DfE/PFA 2012: "Parents given power of veto on schools’ use of biometric information"

[PiqueABoo]

DfE have finally pulled their fingers out and said something (two weeks after Protection of Freedoms Act 2012 gained royal assent):

 

Parents given power of veto on schools

 

There is a link to consultation docs at the bottom of the page - this is about the DfE's draft advice (Annex A).

[glennda]

Its all well and good doing that but Biometric helps schools so much with making things easier!

 

Although when we rolled out ours we gave parents advanced warning on the system three kids parents (out of 1600 kids) complained about the use of the system and where issues swipe cards. Although we clearly stated that we didn't actually store a copy of the fingerprint we stored a digtal signature of it they didn't like that.

 

One parent allowed the finger to be scanned after the third time of her daughter loosing her card and being sent another bill for a fiver to get a new one

[PiqueABoo]

Its all well and good doing that but Biometric helps schools so much with making things easier!

 

Sorry, you missed the chance to have that argument. PFA 2012 is the new law and you'll need to be respecting it by 1st Sep 2013 (which is when it takes effect).

 

There's also CCTV guidance that will eventually be made via PFA2012.

 

Big Brother Watch are busy FOIing schools about use of both biometrics and CCTV right now.

[elsiegee40]

Which is what this FoI currently circulating schools is about : http://www.edugeek.net/forums/behind-red-door/95133-big-brother-watch.html

[glennda]

Sorry, you missed the chance to have that argument. PFA 2012 is the new law and you'll need to be respecting it by 1st Sep 2013 (which is when it takes effect).

 

There's also CCTV guidance that will eventually be made via PFA2012.

 

Big Brother Watch are busy FOIing schools about use of both biometrics and CCTV right now.

 

I don't mind about not having my Say. Already been there and done that and left education! But these people are probably the ones that would moan about peoples time being wasted doing pointless admin tasks...

[PiqueABoo]

Which is what this FoI currently circulating schools is about

 

Hadn't seen that thread but it's at a tangent to what matters. Having satisfied FoI law, if a school has biometrics I then suggest [you|whoever] reads that draft DfE guidance and if necessary send them a response.

[GrumbleDook]

 

Hadn't seen that thread but it's at a tangent to what matters. Having satisfied FoI law, if a school has biometrics I then suggest [you|whoever] reads that draft DfE guidance and if necessary send them a response.

 

The guidance is good for schools, but I think that there are a large number of questions to ask biometric providers... Especially around retention of selected data (eg keep the activity history but not the biometric information).

[glennda]

The guidance is good for schools, but I think that there are a large number of questions to ask biometric providers... Especially around retention of selected data (eg keep the activity history but not the biometric information).

 

But one of the main Biometric providers (biostore) don't actually store any biometric information, they store a mathmatical representation of the finger print. So is that technically classed as storing biometrics? as at the end of the day its just a number

 

Does Biostore record images of fingers?

 

No. It is the policy of Biostore never to store images of fingers anywhere on their system. Only mathematical representations of certain points of interest are recorded, typically between ten and forty depending on the characteristics of the finger. This information is encrypted and is called a template. This data is extremely secure in its encrypted form but even if it were not encrypted it is impossible to recreate the original image of the finger from this data.

[GrumbleDook]

If the stored string is used to compare against a string generated by a 'reader' then yes, it is biometric information. The consultation documents do clearly cover what is meant by biometric data. If Biostore or others disagree then they should get involved in the consultation ... But it is likely to be too late as the act is pretty clear.

[glennda]

If the stored string is used to compare against a string generated by a 'reader' then yes, it is biometric information. The consultation documents do clearly cover what is meant by biometric data. If Biostore or others disagree then they should get involved in the consultation ... But it is likely to be too late as the act is pretty clear.

 

fair enough - TBH i don't see a problem with storing my biometrics on that system - I left and i couldn't care less whether it gets deleted. They can't A: reverse it and B: use it in a court of law.

[PiqueABoo]

But one of the main Biometric providers (biostore) don't actually store any biometric information, they store a mathmatical representation of the finger print. So is that technically classed as storing biometrics? as at the end of the day its just a number

 

I guess you didn't read my dismissal of the same claim you made in the thread at the weekend when I said that is what they more or less all do and very definitely is "biometric information" according to PFA 2012.

[glennda]

I guess you didn't read my dismissal of the same claim you made in the thread at the weekend when I said that is what they more or less all do and very definitely is "biometric information" according to PFA 2012.

