UK School Faces Privacy Law Breach Over Unauthorized Facial Tech Rollout

Published Date: 23/07/2024

Chelmer Valley High School in Chelmsford used facial recognition technology in its canteen without conducting a prior assessment of risks to children's information, infringing data protection law.

"The UK's privacy watchdog, the Information Commissioner's Office (ICO), has reprimanded Chelmer Valley High School in Chelmsford for violating data protection law by implementing facial recognition technology in its canteen without proper consent. The school, which has 1,200 students, started using the technology in March 2023 to take cashless payments from students. However, the ICO found that the school failed to carry out a prior assessment of the risks to the children's information and infringed data protection law.

The ICO stated that the school did not consult with parents and students fully before implementing the technology. A letter was sent to parents in March 2023 with a slip for them to return if they did not want their child to participate, but there was no option to give consent to the scheme. This meant that the school was wrongly relying on assumed approval until November 2023.

The ICO also found that most students were old enough to provide their own consent, but the parental opt-out deprived students of the ability to exercise their rights and freedoms. The school was told it must improve how it used data protection impact assessments and was given a set of recommendations.

Facial recognition technology is still uncommon in schools, although fingerprint-based payment systems are widespread. In 2021, the ICO advised schools using facial recognition systems to consider less intrusive ways to let pupils pay for meals. The ICO's remarks followed a decision by a number of schools in North Ayrshire to introduce the tech, but they subsequently paused their plans.

Lynne Currie, head of privacy innovation at the ICO, emphasized that introducing facial recognition technology is a decision that should not be taken lightly. 'Handling people’s information correctly in a school canteen environment is as important as the handling of the food itself,' she said. 'We expect all organisations to carry out the necessary assessments when deploying a new technology to mitigate any data protection risks and ensure their compliance with data protection laws.'

  Information 

Chelmer Valley High School is a secondary school in Chelmsford, Essex, with over 1,200 students. The Information Commissioner's Office (ICO) is the UK's privacy watchdog, responsible for enforcing data protection laws.

The Information Commissioner's Office (ICO) is an independent authority set up to uphold information rights in the public interest, promoting openness by public bodies and data privacy for individuals."

FAQs:

"Q: What technology did Chelmer Valley High School use in its canteen?

A: Facial recognition technology

Q: What law did the school infringe by implementing facial recognition technology?

A: Data protection law

Q: Why did the ICO reprimand the school?

A: The school failed to conduct a prior assessment of risks to children's information and infringed data protection law.

Q: What did the ICO advise schools using facial recognition systems to do in 2021?

A: Consider less intrusive ways to let pupils pay for meals

Q: What is the role of the Information Commissioner's Office (ICO)?

A: To enforce data protection laws and promote openness by public bodies and data privacy for individuals"

Biometric Products & Solutions

BioEnable offers a wide range of cutting-edge biometric products and solutions: