Biometric data, protection, attendance

Using biometric data in schools

Tags: | | |

Biometric systems can now be used to speed up lunch queues, remove the need for children to take money into schools, save time in taking registers and to prevent unauthorised access to school premises. Mark Blois considers the legal and practical implications of using biometric data in schools

What is biometric technology?

Biometric technology describes the range of technologies used to measure, analyse and record one or more of a person's unique characteristics, such as fingerprints, iris patterns or voice. This technology is generally used to support business processes that require confirmation of identity.


How can this technology be used in schools and what are the potential benefits?

There are several ways that schools can use biometric technology. The most obvious of these are for cashless catering, registration and library borrowing. There are advantages in using a fingerprint system for these functions.

A cashless catering system: Parents can pay in advance for school meals, and the money for each lunch is deducted from the credit. The advantages here are that children will not have to carry cash or cards that can be lost or stolen and children in receipt of free school meals are not identifiable, thus avoiding stigmatisation.

Attendance: Registration time can be saved and used more productively. Pupils actually have to be present in order to register − there is no way of one pupil registering another.

School library: Pupils will have to be present in order to borrow books from the school library, preventing pupils from taking out a book under another child's name.

Fingerprints, unlike a card or money, cannot be lost or forgotten on the way to school!


We already hold data related to staff and pupils, how is this any different?

Schools already hold the names, addresses and often medical information of their pupils. Therefore, schools are familiar with complying with data protection and confidentiality laws. However, biometric data is by its nature quite different, it is a far more personal form of information. The use of biometric data is relatively new, so many people are understandably wary of this relatively untested technology. Someone's fingerprint is for life and there have already been concerns raised about the gathering of such sensitive data.


As the information is so sensitive, do we need to obtain parental consent?

While parental consent is not required, it is advised. In order for personal information to be processed under the Data Protection Act 1998 one of the conditions under Schedule 2 of the Act must be met. These conditions can be summarised as:

1. Having permission of the pupil.

2. If it is necessary for the performance of a contract to which the data subject is a party, for compliance with a legal obligation or for the purposes of legitimate interests pursued by the school, provided that the rights of the school outweigh the rights of the data subject.

In practice it would be wise for a school to gain the consent of parents prior to collecting pupils' biometric data. That way, you can maintain a cooperative and trusting relationship with the pupils and parents.

What should we do if consent is withheld?

If consent to collection of biometric data is withheld by parents, or indeed by pupils, schools should have in place an alternative arrangement, such as a smart card system. In order to avoid weakening the relationship between the school and parents/pupils, you should ensure that facilities are available to all pupils and not just those who have opted into the biometric system.

How secure is the information?

There are two methods of storing biometric information. Firstly, you can store it by recording the complete image of a face or a fingerprint. Secondly, you can store encrypted numerical values derived from fingerprints and not the actual image (each time a fingerprint is scanned a numerical value is created and compared to the original). This second method is being employed by schools and is far more secure as it should not be possible to reverse engineer the process to identify the fingerprint from the numerical value.

How long should I keep it?

Schools cannot keep the biometric data for longer than they need it. Therefore, the data will be deleted upon the pupil leaving the school. You are not permitted to use the information for purposes other than those stated. For example, if you say that the information will be used for the school library, it cannot also be used for checking attendance.

Should my school introduce biometric technology?

The answer to this question will of course depend on the individual school. Biometric technology will be most beneficial in schools that have issues with truancy, problems with theft of lunch money or stigmatisation of children in receipt of free school meals. Potential benefits should be weighed up against potential disadvantages. For example, registration is seen by some teachers as an important part of the day, when the teacher makes eye contact with every pupil. There is also an argument that this use of biometric data for relatively trivial matters could lead children to regard this type of data too lightly. Finally, the school will also have to weigh up all the potential benefits against the financial cost of introducing a biometric system.

Further guidance is provided on Becta's website

This e-bulletin issue was first published in June 2008

About the author: Mark Blois is the editor and author of Legal Expertise. He is a Partner and Head of Education at Browne Jacobson. Before becoming a Partner in 1996 he was awarded third place in The Lawyer Awards in the 'Assistant Solicitor of the Year' category. Having various disabilities himself has led Mark to commit his career to providing practical advice, support and training to schools, colleges and Local Authorities on the full range of legal issues. Mark is named as a leader in his field in both Chambers and Legal 500, is an Executive Committee member of the Education Law Association and is a LA governor at a special school in Nottingham. He writes extensively on education law and has had published over 60 articles in national publications. He is also the author of chapters in Optimus' Education Law Handbook, the IBC Distance Learning Course on Education Law and Croner's Special Educational Needs Handbook.



Member Comments


Biometrics Bad

I can't imagine why any parent would authorize the collection of anything biometric related to their sons or daughters. Nor can I imagine why any parent would go along with any smart card system. Horrible, horrible, horrible move by the schools, and it should be fought tooth and nail by everyone.

Fingerprinting in schools

Thanks to Mark Blois for a comprehensive summary of the issues around fingerprinting in schools.

I would like to take issue on two points. Firstly, he said "There are two methods of storing biometric information. Firstly, you can store it by recording the complete image of a face or a fingerprint. Secondly, you can store encrypted numerical values derived from fingerprints and not the actual image (each time a fingerprint is scanned a numerical value is created and compared to the original). This second method is being employed by schools and is far more secure as it should not be possible to reverse engineer the process to identify the fingerprint from the numerical value."

This overstates the security of the second method. Let's say you look up the encrypted numerical value representing a pupil's fingerprint in the school database. If you want to impersonate that pupil (say, to create a false identity, or to defraud them after they grow up) you don't need to reproduce their exact fingerprint. You just need to come up with some pattern that the scanner will convert into the same numerical value. It doesn't matter if, to the naked eye, it looks like the pupil's fingerprint (or whether it looks like a human fingerprint at all). All that matters is that the scanner (and any other scanner using the same software) will turn it into the same numerical value - a much easier task for the fraudster.

Secondly, he did not mention that automated fingerprinting technology is unreliable. Large-scale trials of fingerprinting for immigration security in Britain and America have shown that it is common for genuine fingerprints to be rejected (up to 20% of the time), and also for fingerprints to be incorrectly matched to the wrong person (around 0.3% of the time, but it can be higher or lower depending on how the system is set up). 0.3% may sound good, but if you have 1,000 pupils in the school then each fingerprint would be matched to 3 pupils on average. Tweak the system to reduce the likelihood of this happening, and you simply push up the false-reject rate. So there is a high risk of incorrect billing unless a swipe card is used in parallel, defeating a main selling point of fingerprint systems.

Post new comment

The content of this field is kept private and will not be shown publicly.
  • Allowed HTML tags: <a> <em> <strong> <cite> <code> <ul> <ol> <li> <dl> <dt> <dd> <img> <p>
  • Lines and paragraphs break automatically.
  • Web and e-mail addresses are automatically converted into links.
More information about formatting options

Use the tabs below to see the most popular and most recently added pages on Teaching Expertise.