 

No I was in a pub and most probably ignored it (as i never read it/might of been touch drunk). But i do agree with the person below your comment saying that the law is rather stupid. i would be most Pi**ed off at the police for keeping your records even though you havn't done anything (like they have with me). A non reversible number is pointless including.

 

According to that - saying somebody is 5ft 10" with brown hair a missing a finger is biometric information - you could easily pick somebody out from having that information (as the police do in a similar fashion with there line ups).

 

The biostore doesn't match it exactly

[PiqueABoo]

The biostore doesn't match it exactly

 

Simply not true and Biostore happens to be where I got some of the information we weren't getting from the DfE - they certainly know users of their fingerprint-based systems will be subject to PFA 2012 on 1st Sep 2013. You'll find an article about it on their news page.

[glennda]

Simply not true and Biostore happens to be where I got some of the information we weren't getting from the DfE - they certainly know users of their fingerprint-based systems will be subject to PFA 2012 on 1st Sep 2013. You'll find an article about it on their news page.

 

They may well still be applicable because as mentioned above the law has stupid clauses (which i have not said they won't at any point I just said I didn't agree with it)

 

and Biostore does not match it exactly - it matches it to be close enough so that the likely hood of two children having the same rough pattern is minimal

 

I will however withdraw this comment

 

According to that - saying somebody is 5ft 10" with brown hair a missing a finger is biometric information - you could easily pick somebody out from having that information (as the police do in a similar fashion with there line ups).

 

as having re-read the quote as I previously missed reading the "and" from the end of 2 A.

[GrumbleDook]

The reason why PFA2012 is written / structure in the way that it is really does make sure that the digital nature of storage of identifying personal information is dealt with. The store itself does not have to be an exact duplicate of the real world data, or even be directly extractable to form a duplicate to the real world data, but can simply be used in a matching / comparison process ... because that is how the technology tends to work.

 

Biostore are well and truly covered.

 

I do have queries about social networking sites which include facial recognition ... because the guidance which is under consultation does make it clear that although the school itself might not be running the technology / system locally but if they provide a solution or insist a child uses a solution which holds biometric information then it is covered under the act.

 

This will be one of my questions under the consultation but I just need to work out the wording properly.

[localzuk]

I understand the law here and accept it, but at the same time I hope the government is willing to accept a drop in the number of children having school meals due to increased time queuing to be served - as schools won't have the money to install more tills to process the kids going through, whilst also complying with the healthy schools initiative and related things. The knock on effect of this is not as simple as just issuing a card to kids - it has a significant knock on effect that I have seen first hand when switching from fingerprinting (due to it simply not working well with the kids fingers in our school) to a card based system.

 

However, at the same time, when we implemented it at that school, we sent out a letter to all parents outlining the system, how it worked, and asked for anyone who didn't like it to contact us and alternative provision would be put in place for their child. We had a total of 2 parents contact us.

 

We also updated the data checking sheet to include a section for accepting the use of biometric data - no-one said no there either for new students.

 

This law is a reaction to a problem that doesn't exist.

[glennda]

I agree with @localzuk the only reason my previous school had the time and funding to be able to increase the quality/goodness of food was by implementing cashless catering - it means all the reports are done automatically and saves time/money which can be better spent on other things.

 

The government needs to stop wasting money on pointless laws and actually look at the positives these things bring rather then the negatives... or is it just me that thinks this?

[GrumbleDook]

Alternative solutions can still also be time saving technologies such as cards containing smart chips / RFID chips ... which have been around for some time. The down side is that the initial cost of these cards have to be carried by the school and there is the risk that families of children who lose their card will not pay for replacements.

 

The refusal to use biometric data has been round for some time and is already dealt with quite well by some schools.

[localzuk]

Alternative solutions can still also be time saving technologies such as cards containing smart chips / RFID chips ... which have been around for some time. The down side is that the initial cost of these cards have to be carried by the school and there is the risk that families of children who lose their card will not pay for replacements.

 

The refusal to use biometric data has been round for some time and is already dealt with quite well by some schools.

 

The alternatives are not actually effective. They result in a *lot* of hassle at tills when kids have lost, broken or forgotten their cards. I designed and maintain a cashless system in one school, and support one in this school - and the outcome is the same at both. Cards are a pain and waste a significant amount of time.

 

So the end result, as I said, is longer queuing time, and in my experience this has a direct relationship with the number of kids skipping lunch altogether as they'd rather be out playing than queuing.

