Senedd backs call for legislation over the use of biometric data in schools

Senedd Members have been told that “a biometric system is not mandatory” for pupils in Wales during a debate over concerns on the nature of data collected on children in schools. ‌​‌‌‌​‌‌‍‌​‌‌‌​‌​‍‌​‌‌‌​‌​

Sarah Murphy, Member of the Senedd for Bridgend, led a debate in the Senedd last week calling for Education Minister Jeremy Miles to write to all schools in Wales for a moratorium on biometric technology and use of bodily data in schools until the Information Commissioner carries out an assessment of the use of children’s data across UK educational systems. ‌​‌‌‌​‌‌‍‌​‌‌‌​‌​‍‌​‌‌‌​‌​

Biometric data and fingerprints are used in many schools across Wales for students purchasing lunch in the canteen. ‌​‌‌‌​‌‌‍‌​‌‌‌​‌​‍‌​‌‌‌​‌​

However, Sarah Murphy MS raised concerns about the issue of consent and what is done with the data when a child leaves school. ‌​‌‌‌​‌‌‍‌​‌‌‌​‌​‍‌​‌‌‌​‌​

She said: “I became aware of fingerprint data collection in schools anecdotally. I was told by parents that it had been introduced by schools in my constituency, and then, when I asked more widely of parents and students if and where this was happening in other schools, I was surprised to discover that it is extremely prevalent. ”​‌‌‌​‌‌‍‌​‌‌‌​‌​‍‌​‌‌‌​‌​

“I then asked if consent had been requested for this to be introduced in schools, and I was shown one letter that parents had been sent to sign off on their children’s fingerprint data being collected and stored to be used in exchange for payment for school meals. ‌​‌‌‌​‌‌‍‌​‌‌‌​‌​‍‌​‌‌‌​‌”

“It stated, and I quote, If you choose not to have your children on biometric system, a four-digit PIN code will need to be allocated. Please note that the PIN codes do not have the same level of security, and it will be your child’s responsibility to remember the code and keep it secure at all times.’ ‌​‌‌‌​‌‌‍‌​‌‌‌​‌​‍‌​‌‌‌​‌​

“I cannot emphasise this enough: biometric data is not safer than a PIN code or passwords. Passwords and PIN codes can be reset. Once your biometric data is compromised, it is compromised for life. ‌​‌‌‌​‌‌‍‌​‌‌‌​‌​‍‌​‌‌‌​‌​

“It potentially stops the children for the rest of their lives from being able to use their fingerprint for security reasons or whatever they wish.” ‌​‌‌‌​‌‌‍‌​‌‌‌​‌​‍‌​‌‌‌​‌​

The Senedd was also told that students’ data should be deleted when they leave school, but students returning to their schools after graduating have realised that biometric systems still recognise their fingerprints in many cases. ‌​‌‌‌​‌‌‍‌​‌‌‌​‌​‍‌​‌‌‌​‌​

Sarah Murphy MS added: “What is this doing to our children’s view in our society? I’ll end by asking these wider questions: what message is this giving to students, that their biometric data, their bodies, can be used in exchange for a monetary transaction? ‌​‌‌‌​‌‌‍‌​‌‌‌​‌​‍‌​‌‌‌​‌​

“As adults, we don’t have to give our fingerprints to access food, knowledge, rights to education, and we would hopefully, and rightfully, kick off if we did, but our children have to. ‌​‌‌‌​‌‌‍‌​‌‌‌​‌​‍‌​‌‌‌​‌​

“How is this shaping how our children view their civil liberties? Because, as adults, as one person who wrote to me highlighted, the police force, under the authority of His Majesty and an Act of Parliament, can collect people’s fingerprints without consent if they’ve been arrested, charged or convicted, but our children have to hand this over daily.” ‌​‌‌‌​‌‌‍‌​‌‌‌​‌​‍‌​‌‌‌​‌​

Alyn and Deeside MS Jack Sargeant was among many who spoke in support of the motion: “How can our young people give consent to this when the risk is simply not understood? And if you couple that with the fact that it takes a huge leap of faith—a huge leap of faith—to simply trust technology companies to do the right thing with our data, then you understand why so many of us are advising caution and why Sarah Murphy is leading on this issue. ‌​‌‌‌​‌‌‍‌​‌‌‌​‌​‍‌​‌‌‌​‌​

Jenny Rathbone MS, said:  “If you can imagine the speed at which young people have to be served during the lunch break, as well as the really important confidentiality that needs to be adhered to around who is in receipt of free school meals and who is not, a thumbprint doesn’t tell you anything more, other than that this individual is wanting to apply to have whatever credit they’ve got on their account discounted by the amount of food that they are consuming.” ‌​‌‌‌​‌‌‍‌​‌‌‌​‌​‍‌​‌‌‌​‌​

“This biometric thumbprint translates into a code—not a photograph, not a name. It’s a series of numbers, which, to the rest of us, is a meaningless piece of information. But it tells the till operator, managing the money, what items need to be deducted that have been purchased by the individual. ‌​‌‌‌​‌‌‍‌​‌‌‌​‌​‍‌​‌‌‌​‌​

