British School Criticized for Illegal Employment of Facial Recognition Tech

A British educational institution received a formal warning from the U.K.’s guardian of data privacy for implementing facial recognition technology without acquiring explicit consent from the students to process their facial images.

This incident reignites the debate over privacy concerning the use of biometric data, especially in educational environments with children involved. Following suit with New York’s prohibition of facial recognition in schools last year, the first of such measures in the U.S., sparked by increased marketing efforts by AI firms touting enhanced security for educational facilities.

While fingerprint identification has long been a staple in British schools for identity verification and access purposes, the adoption of facial recognition technology has seen a rise, spurred on by the need for contactless solutions during the pandemic. Facial recognition for cafeteria payments has been in use at some schools for over four years, leading to the Information Commissioner’s Office (ICO) of the U.K. stepping in when Scottish schools began adopting the technology in 2021.

Now, after several years, the ICO finds itself addressing a similar situation. Chelmer Valley High School, located in Chelmsford, Essex, rolled out a facial recognition system in March 2023 for cashless meal transactions, with fingerprint systems in use since 2016. This system was deployed by CRB Cunninghams.

Although utilization of such technology by schools is not forbidden, it mandates a thorough data protection impact assessment (DPIA), which Chelmer Valley High School neglected to conduct before the introduction of the facial recognition system. The school later submitted a DPIA to the ICO in January, nearly one year post-implementation.

Additionally, the ICO pointed out the school’s failure to secure “explicit consent” for processing the students’ facial scans. A letter was sent to parents about the technology’s usage, framing it within an opt-out arrangement—if a refusal form was not returned, consent was presumed. This approach contradicts Article 4(11) of the U.K. GDPR, which demands a “clear affirmative action” for consent.

Furthermore, the U.K. GDPR asserts that children aged 13 and above are capable of consenting to data processing, indicating that a significant portion of the school’s student body could not adequately “exercise their rights and freedoms.”

“The proper handling of personal information in a school cafeteria is just as critical as food safety,” remarked Lynne Currie, the head of privacy innovation at the ICO, in a press release. “We require all entities to undertake the necessary evaluations when adopting novel technologies to mitigate data protection risks and affirm their compliance with the law.”

Noteworthy is the ICO’s capability to levy hefty fines for data privacy breaches, exemplified by Clearview AI’s $10 million penalty for multiple violations. However, the ICO opts for a cautionary stance towards public educational institutions, displaying leniency through a public reprimand in this scenario—highlighting it as the school’s initial violation.

“We initiated action against this educational establishment to emphasize that the integration of technologies like Facial Recognition Technology (FRT) must be approached with seriousness, especially concerning children,” Currie further stated. “We encourage other schools to explore innovative technologies, provided they do so with data protection as a priority, thereby fostering trust, protecting the privacy of children, and safeguarding their rights.”

Inquiries have been put forward to Chelmer Valley High School by TechCrunch for their comments, and updates will be provided upon their response.