric information in schools and colleges’ with the subtitle ‘Guidance on your legal duties if you use biometric information’ is aimed at school owners, headteachers, governors. It details the process from data protection impact assessment and ensuring non-biometric alternatives are always available, explains the UN Convention on the Rights of the Child, consent requirements for under-18s and guidance on how biometric data is managed.

The guidance includes behavioral biometrics in its definition of biometrics and covers the use of live facial recognition, as well as one-to-one facial recognition such as at an entrance. It recommends thorough research with the UK’s Information Commissioner’s Office (ICO) – such as the commissioner’s opinion on live facial recognition – and Biometrics Commissioner for England and Wales. “We are not aware of any schools/colleges in Wales currently operating FRT systems and would strongly discourage the use of this technology,” states the guidance.

Education Wales has condensed the advice into a simple guide for parents and pupils which includes ways to opt out and reassures readers that “Schools in Wales and across the UK have used biometric technology for many years.” There is even a sample of the one-sentence wording needed to withdraw consent.

Senedd (Senate) Member Sarah Murphy welcomes the clarification, reports News from Wales. “In 2021, I was made aware of local schools in Bridgend introducing technologies to collect and use fingerprints of children for lunchtime meals. Technologies once used by state intelligence agencies are now being used on our children for monetary transactions.

“When somebody has a password, it is something you can change or reset – a fingerprint is something you are. Once that data is compromised, it is compromised for life.”

Welsh Government Minister for Education and Welsh Language, Jeremy Miles, launched the guidance at a high school in Sarah Murphy MS’s Bridgend constituency.

“I want to thank the Minister for his work on this and I welcome the launch of this guidance today, and I am keen to continue working on this with the Minister and Welsh Government. Children must have their right to privacy and consent upheld in education.”

Pippa King, co-author of the damming report ‘The State of Biometrics 2022: A Review of Policy and Practice in UK Education’ is also quoted:

“Schools in Europe have been fined for using biometric technology in school – facial recognition and fingerprints – as processing a student’s biometric data breaches GDPR.

“It would be prudent that UK schools do not put themselves at risk of contravening GDPR, and the risk of a fine, and opt for a less data intrusive method that biometric technology does not offer.”

Powys schools’ biometrics

For example, Ysgol Calon Cymru, a school in Powys, has a fingerprint-based canteen payment system operated by Powys County Council (although Crickhowell High School, below, states this system is run by NRS Ltd). It has a Biometric Data Policy on its website. It seeks consent from one parent, but if the other parent objects or if the child objects, the school does not collect his or her biometric data.

Another school in Powys has the canteen biometrics, but also has fingerprint door access. For this security feature, the Crickhowell High School requires fresh consent from a parent and the child. No alternative to biometrics for door access is mentioned on the school site or the 2017 letters sent to parents, rather further clarification that there are no alternatives: “To ensure the maximum effectiveness of this new security protocol, cards will not be issued as they can be easily lost or cloned.”

Biometric Update has contacted Crickhowell High School for clarity on non-biometric alternatives.

Article Topics

biometric data  |  biometrics  |  children  |  data privacy  |  facial recognition  |  fingerprint biometrics  |  schools  |  Wales