Essex school reprimanded for illegal use of facial recognition technology

An investigation by the Information Commissioner’s Office has found a Data Protection Impact Assessment was not carried out before ID verification was deployed.

The ICO has now decided to formally reprimand Chelmer Valley High School, Chelmsford, after it emerged legally required steps that must be taken before utilising facial recognition technology were not taken. 

High data protection risks associated with biometric data used for processing children’s identities means additional safeguarding measures and assessments are required. In failing to do so, the school potentially put data relating to 1,200 students at risk. 

Among other things, it emerged that in March 2023 a slip was sent home for parents to sign if they did not want their child to participate in the programme. However, this did not give the option to consent to the scheme, so the initiative relied on assumed consent until November that year.

Further to this, because most children were old enough to provide their own consent – an option for anyone in the UK over the age of 13 – the ‘parental opt-out deprived students of the ability to exercise their rights and freedoms,’ said the ICO. Meanwhile, the school’s own data protection officer was not consulted at any stage. Had this happened, the ICO argues, compliance issues would likely have been identified prior to roll out and the situation avoided. 

‘A DPIA [Data Protection Impact Assessment] is required by law – it’s not a tick-box exercise. It’s a vital tool that protects the rights of users, provides accountability and encourages organisations to think about data protection at the start of a project,” said Lynne Currie, the ICO’s head of privacy innovation,’ said Lynne Currie, head of privacy innovation at the ICO. 

‘Handling people’s information correctly in a school canteen environment is as important as the handling of the food itself. We expect all organisations to carry out the necessary assessments when deploying a new technology to mitigate any data protection risks and ensure their compliance with data protection laws,’ she continued. ‘We’ve taken action against this school to show introducing measures such as FRT should not be taken lightly, particularly when it involves children.’

Chelmer Valley High School has since completed a DPIA, and taken steps to rectify the oversights retrospectively, including asking for explicit consent from students. Another assessment must now be completed, and the outcomes will be integrated back into the scheme.

Nevertheless, the ICO has already issued a warning about facial recognition technologies in school settings, which are often used for things like cashless catering. The benefits of this may not outweigh the downsides, which critics such as Liberty and Defend Digital Me say include the normalisation of surveillance of young people. 

Image: Siora Photography