Huge advances have been made with facial recognition technology (FRT) in recent years and it is now used in multiple aspects of everyday life. 

It’s frequently used to verify the identity of employees, to unlock smartphones, to tag people on social media platforms, and, in some countries, for surveillance purposes.

The technology works, in essence, by matching the live image of a face that appears before the camera to a pre-taken image stored in a database and confirming they are the same. 

Facial recognition systems in schools?

While this may be acceptable when verifying you at passport control, say, the idea that it could be used in school to pay for school lunch is more controversial, raising issues of the privacy rights of children, more excessive surveillance and data protection.

This is exactly the maelstrom of issues that hit North Ayrshire Council in Scotland when it came to light that it was rolling out an FRT system called iPayimpact into nine secondary schools to allow students to pay for their meals by having their faces scanned.

At the time the council said all “facial registrations” were encrypted and so could not be used by another agency, and that when the student leaves school or opts out of the system, they will be deleted. It also said the new system was more Covid-secure than the card payments and fingerprint scanners they used previously and would help queues to move more quickly.

However, just days after the rollout of the technology began, the kickback started, with numerous issues raised by privacy groups and concerns being voiced on social media.

This led the Information Commissioner’s Office (ICO) to urge the council to consider a “less intrusive” approach.

In response, the rollout was soon halted, with a spokesperson for North Ayrshire Council telling Tes: “Having received a number of enquiries in recent days, we have temporarily paused the contactless payment system[...] while we consider and respond to the enquiries received.”

An uncomfortable idea 

It is perhaps no surprise the rollout had to be pulled - the idea of facial recognition technology in schools is just not something many are comfortable with.

In a 2019 study by the Ada Lovelace Institute, 67 per cent of respondents said they were uncomfortable about the use of the technology in schools, compared with 61 per cent who were uncomfortable about its use on public transport and 29 per cent about its use by police forces. 

Given this, it is not surprising that some say the idea of schools using biometric data should be ruled out entirely, such as Jen Persson, director of Defend Digital Me, a non-profit NGO that focuses on protecting children’s rights to privacy and data protection.

“Our message to schools is simple. Don’t use facial recognition or fingerprint tech in schools. Go biometric-free,” she tells Tes.

“Schools have a duty of care not to prioritise convenience. Schools should not normalise children’s experience of offering their bodies for use in financial transactions.”

Big Brother Watch, a non-profit, non-political party British civil liberties and privacy campaigning organisation, takes a similar stance: ‘No child should have to go through border-style identity checks just to get a school meal. We are supposed to live in a democracy, not a security state,” says Silkie Carlo, director of BBW. 

“This is highly sensitive, personal data that children should be taught to protect, not to give away on a whim.”  

The need for legal action?

This discussion has now, due to the North Ayrshire incident, reached some powerful places, with a debate in the House of Lords on 4 November relaying these concerns - including a notable remark by Lord Scriven saying that legislation on the issue is needed for the education sector.

“If we leave it to individual schools, the unintended consequences and problems that will arise will be not just technical but deeply ethical and societal. There must be a balanced debate within this Parliament and legislation must be brought forward,” he said. 

However, the move to bring in such legislation to cover this and give schools more guidance on if, and how, they can use FRT systems is likely to be a long time coming.

So where does this leave schools that may still, despite the fallout seen by North Aryshire, want to consider using FRT technology?

Data protection and privacy

Central to the use of any biometric technology are data protection and privacy considerations, as Hannah Sterry, solicitor for legal firm Stone King and part of its information law team, explains.

“FRT involves processing personal data, so schools must consider their obligations under data protection law or risk regulatory action,” she says.

The first of these regulations that schools must consider is the Data Protection Act 2018, which mandates that organisations carry out a Data Protection Impact Assessment (DPIA) for any data processing project that is likely to result in a high risk to individuals. 

Within this, you must describe the nature, scope, context and purposes of the processing; assess necessity, proportionality and compliance measures; identify and assess risks to individuals; and identify any additional measures to mitigate those risks.

“Schools must ensure processing of biometric data using FRT complies with the data protection principles, including the need for processing to be lawful, fair and transparent, and to not go beyond what is necessary,” Sterry adds. 

“FRT is high-risk, so schools must undertake a DPIA to assess proportionality and whether risks can be mitigated. This can be complex, and failure to carry out a DPIA may result in action being taken by the ICO.”

While North Ayrshire Council completed a DPIA before its now-halted rollout of facial recognition technology, BBW and Defend Digital Me claim the project remained in contravention of data protection law because it failed to demonstrate that the processing of special category data is “necessary or proportionate”.

What’s more, although Britain is set to move from the GDPR to its own post-Brexit data regime, for the moment it remains signed up to the European rules, so this is more regulation that schools will need to consider before rolling out facial recognition technology. 

