Biometric fingerprints - polish school fined!

[Jaymate]

Just read this and wondering how many schools in the uk use biometrics and should we now be reconsidering?

 

https://venturebeat-com.cdn.ampproject.org/c/s/venturebeat.com/2020/03/06/polish-school-hit-with-gdpr-fine-for-using-fingerprints-to-verify-students-lunch-payments/amp/

 

Any thoughts?

[Wubbalubbadub]

Maybe i'm misreading.. but this fine related to the fact that the school were having a bias towards those who could provide a fingerprint by making those not using fingerprints go to the back of the line..

[Jaymate]

Maybe i'm misreading.. but this fine related to the fact that the school were having a bias towards those who could provide a fingerprint by making those not using fingerprints go to the back of the line..

 

Yes that is what probably highlighted the use of it but it also says “Moreover, in the authority’s view, the use of biometric data, considering the purpose for which they are processed, is significantly disproportionate.” which sounds like they are saying to use collect and use biometric data just to manage school lunches isn't an appropriate reason to collect and process biometric data on children when there is alternative solutions.

[Ditto]

I know when I first started working at a school, I was slightly surprised that fingerprinting was used. I've tried to reflect why I reacted this way and I came to the conclusion, that for me, is that finger-printing was linked to criminal activity (not that I ever have been except possibly to enter the U.S.). However, it's no different to retina scans, and to a lesser extent facial recognition. Both of these get quite a bit of discussion. Perhaps I'm also surprised more parents haven't objected, but it appears to be widely regard as a norm in schools, although I wonder how many parents are fully aware of fingerprints being used. I'd also wonder how many schools have a clear data retention policy covering those records.

[mavhc]

Better than having their lunch money stolen

[ITGURU]

I know when I first started working at a school, I was slightly surprised that fingerprinting was used. I've tried to reflect why I reacted this way and I came to the conclusion, that for me, is that finger-printing was linked to criminal activity (not that I ever have been except possibly to enter the U.S.). However, it's no different to retina scans, and to a lesser extent facial recognition. Both of these get quite a bit of discussion. Perhaps I'm also surprised more parents haven't objected, but it appears to be widely regard as a norm in schools, although I wonder how many parents are fully aware of fingerprints being used. I'd also wonder how many schools have a clear data retention policy covering those records.

we used to use biometrics for cashless catering.once the fingerprint was taken it could never be read again as an image.it was encrypted. all the data was stored onsite only so no risk of data leak to 3rd parties.

[Ditto]

Better than having their lunch money stolen

It would be interesting to see this stance from a defence lawyer in a Polish court! I suspect the prosecution would chew it up fast.

[Ditto]

we used to use biometrics for cashless catering.once the fingerprint was taken it could never be read again as an image.it was encrypted. all the data was stored onsite only so no risk of data leak to 3rd parties.

Quite possibly, providing all the technology works as designed. Clearly the majority of parents and students have no issue with it as I've seen the same approach. However, I wonder if a 'non-contact' approach will become more desirable with the current viral outbreak.

[mikeprice]

Biometric fingerprints - polish school fined!

 

just goes to show that you shouldn't clean a school too much - I mean a good dust and hoover - maybe a damp wipe

all over polishing is over the top

 

 

 

 

 

 

 

 

 

Oh come on - someone had to

 

the same would have happened with a hungary school

[localzuk]

we used to use biometrics for cashless catering.once the fingerprint was taken it could never be read again as an image.it was encrypted. all the data was stored onsite only so no risk of data leak to 3rd parties.

The risk isn't about it being leaked, but one of privacy of personal data. That data may not be able to be reversed, but it can still be used to identify someone - police could use that data to identify someone for example. The way the law is written, the default position is to not collect or process personal data. So, you have to go through the various steps to justify using it. Saying it is encrypted is not enough.

[mavhc]

The only way it could be used to identify someone is if you took their finger and put it on the reader, I'm assuming the owner of the finger would a) notice that, or if they didn't b) not mind because they'd had their finger removed and really want the police to find their kidnapper

[localzuk]

You are basing that on what you know, but not what may be possible at some point soon. Take the problem of the DNA companies in the USA. Those ones you send a swab to and it tells you which part of the world you come from, and what illnesses you are predisposed to. Sounds like a nice service. Except, the data has been used by police in recent years, because it has lower protection requirements than forcing someone to hand over their DNA via a warrant.

 

So, whilst you may not recognise a way to use the fingerprint data here and now, the law recognises that this can change very rapidly, and we should all fall back to the default position - you must adequately justify collecting and processing that data, and it must be proportionate to the sensitivity of that data.

[mavhc]

that's easy then: just compare the likelihood of someone hacking into the school fingerprint reader, changing the firmware, stealing the fingerprints of children, waiting 10 years for one of them to leave their fingerprint near a recently stolen diamond, finding them again, threatening to tell the police it was them unless they, the manager of a bank, gives them the security codes for the bank's vaults, vs some kid getting them lunch money stolen.

[CHiLL]

Looks like they were hit on two fronts;

“In the opinion of the president of the UODO, such rules introduce unequal treatment of students and their unjustified differentiation, as they clearly favour students with biometric identification,”

I agree that the students shouldn't be treated unequally. We have some students and staff who refuse to use biometrics due to their religion, so they're issued a card instead.

