Guidance on using biometric technology

Governors and headteachers are being urged to be clear and open with parents and pupils about the growing use of biometric technology in schools.

Schools are increasingly using biometric systems, such as fingerprint scanning, to monitor attendance, run cashless catering or automate libraries. But new guidance issued by Becta, the government’s education technology agency, advises schools to acknowledge the concerns of some parents when implementing such systems. It also outlines the school’s legal position, including the need to make sure that it complies with the Data Protection Act.

Biometric technology records physical or behavioural characteristics that are unique to individuals. These include retina and iris patterns, voice, facial shape, hand measurements, fingerprints and handwriting. These characteristics can either be recorded by taking a complete image, such as a passport photograph or a fingerprint, or by taking measurements that record the unique characteristics of the source but do not capture a complete image.

This latter approach is the one employed by the fingerprint recognition technology that is most common in the biometric systems currently being used by schools. Instead of taking a photograph or a physical imprint of the finger, the reader converts the characteristics of the fingerprint to a numerical value, which is stored with the child’s name. An image of the fingerprint cannot be recreated from the numerical data, but the child can be identified each time a new reading creates a value that matches the one in the database.

When the biometric data is stored it is subject to the requirements of the Data Protection Act, just like any other data. This means, for example, that schools cannot use biometric information for anything other than the express purpose for which it was collected. So data taken for use in a library can only be used in that context. Schools should also not keep personal data any longer than it is needed for its specified purpose, which means that pupils’ biometric data should be destroyed when they have left the school.

The guidance advises that schools are not legally obliged to obtain the consent of the pupil or the parent before collecting biometric data. Although the subject giving consent is one of the conditions that allows personal data to be processed if it is met, the governing body’s legal obligations entitle it to record the data, even if that particular condition has not been met.

Becta suggests that, before introducing biometric technologies, schools should consider first with their governing body what system is most suitable and appropriate to their needs. It adds that, notwithstanding the legal position, schools should recognise that some parents may have concerns about what is planned.
‘In the light of such possible concerns, it is good practice for schools to be clear and open with all parents and pupils when introducing the technology,’ says the guidance. ‘This could involve explaining what biometric technology will be used, what is involved, what data will be held and stored, why it is required, how it will be secured and how long it will be retained.’

It goes on to recommend that schools reassure parents and pupils that the data will not be passed on to any third parties and to explain how it will be kept safe. The guidance also accepts that some parents and/or pupils may still want to opt out of using biometric systems. In such cases, it suggests that schools may want to build in an alternative method of accessing their systems, such as smartcards, which can provide all the same benefits, even though they have drawbacks such as the need for pupils to remember them, and the chance of them being lost or stolen and misused.

‘Each school must make their own decisions over the systems they employ,’ said Becta chief executive Stephen Crowne. ‘Biometric technology can offer a means for streamlining the day to day running of the schools, but they must be aware of the sensitivities that surround this technology. Schools must ensure that they engage fully with parents and pupils and consider the provision of alternative systems if there are strong objections to the use of biometric technology.’

Becta guidance on biometric technologies in schools can be downloaded here

Forms of biometric technology
Biometric technology is used to identify individual people by measuring, analysing and recording their unique physical or behavioural characteristics. The most common methods involve face recognition, iris scanning and fingerprinting.

• Face: A computer connected to a camera can record an image of someone’s face and use it to create a template using measurements between key points on the face. This template can then be compared with those already contained in a database.
  

• Eye: Iris scanners measure and record the unique markings on the coloured part of the eye. This data is stored as a reference to confirm an individual’s identity in the future.
  

• Finger: A sensor plate reads the unique pattern and distinguishing features of a finger print, plotting them onto a digitised template which is used for comparison on future occasions.
  

Principles of data protection
Schools must comply with the principles of the Data Protection Act when using any data, including biometric data. These state that data must:

• be fairly and lawfully processed
• be processed for limited purposes
• be adequate, relevant and not excessive
• be accurate
• be kept no longer than necessary
• be processed in accordance with data subjects’ rights
• be secure
• not be transferred to other countries without adequate protection of data subjects’ rights.