UK schools start scanning children's faces to take their lunch money

[enjay]

Quite, but then GDPR would also apply to the border force too. It's still personal information contained about you and me.

 

Yes, but "national security" is a weightier justification for processing than "it is quicker, and saves us replacing biometric readers every year".

[Michael]

So it's OK to have an encrypted database of fingerprints, but not an encrypted database of facial recognition for a school? Why? And given 97% of parents/carers gave consent, they knew what it was being used for.

 

Legacy and cloud MIS solutions have pictures of children associated with their user profile. Is an MIS any more secure than a catering solution?

 

I guess it depends if we're talking about the level of encryptions used and/or whether it's suitable full stop for a school altogether?

 

I'm pretty sure they'll be a GDPR 2.0 at some point.

[paulkerton]

So it's OK to have an encrypted database of fingerprints, but not an encrypted database of facial recognition for a school? Why? And given 97% of parents/carers gave consent, they knew what it was being used for.

Yes. logically you're correct.

However, there are differences because at the moment, there isn't any technology that would see a person walking down the street and scanning their hand and identifying them on the fly from their fingerprints on CCTV.

[enjay]

So it's OK to have an encrypted database of fingerprints, but not an encrypted database of facial recognition for a school?.

 

I didn't say that. As with anything GDPR, it isn't about a list of what is or isn't okay, it is about why you are doing it. So ask yourself "why are you doing it?", "can it be done another way without the data?", "how is the data stored/processed/accessed?" and "what will we do for people who don't consent?". We can justify a database of fingerprints, can we also justify a database of faces? If you can, then crack on with your facial recognition for lunch money.

 

You also want to look at the practicalities. How often will photos need updating as the children age? When a child changes their hair colour/style, how will you update the photo? What will you do for children who haven't consented or don't get recognised? How quickly can the camera recognise the child, and how does that compare to scanning fingers? If phone unlocking is anything to go by, fingers are much quicker!

[Michael]

@paulkerton - Technologies scanning hands on the fly, not that I know of, but the military can probably read a newspaper from space. If it's not possible yet, it might be soon.

@enjay - So it's not the encryption, more so the application purpose you're raising? I guess this is why we have consent procedures, but it'll be interesting to see how this pans out.

[jthompson]

I suspect that this story will have more of an ick factor for people who dont' work in a school IT department. People who might see a school canteen system's ability to perform face recognition to charge the correct pre-paid school lunch account as a wider capability of the school's entire IT, such that CCTV, registers, Internet-connected classroom computers, etc. are all in posession of equivalent powers.

 

Another argument is that it adds to the normalisation for young people of a surveilance society, but I think CCTV has being doing quite a few years of heavy lifting on that front already. That seems to have gone from a site security measure to an everyday pupil supervision aid.

[mavhc]

Right, if you don't want to be face tracked by multiple companies and government departments, don't go outside your own house, or near the window.

 

Can you do the same "hash that's unusable on another system" argument you can do with fingerprint scanners though?

 

You can't read a newspaper from space, the atmosphere is too dynamic, that's why we have space telescopes, and aerial photography.

[GrumbleDook]

It has been so interesting reading all the different news articles, political commentaries, analysis by privacy professionals and rants by a few individuals.

I’ve tried to keep a balanced approach to this (yay for fence sitting!) and usually just try to clarify how schools work, why this could have such a positive impact for the school and individuals, and to point people to the relevant legislation, especially about consent and competence.

Most of this thread has shown so much good discussion, done in an open and friendly manner. One of the reasons why this is still a favourite place for me.

 

I only have a few bits to add to this discussion. Most have been said in similar discussions about biometrics in the past, or have been directly mentioned.

 

We know the Protection of Freedoms Act is a principle piece of legislation for biometrics in schools, and we know the emphasis on communication about the use of FR has to also explain the alternatives that can be used. It is really hard to use consent/explicit consent and the art. 6 and art. 9 lawful bases due to the imbalance of power that the school has, but this is the only option. This is why the use of biometrics is tricky. But this discussion has been had so many times.

 

The main change is the intrusiveness. There are other changes but that one is the first.

 

Is a check against somebody’s face for their ID intrusive? In itself, no. We do it on a regular basis, many schools have ID card that can be checked and we know how this is used to ensure the right children be access to their money to pay for food, whether that money comes in as payment from family or as part of FSM. We know cashless catering is used to reduce bullying, remove stigma against FSM and to try to help make sure disadvantaged children get a solid meal, possibly the only one they might have that day.

 

But this is not asking a human to check a card against a person. This is a computer checking a face against an image in the database.

 

The DPIA for this is available from the relevant Scottish council, and it is clear that these areas have been considered but the benefits to the individuals are significant enough (at the point the DPIA was done) that it could go ahead, but whether the work on communication with the families was enough is one of the areas being questioned.

 

The other thing to discuss has to be normalisation to intrusive use of personal data. That has to be a discussion point at the very beginning of looking at this.

 

I’m not going to say it is or isn’t. I will say that consideration for your community is a must as it does affect groups differently.

 

I would also recommend looking at the work of the Digital Futures Commission and the Children’s Rights Impact Assessment.

 

But most of all, it makes me so happy to see a strong and open discussion on EG about all this. Well done to you all.