A school has been reprimanded by the data protection regulator after using facial recognition technology to take cashless payments from students at its canteen.
The Information Commissioner’s Office (ICO) said the case showed that schools must keep data privacy at the front of their minds when introducing this type of technology.
Chelmer Valley High School, in Chelmsford, Essex, broke the law when it “failed” to complete a data protection impact assessment (DPIA) before starting to use the technology, the ICO said today.
The secondary school, which has around 1,200 students, had not properly obtained clear permission to process the children’s biometric data, and students were unable to “exercise their rights and freedoms”, the commissioner’s office said.
“We’ve taken action against this school to show introducing measures such as facial recognition technology (FRT) should not be taken lightly, particularly when it involves children,” the ICO said in a statement today.
Facial recognition technology and data privacy
While the watchdog said that it does not want to “deter other schools from embracing new technologies”, it warned that this must be “done correctly with data protection at the forefront, championing trust, protecting children’s privacy and safeguarding their rights”.
In March last year Chelmer Valley High School began using facial recognition technology to take cashless payments in its canteen, before an assessment was made of the risks to the children’s information.
Lynne Currie, head of privacy innovation at the ICO, said: “Handling people’s information correctly in a school canteen environment is as important as the handling of the food itself.
“We expect all organisations to carry out the necessary assessments when deploying a new technology to mitigate any data protection risks and ensure their compliance with data protection laws.”
The data watchdog also found that Chelmer Valley High School failed to seek opinions from its data protection officer, or consult with parents and students, before implementing the technology.
In March last year a letter was sent to parents with a slip for them to return if they did not want their child to participate in use of facial recognition technology, the ICO said.
Until November last year, the ICO warned, the school had been wrongly relying on “assumed consent” for facial recognition - except where parents or carers had opted children out of the system.
The data protection regulator also noted that most students would have been old enough to provide their own consent, so the parental opt-out deprived students of the ability to exercise their rights.
Lawfully managing consent
The ICO reprimand said: “Chelmer Valley High School has therefore failed to complete a DPIA where they were legally required to do so.
“This failing meant that no prior assessment was made of the risks to data subjects, no consideration was given to lawfully managing consent, and students at the school were then left unable to properly exercise their rights and freedoms.”
The school provided a DPIA to the data watchdog in January this year, and it begun obtaining explicit opt-in consent from students in November last year.
Ms Currie added: “A DPIA is required by law - it’s not a tick-box exercise.
“It’s a vital tool that protects the rights of users, provides accountability and encourages organisations to think about data protection at the start of a project.”
The reprimand comes after the ICO told North Ayrshire Council last year that its use of facial recognition technology to take canteen payments in nine schools was “likely” to have infringed data protection law.
Concerns were raised when the technology was introduced in North Ayrshire schools in 2021 as part of a replacement of its existing cashless catering system.
Chelmer Valley High School has been approached for comment.
For the latest education news and analysis delivered directly to your inbox every weekday morning, sign up to the Tes Daily newsletter