“So, even if the school’s account was hacked, the information that was held via the thumbprint wouldn’t tell you about which individuals had had dinner that day and who hadn’t. It is a stretch to think that a hacker would be hacking the school’s account and the till manager’s account at the same time.” ‌​‌‌‌​‌‌‍‌​‌‌‌​‌​‍‌​‌‌‌​‌​

Minister for Education Jeremy Miles MS responded: “The Welsh Government recognises the need for checks and appropriate balances in a system where personal and sensitive information is used to enable learners, and indeed any citizen, to engage in day-to-day activities. ‌​‌‌‌​‌‌‍‌​‌‌‌​‌​‍‌​‌‌‌​‌​

“In 2022, as Sarah Murphy mentioned, I launched revised guidance on safeguarding biometric data in schools and colleges, and I did so in Bryntirion Comprehensive School, with Sarah, in Bridgend. The guidance does provide clear information to schools and colleges on their legal duties in relation to implementing and using biometric identification systems. ” ‌​‌‌‌​‌‌‍‌​‌‌‌​‌​‍‌​‌‌‌​‌​

“The guidance sets out clearly that schools and colleges, before using a biometric system, should carefully consider whether there are other less invasive options that could provide the same level of service to learners. When a school does consider a biometric system, the school must be clear on the legal requirements that would be placed upon it.” ‌​‌‌‌​‌‌‍‌​‌‌‌​‌​‍‌​‌‌‌​‌​

“As noted in the motion, schools and colleges must consider the UN Convention on the Rights of the Child, and that’s also clearly set out in our guidance. This includes the right to express their views, feelings and wishes in all matters affecting them; to have their views considered and taken seriously; and the right to privacy. ‌​‌‌‌​‌‌‍‌​‌‌‌​‌​‍‌​‌‌‌​‌​

“It’s therefore vital that learners understand that participation in a biometric system is not mandatory. Alongside the main guidance, we produced a version specifically for children, as Sarah Murphy referenced in her speech, to help young people understand their rights in relation to this area. ” ‌​‌‌‌​‌‌‍‌​‌‌‌​‌​‍‌​‌‌‌​‌​

“Where either a parent, a carer or a learner chooses to opt-out, schools and colleges must find a reasonable alternative means of providing the service. This is an especially important point. Learners should not be disadvantaged or receive access to fewer or indeed different services because of a school’s decision to introduce biometrics.” ‌​‌‌‌​‌‌‍‌​‌‌‌​‌​‍‌​‌‌‌​‌​

The Minister stated that schools are legally responsible for any data they gather and use and must ensure that any biometric data is stored securely, and is not kept longer than needed. ‌​‌‌‌​‌‌‍‌​‌‌‌​‌​‍‌​‌‌‌​‌​

He added: “At present, there is no specific intention to introduce general legislation for use of biometric data in schools due to the existence of a broader legal framework with relevant checks and balances. The decision to introduce a biometric system is one for individual schools to make based on operational needs, impact assessments, and in consultation with staff, learners, parents and carers.” ‌​‌‌‌​‌‌‍‌​‌‌‌​‌​‍‌​‌‌‌​‌​

“The Welsh Government will object to the motion in order to abstain on it, as is its convention, but the Member has raised important points with me here in the Chamber today. As she has previously done this, it has allowed us to look together at what more we can do. As she has recognised, and I am grateful for this, the Government has acted.” ‌​‌‌‌​‌‌‍‌​‌‌‌​‌​‍‌​‌‌‌​‌​

The following motion was agreed upon by the Senedd: ‌​‌‌‌​‌‌‍‌​‌‌‌​‌​‍‌​‌‌‌​‌​

To propose that the Senedd: ‌​‌‌‌​‌‌‍‌​‌‌‌​‌​‍‌​‌‌‌​‌​

1. Notes that the prevalent collection and use of biometric data within schools across Wales is putting children’s personal data and privacy at risk. ‌​‌‌‌​‌‌‍‌​‌‌‌​‌​‍‌​‌‌‌​‌​

2. Calls on the Welsh Government to introduce legislation that would: ‌​‌‌‌​‌‌‍‌​‌‌‌​‌​‍‌​‌‌‌​‌​

a) ensure that Article 16 of the United Nations Convention on the Rights of the Child, a child’s right to privacy, is upheld within Wales; ‌​‌‌‌​‌‌‍‌​‌‌‌​‌​‍‌​‌‌‌​‌​

b) ensure that schools and childcare settings are using non-biometric technologies for services, rather than using biometric systems that may compromise the security of children’s biometric data; ‌​‌‌‌​‌‌‍‌​‌‌‌​‌​‍‌​‌‌‌​‌​

c) ensure appropriate risk assessments and procurement processes of technology companies within educational settings are put in place; ‌​‌‌‌​‌‌‍‌​‌‌‌​‌​‍‌​‌‌‌​‌​

d) acknowledge the potential harms from the unregulated use of biometric data; ‌​‌‌‌​‌‌‍‌​‌‌‌​‌​‍‌​‌‌‌​‌​

e) acknowledge the lack of consent by young people and children within current usages of biometric data within schools. ‌​‌‌‌​‌‌‍‌​‌‌‌​‌​‍‌​‌‌‌​‌​

Top pic: Sarah Murphy MS. ‌​‌‌‌​‌‌‍‌​‌‌‌​‌​‍‌​‌‌‌​‌​