The financial cost of getting it wrong

Under GDPR, data collected by FRT is classified as biometric data, which is special-category data that requires that the data subject has given explicit consent to the personal data processing, or that the processing is necessary for reasons of significant public interest.

This is a high bar to pass - and get it wrong and there can be major consequences, as two French schools and a school in Sweden found out in 2019 when they were fined by their national data protection authorities after implementing facial recognition tech to keep track of students’ attendance and control entry access. 

Sterry says the fines underline how seriously data protection authorities take these issues: “The authority found this use of FRT violated data protection law as FRT was a disproportionate measure to track attendance and the school did not carry out a DPIA.

“The Swedish case also highlighted issues with ‘consent’ as a legal basis due to the imbalance of power between pupils and their school.”

She adds that the ICO’s response to the North Ayrshire’s rollout, in which it urged an alternative, less intrusive approach to be taken if the same goal can be achieved, suggests that it, too, could take a strict approach.

“It seems likely that a similar approach may be followed in the UK towards schools that do not properly consider data protection law.”

North Ayrshire Council tells Tes that it did follow the ICO’s GDPR guidance, ensuring that students in S4-S6 were allowed to provide their own consent while those in S1-S3 required parental consent. 

It added that prior to the halting of the FRT rollout, 97 per cent of children or their parents had consented to the new system.

What is true consent?

However, according to Carlo, the example of the school in Sweden shows that “consent” is not enough, as the inherent power dynamic in the school environment means that claiming you have achieved true consent under GDPR could be up for debate. 

Similarly, Claire Hall, a data protection specialist with law firm VWV’s school’s team, says schools have to be transparent about the data they are collecting and how the biometrics system works, as otherwise any claims of consent may not hold up if pupils or parents say the true reality of the system was not adequately explained.

“Schools should absolutely make sure they’re being transparent with their pupils and their parents,” she tells Tes. “You would normally do that while obtaining consent, but they should think about putting it in their privacy notice as well.”

And on top of all this, Will Richmond-Coggan, privacy and surveillance lawyer at national law firm Freeths, tells Tes that there is also a moral issue for schools to consider if they are planning on using biometric tools.

“[It risks] normalising intrusive surveillance at a young age, which might make those individuals less protective of their rights to privacy as they grow up and move into the wider world. Such risks need to be weighed against the benefits in deciding whether or not to proceed,” he says.

Given all this, it may make you wonder why schools would want to deal with the legal headaches and risks that could come with FRT or other biometric technologies.

The case for FRT

However, there are those who believe that, despite these concerns, the benefits are worth it. One of those advocates is James Browning, chief information and digital officer at Academies Enterprise Trust. 

He says facial recognition in a school setting could, if done right, have a positive impact on some real and current challenges in school - and not just paying for lunch. 

“Use on building entrances to manage authorisation to enter could help reassure and tighten controls that all schools need to put in place to safeguard their students,” he tells Tes. 

“Furthermore, if it was added to CCTV, it could help with the management of in-school incidents. Similarly, use of facial recognition on entry to classrooms could speed up lesson registration by automatically registering and sharing this data with the school’s MIS - a process that when manually recorded often eats into valuable time that would be otherwise spent teaching.”

Another who thinks like this is Al Kingsley. He’s the group CEO at a tech firm called NetSupport but also serves as the chair of two multi-academy trusts and a member of the regional schools commissioner’s headteachers’ board for the East of England and North-East London.

“Some people will say facial recognition in schools is a step too far. However, it comes down to context, because we’re all quite happy to use our faces to access our smartphones, without questioning where that information may go,” he tells Tes. 

“Operationally, facial recognition can make life easier in a school and provide security for students - eg, when they need to identify themselves on school grounds or for cashless catering, which can be really positive.” 

Tom Lawson, headmaster at Eastbourne College, takes things a step further still, claiming that the privacy concerns surrounding the technology have been somewhat overblown and the education sector is missing out on the benefits FRT could offer.

“That the ICO describes facial recognition as intrusive is a red herring. Far too often, rules about data protection and privacy - which are rightly imposed on the private sector seeking to profit from our personal information - are applied to schools, who intend only to use data to safeguard and support children,” he tells Tes.

“Schools are used to handling sensitive data carefully in accordance with the law and maintaining privacy.”

That said, the college is “not actively considering facial recognition technology” at present, but Lawson says that it would not be afraid to implement it if it was the best tool for the job - but only after any privacy and safety issues had been “thoroughly examined”.

There may be others who agree and are keen to consider how FRT or other biometrics technologies could play a part in their school to save time, money and effort in their operations. And perhaps if the law does move to give schools more clarity on this, others, too, may become more open to its implementation.

But given the pushback against North Ayrshire’s rollout, it is clear that for now, society is perhaps not quite ready for pupils to submit to facial scanning systems in the classroom, school gates or lunch queues.

Carly Page is a freelance journalist