[glennda]

Alternative solutions can still also be time saving technologies such as cards containing smart chips / RFID chips ... which have been around for some time. The down side is that the initial cost of these cards have to be carried by the school and there is the risk that families of children who lose their card will not pay for replacements.

 

The refusal to use biometric data has been round for some time and is already dealt with quite well by some schools.

 

yes but as you mention they lose cards - my previous school used cards and it was terrible (although as it was pfi the catering system wasn't linked to sims for images which helps). As i previously mentioned the actual refusal rate was 1 in 533 (3 children in 1600). So on those odds the government is padering to such a small minority (roughly 5000 from over 3 million)

 

If they start doing that they may as well take the BNP seriously....

Edited May 15, 2012 by glennda

[GrumbleDook]

The alternatives are not actually effective. They result in a *lot* of hassle at tills when kids have lost, broken or forgotten their cards. I designed and maintain a cashless system in one school, and support one in this school - and the outcome is the same at both. Cards are a pain and waste a significant amount of time.

 

So the end result, as I said, is longer queuing time, and in my experience this has a direct relationship with the number of kids skipping lunch altogether as they'd rather be out playing than queuing.

 

And I've worked in a school with card-based cashless catering which was as quick as biometric offerings, and seen a number of schools who use a mixed approach with no difference. Stopping the loss of cards and getting a good response from parents and children around this is down to behaviour modification and not the fault of the chosen technology. It is worth mentioning because you have to deal with it, but it should not be a reason to ignore it as an option (which some other schools might do).

 

@glennda There are many reasons why people refuse to use biometric systems, some for personal reasons, some medical and some due to faith. To say that we are pandering to the requirements of these ... well that is not really fair ... you might only have 2 vegetarians in the school ... you would still support them in their choice nd the choice of their family.

[PiqueABoo]

I do have queries about social networking sites which include facial recognition ... because the guidance which is under consultation does make it clear that although the school itself might not be running the technology / system locally but if they provide a solution or insist a child uses a solution which holds biometric information then it is covered under the act.

 

Not entirely sure what the query is but from Hansard (Lords): I know that my noble friend is concerned that these provisions should not apply when pupils access commercial websites or software systems that use face recognition to control access. I can give reassurance to my noble friend that the provisions in Clause 26 cover only the processing of biometric information that is carried out by, or on behalf of, the school or college.

[GrumbleDook]

Not entirely sure what the query is but from Hansard (Lords): I know that my noble friend is concerned that these provisions should not apply when pupils access commercial websites or software systems that use face recognition to control access. I can give reassurance to my noble friend that the provisions in Clause 26 cover only the processing of biometric information that is carried out by, or on behalf of, the school or college.

 

And this is where the law gets really murky ... if you are asking a child to use a system which contains facial recognition as part of the functionality (i.e. not to control access) then is it being done on behalf of the school? The answer does not cover this scenario yet it is a real life situation ... and so we get into instructing children to possibly turn off this feature (which they are bound to follow ... of course) ...

 

If another child in the school uploads a picture containing them and classmates ... and the system automagically suggests the names of students to be tagged against it? This is processing data based on facial recognition ... would this be something that has to be dealt with under the act?

 

If you instruct a child to use something (sports equipment, VLE, etc) and some harm happens as a result then there is a certain amount of liability which the school has to take (get full legal advice for a fuller covering of this ... the word 'murky' really jumps out here) ... and does this apply to the act as well?

[PiqueABoo]

This law is a reaction to a problem that doesn't exist.

 

Depends on how you perceive the law - it's not saying biometrics in schools is unconditionally evil, the "problem" is consent, failures to inform and obtain consent, mixed in with human rights, child rights and so on.

 

Quoting numbers about how many folk don't give consent is only part of it, what you can't tell me is how many people gave consent but would have been seriously put out if you hadn't asked for consent. Sprogette is my (Primary age) child and although the stream of consent forms is a pain at times and I've yet to say no, I definitely do want to see and sign some of them.

[PiqueABoo]

And this is where the law gets really murky ... if you are asking a child to use a system which contains facial recognition as part of the functionality (i.e. not to control access) then is it being done on behalf of the school?

 

"On behalf of the school" means speaking or acting for the school and I think that would include teacher instructing kid to use a biometric wotsit in any scenario.

 

If another child in the school uploads a picture containing them and classmates ... and the system automagically suggests the names of students to be tagged against it? This is processing data based on facial recognition ... would this be something that has to be dealt with under the act?

 

If kid does it of their own volition then probably not.