Facial Recognition Guidance and Schools

The ICO has recently published an opinion on the use of live facial recognition in public spaces (https://ico.org.uk/media/for-organisations/documents/2619985/ico-opinion-the-use-of-lfr-in-public-places-20210618.pdf), and a few people have started to ask questions on the possible impact that this could have on technology within schools or where people may be looking to develop or roll out technology that is linked to this.

Let’s just say first that this is not CCTV that we are talking about, so it is not your standard set of cameras and recording system that is used to deal with possible intrusions, criminal damage, etc. or even where camera systems are being used to record teaching practices during lessons as part of a systematic approach to improving the quality of learning and teaching (and yes, those are quite possibly good starting points when you are writing up your purposes for processing data using camera systems).

These are the descriptions that the ICO’s opinion gives for facial recognition technology (FRT) and live facial recognition (LFR).

Facial recognition is the process by which a person can be identified or otherwise recognised from a digital facial image. Cameras are used to capture these images and FRT software produces a biometric template. Often, the system will then estimate the degree of similarity between two facial templates to identify a match (eg to verify someone’s identity), or to place a template in a particular category (eg age group). FRT can be used in a variety of contexts from
unlocking our mobile phones, to setting up a bank account online, or passing through passport control. It can help make aspects of our lives easier, more efficient and more secure.

The uses of FRT referenced above typically involve a “one-to-one” process. The individual participates directly and is aware of why and how their data is being used. LFR is different and is typically deployed in a similar way to traditional CCTV. It is directed towards everyone in a particular area rather than specific individuals. It has the ability to capture the biometric data of all individuals
passing within range of the camera automatically and indiscriminately. Their data is collected in real-time and potentially on a mass scale. There is often a lack of awareness, choice or control for the individual in this process.

The first, and possibly most important point for those in schools, is that FRT is biometric data. Not only do you have to consider the requirements under the Data Protection Act 2018 and UK GDPR, but also the Protection of Freedoms Act 2012 (https://www.legislation.gov.uk/ukpga/2012/9/contents/enacted), in particular Section 1, Chapter 2.

The use of children’s biometric data by schools requires consent. That makes a significant chunk of the above on LFR a moot point, to be honest.

Say you argue that there is a need, based on the purposes I’ve stated above and you are going to go for Consent as the lawful basis. What are you going to do for those who don’t provide consent or object/withdraw consent later on? Provide them all with technology defeating masks and clothing? Will that become part of the uniform code? It might not be a bad thing you know … being the first schools to support children’s privacy by making the school uniform able to confuse LFR systems?

What is it Sir Humphrey use to say about these things? Oh yes …. “Very brave, Minister. Very brave!”