UK: ICO issues letter to Council for use of facial recognition technology in schools

The Information Commissioner's Office ('ICO') announced, on 31 January 2023, that it had issued a letter to North Ayrshire Council ('NAC') following their use of Facial Recognition Technology ('FRT') across nine of its schools to manage 'cashless catering' in school canteens. In particular, the ICO stated that the NAC had stopped processing shortly after data protection concerns were raised with the ICO in October 2021. In this regard, the ICO detailed in its letter that it had engaged with the NAC to assess whether their processing activities raised any concerns in respect of data protection law and concluded that FRT had been deployed in a manner that is likely to have infringed data protection law under the following Articles of the UK General Data Protection Regulation (Regulation (EU) 2016/679) ('UK GDPR'):

• lawful, fair, and transparent in Articles 5(1)(a), 6, 9, and 12 of the UK GDPR;
• right to be informed in Article 13 of the UK GDPR;
• retention in Article 5(1)(e) of the UK GDPR; and
• Data Protection Impact Assessment ('DPIA') in Article 35 of the UK GDPR.

As such, the ICO recommended the following improvements that the NAC should implement:

• ensure that there is a valid lawful basis for processing: the ICO noted that consent was the appropriate lawful basis for processing children's special category biometric data in this context and that the requirements for valid consent were unlikely to be met in this case;
• ensure that the processing is transparent: the ICO stated that NAC should be able to explain in age-appropriate language how children's data will be collected, used, stored, and retained, and the risks associated with its use; and
• ensure that a comprehensive DPIA is conducted in advance of processing commencement, which considers the necessity and proportionality of the processing, the potential for 'function creep' (i.e. using personal data for purposes beyond those originally identified), and ensures that risks of bias and discrimination in the use of FRT are identified, assessed, and mitigated.

Moreover, the ICO included detailed analysis of its main areas of concern and its observations in the appendix to the letter.

Using FRT in schools – letter to North Ayrshire Council

We have issued a letter to North Ayrshire Council (NAC) following their use of Facial Recognition Technology (FRT) to manage ‘cashless catering’ in school canteens.

The story was first brought to us in October 2021 when #NAC introduced FRT into nine of its schools. NAC stopped processing shortly after data protection concerns were raised with us.

Although #FRT and other new technologies can offer benefits within an education setting, they process special category data and are not without risk.

As the data protection regulator, we want to ensure that educational authorities can access the benefits of new and emerging technologies, whilst also protecting children’s data and safeguarding their rights.

FRT and similar technologies can potentially be used lawfully with appropriate assessment and care.

One of the things that education authorities based in England & Wales must also apply is section 26 of the Protection of Freedoms Act 2012 which has provisions around parental & child consent for the use of biometrics in schools. These provisions do not apply in Scotland or NI. / ico.org.uk

Source by Redazione