Secondly;

While parental consent was obtained for the biometric ID program, the UODO found that the system was “not essential for achieving the goal of identifying a child’s entitlement to receive lunch.”

If that's the case, are all schools that fall within GDPR falling foul of this? Whilst it's true that fingerprints aren't essential of identifying whether a child is entitled to lunch, but it doesn't half speed up the process. What's the alternative? Dinner staff type the name of the child, identify them by their photo and then serve?

[GrumbleDook]

The article has some issues ... if nothing else they state that BA have been fined (they have had to notice of intent, so it has hoops to jump through and appeals and so on), and the headline is click bait.

 

Biometrics can be used but it has to be proportionate and also done legally.

 

In this case it was neither. That is a problem with the school, not the use of biometrics.

 

I’ll be putting out a more detailed article tonight.

[Bionic]

It's reported here too:

 

https://edpb.europa.eu/news/national-news/2020/fine-processing-students-fingerprints-imposed-school_en

 

 

This bit is a cause for concern for schools who use fingerprint readers:

 

"Moreover, in the authority’s view, the use of biometric data, considering the purpose for which they are processed, is significantly disproportionate."

[robyholmes]

Looks like they were hit on two fronts;

 

I agree that the students shouldn't be treated unequally. We have some students and staff who refuse to use biometrics due to their religion, so they're issued a card instead.

Secondly;

 

If that's the case, are all schools that fall within GDPR falling foul of this? Whilst it's true that fingerprints aren't essential of identifying whether a child is entitled to lunch, but it doesn't half speed up the process. What's the alternative? Dinner staff type the name of the child, identify them by their photo and then serve?

 

For us, we moved to mifare ID cards which we use for Cashless, Doors, Library and Printing. Removing the need to hold biometric data. Our kitchen staff said they can now process students much faster as pretty much everyone has a ID card and only has to tap it on the reader to pay. Rather than deal with students without permission entering pins or cleaning the readers to get it to read the thumbprint. Does mean manging lost ID cards but its manageable.

[localzuk]

If that's the case, are all schools that fall within GDPR falling foul of this? Whilst it's true that fingerprints aren't essential of identifying whether a child is entitled to lunch, but it doesn't half speed up the process. What's the alternative? Dinner staff type the name of the child, identify them by their photo and then serve?

That's the thing - there are other alternatives - we use RFID cards and PIN numbers. Personally I don't like the PIN number part, but I was overruled (it carries a risk of "unknown theft" that a physical object doesn't). Sure, we have to print new IDs pretty regularly, but the system generally works. Fingerprints aren't necessary.

[mavhc]

How much are RFID cards these days?

[mikeprice]

AT a school I worked in some years ago we introduced fingerprint readers for the canteen - some of the parents complained that we were treating the kids as criminals

(amusingly the police liason person commented that the people complaining were the ones where the police already had the parents' (and soemtimes the kids) fingerprints on files anyway!)

 

so we got the reader company in to talk to them - he explained that the system was totally different to the police type of systems and was far less accurate. Basically the actual fingerprint was not held on the system in any way. The images was used to generate a single, but big, number based on the patterns in the print and only this number was stored. It was impossible to go from this number back to teh fingerprint.

Also -although there was very little chance of 2 kids in the same school generating the same number it was not impossible - he actually commented that the systemn was fine for a single school - but if it was done with a single database for all schools in the country then they would expect duplicates.

Hence

a) if the police came long and asked for a print of a kids fingerprint we had no way of doing it - and it could not be generated from the system in any way

b) even if it could be done it was not good enough for anyone to use as evidence anyway

 

 

so - in reality you are not holding the actual biometirc data about anyone - just a number generated from the biometric - and that number is of low accuracy - and there is no real method that you could use the system to help the police (etc ) if they asked

 

whether or not it would be possible for the someone to take a fingerprint found at a crime scene and 3d print it into a finger shape - then put that into a school reader and get a positive match - dunno

[paulkerton]

I once had a nursery that wanted to put a door entry system in place that would allow parents to enter the building without being buzzed through the door using fingerprint.

 

I put the kibosh on that one pretty quickly, both from a security and a biometric security standpoint. I said we couldn't justify storing parent biometric data on the system simply because she didn't want to press a button to open the door.

 

You have to remember though that a judgement from the UODO may not be the same as one taken by the ICO. It'll be interesting to see if the ICO do take this up at some point though.

[robyholmes]

How much are RFID cards these days?

 

Around 50p for a Mifare classic card I would say, depends on the number your buying.

[localzuk]

How much are RFID cards these days?

You can get EM4100 cards for less than 20p a card.

[localzuk]

so - in reality you are not holding the actual biometirc data about anyone - just a number generated from the biometric - and that number is of low accuracy - and there is no real method that you could use the system to help the police (etc ) if they asked

The law disagrees with you I'm afraid. All data is stored as numbers. A photo on a computer? Just binary data. The output of a fingerprint reader? Binary data.

 

The Protection of Freedoms Act 2012 stipulates that fingerprint data can only be used in a school with consent from both the child and the parents. The definition of fingerprint data includes your long numbers.

[mavhc]

What about a hash of a photo?