- A school in the UK has been formally warned by the data protection regulator for using facial-recognition technology to process facial scans without the explicit consent of students.
- The incident sparks discussion about privacy and data protection issues surrounding the use of biometric data in educational settings, especially when children are involved.
OUR TAKE
Chelmer Valley High School has been given a formal warning by the data protection regulator for using facial-recognition technology without a data protection impact assessment (DPIA) and without students’ clear agreement. This incident highlights the importance of strict compliance with data protection regulations when using biometrics in educational institutions, especially when children’s privacy and data security are taken into account.
-Rae Li, BTW media
What happened
Chelmer Valley High School began using facial-recognition technology for cashless lunch payments in March 2023 without a DPIA although it has been using fingerprint recognition since 2016. The school submitted its DPIA to the Information Commissioner’s Office (ICO) in January this year, almost a year after introducing the technology. However, the ICO noted that the school had failed to complete the assessment before introducing biometrics.
In addition, this high school failed to obtain explicit consent for a student’s face scan. The school had sent notice to parents that unless students made it clear they did not want to participate, they would automatically be included in the program. This is in breach of the General Data Protection Regulation (GDPR) which requires clear positive action as a condition of consent. Thud, Chelmer Valley High School has received an official warning from the ICO for failing to comply with data protection regulations.
Also read: Detroit Police Department agrees to limit facial recognition tech
Why it’s important
The use of facial-recognition technology has sparked a broad discussion about personal privacy, data security and consent rights, especially in sensitive environments like schools. This incident highlights the need for strict compliance with data protection regulations when adopting new technologies to ensure that children’s privacy and rights are respected and protected.
Also, this incident emphasises the role of regulators in ensuring that the use of technology complies with legal and ethical standards. The intervention and warning by the ICO shows that in the case of breaches of data protection regulations, the regulator will take action to safeguard the public interest and the integrity of data protection.
