What are Biometric Systems?
Biometric Systems in Schools.
Data Protection and Biometric Systems in Schools.
The Principles and conditions of the Data Protection Act (DPA)
Public Opinion
Summary
What are Biometric Systems?
In current times, the term ‘biometrics’ is generally used to describe data that can be used to recognise or verify a person’s identify. The data can be physical information, such as fingerprints, thumbprints, iris/retina scans and facial characteristics or behavioural traits such as signatures, handwriting and voice recognition.
Biometric information has been used for centuries – particularly in the detection of crime and more recently, in medicine. The main growth in the use of biometric systems has been since the early 1990s and critics and scientists say that there is an even bigger expansion in the use of biometric data in everyday life still to come.
The purpose of a biometric system can be distilled into a deceptively simple phrase: It is used for the verification or identification of an individual.
How and why are biometric systems used?
The main purpose is for verification - typically used to enable access – either to a physical place or to services provided. In its simplest form, this system may hold no more than a unique reference number and the digitised biometric, rather like a key to a door. The biometrics in this system can be used in place of passwords, swipe cards, tokens or PIN numbers. The advantages of this are that unlike the above, one cannot ‘lose’ one’s biometric, nor can it be easily ‘borrowed’, stolen or used by anyone else and thus improves security. Conversely, if theft is difficult when it is attempted, it is likely to have much more damaging results. One rather gruesome example of this is where a car had a biometric system in place of a key, there is a report that a thief, knowing this, cut off the owner’s finger in order to try and steal his car.
Systems that required the biometrics for identification purpose include driving licences, identification of a child’s parent and, not surprisingly, identify card and passport systems.
Rejection and Acceptance Rates.
There is always a possibility of a failed result in the use of biometric data. This is most usually down to how the system has been set up. Systems can be set in one of two key ways: i) those whose thresholds are set to demand a very high level of matching – e.g. when it is more important to reject an individual, (even if it is an authorised individual) than to accept, such as in high security environments and ii) those whose thresholds are set to accept a lower level of matching – e.g. when it’s more important to accept an unauthorised user than to reject an authorised one. Most schools systems will fall into this latter category.
Biometric Systems in Schools.
Biometric systems have been gradually entering schools in the UK since 2001. In April 2006, a grant of £330m was made available to schools to support the development of e-Learning and included in this was the purchase of new library systems, including those that used finger- or thumbprint data for lending and borrowing.
Many schools have taken advantage of this new technology in order to move from the concept of ‘library’ to the more modern ‘resource centre’. Libraries have a particular image that can mean that some groups of pupils in particular are not as attracted to using them as others.
Boys in particular are thought to use an upgraded resource centre more than a traditional library. Other advantages include the fact that access to the resources does not require the pupil to have remembered to bring their library card or ticket and the biometric data cannot be lost or damaged. Typically, the biometric used is a thumb or fingerprint.
Schools are also beginning to use similar biometric data to enable electronic recording of attendance, not just at registration periods in the morning or afternoon, but at each lesson of the day. Attendance is believed to be directly linked to attainment and schools have long struggled to collect and use attendance data effectively. This system streamlines the process considerably though there has not yet been any research done using these metrics in conjunction with attainment results. A growing number of schools are now choosing to implement systems in school dining halls in order to avoid pupils having to pay cash for school meals and to eliminate the stigma linked to the receipt of a free school meal – particularly in secondary schools. Many schools are using the data to link in with health eating education and the systems can record what choices a pupil made at lunch. Heads can offer ‘rewards’ to pupils who, for example, have selected healthy options on a regular basis based on reports produced by the system.
Data Protection and Biometric Systems in Schools.
Many schools have already introduced biometric data systems, including electronic registration and lunch systems, and have done so (most likely,) in accordance with the Data Protection Act 1998, which does not necessarily require consultation or consent in order to hold the data.
Initially, many schools simply implemented the new systems as part of their management processes. A recent small scale survey into one local authority indicated that some Head Teachers chose not to consult with parents or to inform them only once the system was in place. Another school chose to consult with parents who attended a specific meeting, where the school’s intentions were outlined and where any concerns could be addressed. Most schools that consulted said that the parents were mostly unconcerned: one parent wanted to look more closely at the IT system; three parents initially said they were unhappy about their child’s data being taken this way (fingerprinting) but following further discussion and reassurance from the Head, agreed to allow it.
However, there has been a swell of public opinion against such system which is still growing.
Schools need to be fully aware of the DPA 1998 in order to follow the legal requirements of implementing a system that holds personal data. There are a set of 8 key principles in the Act, stating that personal information must be:
- Fairly and lawfully processed
- Processed for limited purposes
- Adequate, relevant and not excessive
- Accurate and up to date
- Not kept for longer than is necessary
- Processed in line with your rights
- Secure
- Not transferred to other countries without adequate protection
(DPA 1998)
The Principles and conditions of the Data Protection Act (DPA)
There are a number of conditions attached to the principles and unpicking some of the issues does become complex. This section will attempt to identify the process that schools should go through and why there may be more than one interpretation of the law.
If biometric data is collected by the school, the school must ensure that under Principle 1, the data is only collected and used for a specific, fair and lawful purpose. In order for it to meet this principle, a school must also be able to meet the at least one of the six conditions that govern this principle. These are that:
- The data subject (or pupil) has consented to the processing;
- Processing is necessary for 'the performance of a contract;
- Processing is required under a legal obligation (other than one stated in the contract);
- Processing is necessary to protect the vital interests of the data subject's rights;
- Processing is necessary to carry out any public functions;
- Processing is necessary in order to pursue the legitimate interests of the "data controller" or "third parties".
