From the verification of employee’s identities at work and ubiquitous CCTV and traffic cameras, to unlocking smartphones and tagging your friends in photos on social media, Facial Recognition Technology (FRT for short) is everywhere. Some would say that the Big Brother-esque society that was once a futuristic pipedream is fast becoming our reality.
It’s easy to get swept up in the excitement and potential of new technologies–indeed, when managed lawfully, FRT can offer many benefits to the education sector. Nonetheless, processing biometric personal data should never be taken lightly. The ICO agrees;
“As the data protection regulator, we want to ensure that educational authorities can access the benefits of new and emerging technologies, whilst also protecting children’s data and safeguarding their rights.”
The ICO recently issued a letter to North Ayrshire Council (NAC), addressing the utilisation of Facial Recognition Technology (FRT) as a tool to implement a ‘cashless catering’ initiative in school canteens.
North Ayrshire Council first captured the ICO’s attention in October 2021, following their introduction of FRT into nine schools. The council told the ICO that it had paused the use of the technology at the end of October 2021 after concerns were raised, and by the middle of November all data had been deleted. The ICO issued a letter to the council earlier this month listing its findings of the review, saying it was “concerned that the technology had been deployed in a manner that is likely to have infringed data protection law”.
The situation with North Ayrshire Council begs the question, does Facial Recognition Technology have a place in our schools? Could North Ayrshire Council have implemented it differently or is facial recognition technology inappropriate for schools, as a blanket rule?
How does Facial Recognition Technology Work?
FRT algorithms analyse recorded images of individuals–provided by CCTV cameras–to scan for distinguishable facial features, for example the distance between your eyes or the tip of your nose. These distinguishable features enable FRT to create ‘a unique biometric data record of an individual and match them against a database’. Thus, the system recognises key information about the individual, such as gender or identity. While the capabilities of such technology are undoubtedly helpful for passport patrol, when it comes to schools most people consider the use of FRT excessive and intrusive.
The Benefits of Facial Recognition Technology in schools
The managing director at CRB Cunninghams argued that FRT would ‘cut the average transaction time to five seconds per pupil’, critical for secondary schools trying to feed 1,000 teenagers in 25 minutes. They also argued that the system did not use LFR (Live facial recognition).
We’ll admit, aside from the obvious time saving benefits for schools, we’re struggling to think of other reasons why the biometric data of children should be analysed and stored while at school…‘cool’ new technology incentivising more kids to eat in the canteen instead of packed lunches? Let’s be honest, even that half baked justification really doesn’t cut the mustard…and it seems we’re not the only ones with concerns.
The Pitfalls of Facial Recognition Technology
Protecting Children
According to the ICO, the first point of failure was that the school didn’t take the unique needs of children into consideration enough. The ICO said; ‘This type of processing presents risks to pupils’ rights and freedoms, particularly around bias and discrimination, and children are often less aware of the risks that may be involved when their personal data are being collected and processed. They therefore merit particular protection under data protection law.’
Big Brother Watch, a non-profit, non-political British civil liberties and privacy campaigning organisation, echoes the sentiment: ‘No child should have to go through border-style identity checks just to get a school meal. They’re in good company, in a 2019 study by the Ada Lovelace Institute, 67% of people asked said they were uncomfortable about the use of the technology in schools.
Influencing Behaviour
There’s no shortage of headlines when it comes to FRT; Gatwick Airport and London’s King’s Cross station using FRT-enabled camera, police trials of FRT during sporting events, improper–and potentially biased–use of FRT technology by the police, even the introduction FRT kiosks at US airports. With the ever-increasing prominence of FRT technology in our everyday world, many worry that recording everyone’s biometric data could ‘force people to change their behaviour;
“…the deployment of FRT could create a sense of being watched that could dissuade people from expressing their views or participating in peaceful protests.”
Intrusive
Many believe that the facial recognition technology is so intrusive that attempts to moderate and minimise abuses of control/data breaches could be fruitless, as discussed by Connect World;
“Whereas it is possible for the use of FRT to be perceived as excessive, a very invasive or excessive use is likely to be unlawful. That said, even where the controller complies strictly with data minimisation and other privacy principles, there is still a severe risk of misinformation that can result from a lack of transparency.”
Issues of bias
FRT is not without its limitations, many accuracy issues have arisen from failure–on the part of data engineers–to adequately train their FRT models on sufficiently diverse audiences. The result is an inherent risk of biases infiltrating FRT systems.
Conclusion
The ICO finally concluded that ‘whilst it may be possible to deploy FRT in schools lawfully’, in this instance, there were some likely data protection infringements under:
- Lawful, Fair, and Transparent (Article 5(1)(a), Article 6, Article 9 and Article 12);
- Right to be Informed (Article 13);
- Retention (Article 5(1)(e)); and
- Data Protection Impact Assessment (Article 35).
Clearly, there is no blanket prohibition for FRT in schools. However, the bar for establishing the lawful basis is very high. Schools in England and Wales also have a duty to apply the Protection of Freedoms Act 2012, which sets out rules about parental and child consent for the use of biometrics in schools. These obligations need to be met in addition to data protection requirements. The provisions do not apply in Scotland or Northern Ireland.
Generally, organisations seeking to rely on their duty to perform a public task would need to document their assessment that the FRT is genuinely necessary, which the ICO established it certainly was not, to provide school lunches. There would also need to be child-friendly privacy notices, and an additional Article 9 UK GDPR exception which permits the processing of special category data. Lastly, the ICO established in no uncertain terms that such organisations ‘should not proceed unless it is confident that the data accuracy principle can be complied with and risks associated with bias and discrimination can be managed.’
Related DPAS blogs;
https://www.dataprivacyadvisory.com/why-does-cctv-require-compliance/
Other research;
https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2023/01/using-frt-in-schools/
https://connect-world.com/facial-recognition-technology-what-are-the-benefits-a
https://www.tes.com/magazine/analysis/general/should-schools-use-facial-recognition-technology
https://lordslibrary.parliament.uk/facial-recognition-technology-in-schools/
