Biometric technology systems in schools: guidance

Examples of biometric technology systems in schools

Fingerprint, palm, and facial recognition systems

8. A number of biometric technology systems already established or being considered in Scottish schools have typically been based on fingerprint or palm recognition technology. As outlined in the paragraph above, such systems capture biometric data by taking measurements that adequately capture the uniqueness of the fingerprint or palm.

9. In relation to fingerprint recognition systems, a numerical value or graph is derived from the pupil’s fingerprint when it is first placed on a reading device. This numerical value or graph is then stored in the biometric technology system.

10. In relation to palm recognition systems, the palm of the hand is placed above a sensor and a near infrared image is captured. The vein pattern of the palm is analysed, encrypted, and then stored into the biometric technology system.

11. Each time the pupil’s fingerprint or palm is subsequently re-read, the measurements of the characteristic are generated and compared. This system then uniquely identifies the pupil within the population of the school where a match is found. Schools do not keep the image of the fingerprint or palm.

12. A facial recognition system maps facial features from a photograph or video and compares this with a database of known faces to find a match. Whilst facial recognition systems may help to verify a person’s identity, such systems are likely to be considered disproportionate for the purpose of verifying the identity of pupils in schools. Information Commissioner’s Office (ICO) guidance on the use of live facial recognition technology in public places is available on the ICO website.

The use of biometric technology systems in schools

13. Manufacturers of biometric technology systems have explained that such systems can be used for numerous functions within schools. Examples of these functions are described below, however this list is not exhaustive. Please note other identification mechanisms (such as smartcards) can be used as an alternative to biometric technology systems.

• Cashless catering system for school meals: Parents/carers can pay in advance for pupils’ school lunches by crediting the pupils’ account. Pupils can then use this credit to pay for their school lunch. Individual pupils can be identified at the till by an automated fingerprint or palm recognition mechanism, with the cost of their lunch being deducted from the credit in their account. In some instances, pupils can also add credit to the account themselves using machines based within the school.
• Automated system for recording attendance: Pupils can register via an automated fingerprint or palm recognition mechanism at the school gate or entrance at the start and end of each school day.
• School library automation: Use of biometric technology can help manage lending from the school library. An automated fingerprint or palm recognition system can identify and record a pupil’s name and the items they have borrowed or are returning.

14. The advantages of biometric technology systems over other automatic identification systems have been highlighted by manufacturers. In relation to catering or borrowing books, manufacturers explained that pupils do not need to remember to bring anything with them to the canteen or school library, so nothing can be lost (such as a swipe card). However, biometric technology systems can be perceived as more intrusive than other automatic identification systems. There is also the question of whether such systems are proportionate and appropriate for use in educational establishments (see paragraph 27).

15. Where an education authority uses a supplier to provide technology, and that supplier is then to process personal data on behalf of the education authority, there must be a contract in place between the educational authority (data controller) and the supplier (data processor). Article 28 of the UK GDPR sets out what is required within this contract and further information is provided in paragraph 49 of this guidance below. The education authority should be assured that the processor can comply with the requirements of data protection law and will not use data for their own purposes.