(DPA 1998)
It has proved very difficult to find an irrefutable message from either the Information Commissioner’s office (ICO) or the Government on whether the introduction of biometric systems into schools in the UK meets the full requirements of the DPA 1998. The following quote is taken from the ICO website:
..it is impossible to say that the use of fingerprints outside law enforcement, for instance where entitlement to services is involved, will inevitably breach the Data Protection Act (“the Act”). But certain features of such systems will make them more or less likely to be acceptable on privacy and security grounds.
ICO 2007
However, a set of guidelines published by Becta, the Government’s school ICT agency on 23 July 2007 identifies a general enabling power for schools to collect and use biometric data. It states that the governing body of a maintained school has a power under paragraph 3(1) of Schedule 1 of the Education Act 2002 to:
“do anything which appears to them to be necessary or expedient for the purposes of, or in conjunction with (a) the conduct of the school, or (b) the provision of facilities of services under section 27 [of that Act.]”
These guidelines were produced specifically to help Heads to understand how the DPA 1998 applies in the use of biometric data in their schools. It could be argued that the guidelines were slow in being produced and may indicate a lack of forethought on the subject. Considering the political and media interest that was building on the subject, it might also be thought that the guidelines were in response to public pressure.
Public Opinion
A search on the web for Biometrics+Schools+UK will invariably bring back, (along with guidelines, scientific references and IT solutions), links to media reports and campaign groups, almost all of which are ‘anti’ biometric systems. ‘Leave them kids alone’ (LTKA); ‘Morley Parent’s Blog’; ‘Thumbs Down’ and ‘Biometrics in School : a concerned parent who doesn’t want their children to live in ‘1984’ type society’ are but a small sample by which to gauge public opinion on biometric testing.
Fears about the system range from concerns that children are being ‘softened up’ to hand over their biometric data at a young age, so that they will be less resistant to providing this type of data as they grow into adulthood, which will smooth the way to national identity cards and cashless purchases, for example. Other concerns link to the association with crime that goes with the concept of fingerprinting. Parents are often quoted as feeling that their child is being ‘treated like a criminal’ through the fingerprinting process. Pressure groups suggest that data collected in early life can and will be used once the young person has left school by being made available to the police and other authorities. A further fear relates to identity theft. Whilst biometric systems have used identity theft as a positive, i.e. that the system makes identity theft extremely difficult compared to many non-biometric systems, campaigners and pressure groups use the argument of identity theft against biometric systems. They argue that the prints of a pupil could be stolen at the age of 7 by a hacker. These could then used by someone who wanted to assume the identity of a British citizen. By the time the 7year-old is old enough to open a bank account or something similar, he discovers that he already has one – the identity thief got there first.
Once compromised, or attacked by an impostor in this way, an individual is potentially compromised for life as one cannot change one’s biometrics in the same way as a stolen PIN. This is a new concept and there is little information about how exactly it can be challenged. Research is currently being done on ‘Cancellation biometrics’ but for the main part, biometrics are being sold as a potential answer to identity theft.
The campaigns against biometric testing in schools are, naturally, vociferous, as might be expected and a great deal of the postings on the websites are from very anxious parents. Referring back to the small scale survey mentioned earlier, of the 2,000+ parents whose children have registered fingerprints on a school system, there has not been a single complaint raised to the local authority or a refusal to allow the data to be held. This is true even in those schools where initial consultation did not take place. All the schools in this survey now say they include reference to the system in newsletters and brochures about the school.
Some parents nationally, however, are considering taking legal action in order to stop schools from fingerprinting children. Amongst this group is a filmmaker, Jonathan Adams, says that litigation may be the only way forward. He continues:
"We fear they are in breach of the Human Rights Act, the Data Protection Act and the European Commission laws that safeguard the child… We have sought initial advice from lawyers…If we won, the individual schools would have to pay a hefty price for ignoring parents' wishes.”
LTKA (2007)
As yet, no evidence has been found that any action has been brought against a school, but clearly the will to do so exists.
Summary
Biometric systems in schools (and elsewhere) are growing in usage and numbers and despite some strong opposition, the key strengths of the systems for schools are many and varied. They include administrative convenience, speed of service provision, no loss of passwords, cards or tokens for access, and the opportunity to have cashless systems, which can reduce both the stigma for free school meal takers and the opportunity for bullying and theft.
Schools and governing bodies do need to fully consider some of the wider implications in the introduction of these systems. It is clear that the systems deliver a hi-tech image – indeed one system is called ‘Vericool’ – and aim to act as a tool of convenience to the schools themselves. However, data security must be a very high consideration, as despite the sales pitch that ‘no images are stored’, there is always the possibility of a technical solution to matching biometric templates. A fingerprint is for life and cannot be replaced if it is compromised.
The guidelines produced by Becta offer further information for schools that covers many of the issues and legalities found during the compilation of this report. This information is published on the Teachernet website and it is the recommendation of the report that Heads or Governing Bodies, using or thinking of using a biometric system in school, should read this at the earliest opportunity as it outlines the legal implications that may otherwise be missed.
Becta. (2007) Guidance on the use of biometric systems in schools. http://www.becta.org.uk
Department for Children, Schools and Families. DCSF Guidance to data processing and sharing. http://www.teachernet.gov.uk/_doc/9133/