Frequently Asked Questions
What information should schools provide to parents/pupils to help them decide whether to object or for parents to give their consent?
Any objection or consent by a parent must be an informed decision – as should any objection on the part of a child. Schools and colleges should take steps to ensure parents receive full information about the processing of their child’s biometric data including a description of the kind of system they plan to use, the nature of the data they process, the purpose of the processing and how the data will be obtained and used. Children should be provided with information in a manner that is appropriate to their age and understanding.
What if one parent disagrees with the other?
Schools and colleges will be required to notify each parent of a child whose biometric information they wish to collect/use. If one parent objects in writing, then the school or college will not be permitted to take or use that child’s biometric data.
How will the child’s right to object work in practice – must they do so in writing?
A child is not required to object in writing. An older child may be more able to say that they object to the processing of their biometric data. A younger child may show reluctance to take part in the physical process of giving the data in other ways. In either case the school or college will not be permitted to collect or process the data.
Are schools required to ask/tell parents before introducing an automated biometric recognition system?
Schools are not required by law to consult parents before installing an automated biometric recognition system. However, they are required to notify parents and secure consent from at least one parent before biometric data is obtained or used for the purposes of such a system. It is up to schools to consider whether it is appropriate to consult parents and pupils in advance of introducing such a system.
Do schools need to renew consent every year?
No. The original written consent is valid until such time as it is withdrawn. However, it can be overridden, at any time if another parent or the child objects to the processing (subject to the parent’s objection being in writing). When the pupil leaves the school, their biometric data should be securely removed from the school’s biometric recognition system.
Do schools need to notify and obtain consent when the school introduces an additional, different type of automated biometric recognition system?
Yes, consent must be informed consent. If, for example, a school has obtained consent for a fingerprint/fingertip system for catering services and then later introduces a system for accessing library services using iris or retina scanning, then schools will have to meet the notification and consent requirements for the new system.
Can consent be withdrawn by a parent?
Parents will be able to withdraw their consent, in writing, at any time. In addition, either parent will be able to object to the processing at any time but they must do so in writing.
When and how can a child object?
A child can object to the processing of their biometric data or refuse to take part at any stage – i.e. before the processing takes place or at any point after his or her biometric data has been obtained and is being used as part of a biometric recognition system. If a pupil objects, the school or college must not start to process his or her biometric data or, if they are already doing this, must stop. The child does not have to object in writing.
Will consent given on entry to primary or secondary school be valid until the child leaves that school?
Yes. Consent will be valid until the child leaves the school – subject to any subsequent objection to the processing of the biometric data by the child or a written objection from a parent. If any such objection is made, the biometric data should not be processed and the school or college must, in accordance with the Data Protection Act, remove it from the school’s system system by secure deletion.
Can the school notify parents and accept consent via email?
Yes – as long as the school is satisfied that the email contact details are accurate and the consent received is genuine.
Will parents be asked for retrospective consent?
No. Any processing that has taken place prior to the provisions in the Protection of Freedoms Act coming into force will not be affected. From 1 September 2013 (when the new duties in the Act take effect), any school or college wishing to continue to process biometric data from that date must have already sent the necessary notifications to each parent of a child and obtained the written consent from at least one of them before continuing to use their child’s biometric data.
Does the legislation cover other technologies such a palm and iris scanning?
Yes. The legislation covers all systems that record or use physical or behavioural characteristics for the purpose of identification. This includes systems which use palm, iris or face recognition, as well as fingerprints.
Is parental notification and consent required under the Protection of Freedoms Act 2012 for the use of photographs and CCTV in schools?
No – not unless the use of photographs and CCTV is for the purposes of an automated biometric recognition system. However, schools and colleges must continue to comply with the requirements in the Data Protection Act 1998 (DPA) when using CCTV for general security purposes or when using photographs of pupils as part of a manual ID system or an automated system that uses barcodes to provide services to pupils. Depending on the activity concerned, consent may be required under the DPA before personal data is processed. The Government believes that the DPA requirements are sufficient to regulate the use of CCTV and photographs for purposes other than automated biometric recognition systems.
Photo ID card systems where a pupil’s photo is scanned automatically to provide him or her with services would come within the obligations on schools and colleges under sections 26 to 28 of the Protection of Freedoms Act 2012 as such systems fall within the definition in that Act of automated biometric recognition systems.
Is parental notification or consent required if a pupil uses or accesses standard commercial sites or software which use face recognition technology?
The provisions in the Protection of Freedoms Act 2012 only cover processing by or on behalf of a school or college. If a school or college wishes to use such software for school work or any school business, then the requirement to notify parents and to obtain written consent will apply. However, if a pupil is using this software for their own personal purposes then the provisions do not apply, even if the software is accessed using school or college equipment.