School’s facial recognition tech blunder leads to ICO reprimand

A UK school that broke the law when it introduced facial recognition technology (FRT) has been reprimanded by the Information Commissioner’s Office (ICO), the country’s data privacy regulator.

Chelmer Valley High School in Chelmsford, Essex, first started using the technology in March last year to take cashless canteen payments from students.

However, seeing as facial recognition technology processes biometric data to identify people, and is likely to result in high data protection risks, it requires a data protection impact assessment (DPIA) for organisations to use it legally and responsibly.

The high school, which has around 1,200 pupils aged 11 to 18, failed to carry out a DPIA before starting to use the tech, meaning no prior assessment was made of the risks to the children’s information.

Further, the school hadn’t properly obtained clear permission to process the students’ biometric information; nor were the students given the opportunity to decide whether they did or didn’t want it used in this way.

The high school also failed to seek opinions from its data protection officer, or consult with parents and students before implementing the technology.

“Handling people’s information correctly in a school canteen environment is as important as the handling of the food itself,” said Lynne Currie, ICO head of privacy innovation.

“We expect all organisations to carry out the necessary assessments when deploying a new technology to mitigate any data protection risks and ensure their compliance with data protection laws.

“We’ve taken action against this school to show introducing measures such as FRT should not be taken lightly, particularly when it involves children.

“We don’t want this to deter other schools from embracing new technologies. But this must be done correctly with data protection at the forefront, championing trust, protecting children’s privacy and safeguarding their rights.”

Recommended reading

In March 2023, a letter was sent to parents with a slip for them to return if they did not want their child to participate in the facial recognition technology.

Affirmative “opt-in” consent wasn’t sought at this time, meaning until November 2023 the school was wrongly relying on assumed consent. The law doesn’t deem “opt-out” a valid form of consent and requires explicit permission.

The ICO’s reprimand has also noted that most students were old enough to provide their own consent, meaning parental opt-out deprived students of the ability to exercise their rights and freedoms.

“A DPIA is required by law – it’s not a tick-box exercise. It’s a vital tool that protects the rights of users, provides accountability and encourages organisations to think about data protection at the start of a project,” Currie added.

The data privacy regulator has provided the school with recommendations for the future.

Related