Schools Week readers will be familiar with the fact that a pilot to introduce facial recognition technology (FRT) in nine schools in North Ayrshire was brought to a swift conclusion by the Information Commissioner’s Office. The seemingly commonsense solution to unblock an administrative bottleneck (in this case, to streamline student lunch payments) raised serious concerns about privacy and consent. There is a real risk that young people’s privacy is gradually being eroded by successive technological developments.
Current and future uses
With stable, fixed populations for whom technology is already part of the fabric, schools are ideal for the rollout of new innovations. Identifying children at a fixed point in a canteen queue is only a starting point.
FRT is also available to identify students’ presence at school, both confirming their attendance and monitoring their whereabouts on school premises. Inevitably, it could be used for disciplinary investigations. In the US, sophisticated FRT systems are being marketed to prevent school shootings. And the technology is already available to monitor students’ facial expressions to track their mood or engagement, which could be used to provide real-time feedback to teachers.
Unlike a student’s school records, however, their face is part of their fixed physical identity. FRT therefore has the potential to bake in discrimination and a culture of surveillance. For example, established research shows that it disproportionately fails to match images of darker-skinned people, especially women. And unlike CCTV, FRT allows the creation of new datasets of identified individual students including not just their attendance but also their routes around school, their association with other students and even whether they paid attention in maths.
Regulatory catch-up
Within this context, clear parameters need to be in place with respect to the collection, use and retention of this data. The data protection framework is able to accommodate emerging technologies, but only to an extent. European data protection authorities have imposed GDPR fines with respect to FRT in schools on two occasions. In Sweden, despite obtaining explicit consent, a school was fined after it failed to conduct a risk assessment or consult the authority. And in France, a fine was imposed where the consent obtained was not fully informed or freely given and the school could not demonstrate that its objectives could not be secured by less intrusive means.
In both cases, the schools’ compliance fell short, even though they had paid attention to data protection legislation. But although principles-based data protection legislation allows this sort of flexibility, it is inherently uncertain. Therefore, given the acknowledged risks of FRT, schools need specific guidance to determine whether it is necessary, fair and proportionate – and therefore lawful – in given circumstances.
Consent is a particularly fraught issue, not least given clear ICO guidance that it is not appropriate to rely on consent where there is an imbalance in power. Note that while 97 per cent of families in the North Ayrshire schools consented to FRT in the canteen queue, 67 per cent of respondents to a recent Ada Lovelace Institute survey disagreed with the use of FRT in schools.
Facing the facts
Further, consent provided on the basis of practical exigency, especially if based on high-level information, would not comply with the gold standard of UK GDPR consent. And further still, there are practical difficulties such as whether non-consenting students can be filtered out without first capturing and identifying their image.
Guidance is also required regarding data minimisation, security, retention and anonymisation. Otherwise, schools will unintentionally become the custodians of intrusive student databases without lawful justification.
The Ryder legal review commissioned by the Ada Lovelace Institute last week called for an immediate ban on the use of live FRT in public places including schools, and called for an urgent review of existing laws and a new legislative framework to coincide with the reforms under way to our data protection regime.
I agree. The introduction and development of FRT in schools needs to be paused to allow for fully informed public consultation and regulatory consideration of its future impact.
While schools are understandably hungry for extra efficiency, leadership teams should remember that the technology is not as innocuous as it seems, and that the potential consequences of early adoption will fall on them rather than on the commercial enterprises marketing it to them.
Your thoughts