A SCHOOL in England has been reprimanded for using 'facial recognition technology' to take cashless canteen payments from schools - more than 18 months after North Ayrshire Council faced a similar rap.
The technology was introduced in nine North Ayrshire secondary schools in September 2021, affecting more than 2,500 pupils, before being swiftly withdrawn from service the following month after serious concerns were raised.
And last year, a review by the Information Commissioner's Office (ICO) found that North Ayrshire's short-lived use of facial recognition technology (FRT) was "likely" to have breached data protection law.
Now the ICO has ruled that a school in Essex broke the law when it “failed” to complete a data protection impact assessment before starting to use the technology.
They ruled that Chelmer Valley High School, in Chelmsford, which has around 1,200 pupils aged 11-18, had not properly obtained clear permission to process the children’s biometric data and students were unable to “exercise their rights and freedoms”.
After the Chelmer Valley judgement, Lynne Currie, head of privacy innovation at the ICO, said: “Handling people’s information correctly in a school canteen environment is as important as the handling of the food itself.
“We expect all organisations to carry out the necessary assessments when deploying a new technology to mitigate any data protection risks and ensure their compliance with data protection laws.
“We don’t want this to deter other schools from embracing new technologies. But this must be done correctly with data protection at the forefront, championing trust, protecting children’s privacy and safeguarding their rights.”
The North Ayrshire system was designed to manage 'cashless catering' by scanning the faces of pupils at canteen tills and matching the photo to a digital record, at which point money would be deducted from their online account and transactions would be streamlined during the busy lunch break.
The council told the ICO that it had paused the use of the technology at the end of October 2021 after concerns were raised, and by the middle of November all data had been deleted.
The ICO said that while North Ayrshire sent out consent forms to parents of S1-S3 pupils, and gave consent forms directly to pupils in S4-S6, it "appears unlikely that consent was freely given".
The ICO told council officials: "Our view is that NAC was unlikely to comply with the requirements of [data protection laws] as it did not ensure that the content of its privacy notice was provided to children in a concise, transparent, intelligible and easily accessible form, using clear and plain language.
"In particular, it did not attempt to explain to children, in child-friendly terms, the potential impact of the processing of biometric data."
Comments: Our rules
We want our comments to be a lively and valuable part of our community - a place where readers can debate and engage with the most important local issues. The ability to comment on our stories is a privilege, not a right, however, and that privilege may be withdrawn if it is abused or misused.
Please report any comments that break our rules.
Read the rules here