North Ayrshire Council 'likely' to have breached data law with facial recognition tech in schools
A data security watchdog says it’s highly likely that North Ayrshire Council broke data protection laws when it introduced facial recognition technology in schools.
A data security watchdog says it’s highly likely that North Ayrshire Council broke data protection laws when it introduced facial recognition technology in schools.
The local authority introduced facial recognition technology (FRT) to nine schools in the region in 2021, for pupils to pay for school lunches.
However, after the Information Commissioners Office (ICO) raised concerns shortly after it was implemented, the council scrapped the tech.
ICO Report
The ICO has now written a letter after their initial concerns saying the council is likely to have breached data protection law, as pupils and parents weren’t aware of what they were consenting too and had no knowledge of the potential risks of FRT.
The report stated: “We took a detailed look at the information provided by NAC and concluded that, whilst it may be possible to deploy FRT in schools lawfully, in this case we are concerned that the technology had been deployed in a manner that is likely to have infringed data protection law.
"our view is that NAC was unlikely to comply with the requirements of Article 12 as it did not ensure that the content of its privacy notice was provided to children in a concise, transparent, intelligible and easily accessible form, using clear and plain language. In particular, it did not attempt to explain to children, in child-friendly terms, the potential impact of the processing of biometric data.
"In addition, the communications from NAC underplayed the complexity of the FRT technology and suggested that biometric processing is an historic and well-tested practice. This could be considered misleading to the data subjects as there was no attempt to explain the fact that this is a relatively new technology which would result in the processing of children’s unique biometrics, nor was there any attempt to outline the potential risks this could present.
"It therefore appears unlikely that consent was freely given. It should have been made clear to pupils and parents that there was no requirement to consent to FRT to obtain a school lunch and alternative options as easy to use as the FRT, should have been provided."
Cyber Security Expert on FRT
Cyber Security expert at Glasgow Caledonian University, Omair Uthmani is telling West FM there was no need for this type of complex technology to be used in schools, as the risks of data being hacked or breached was a case of when not if.
He said: “There are a couple of reasons why there was no need for this in schools.
“The justice sub committee said in 2020 that this type of technology wasn’t even suitable or acceptable for police to use, and said we will not be using it because of the inherent dangers of FRT.
“The reasons they cited was because FRT is trained on data, the number of false flags go up significantly when you apply to woman and people of colour.
“So, from the perspective it is a dubious technology. Even for a policing purpose it is not viable, so for a child to use for paying for school lunches, there could have been alternatives.
“There hasn’t been a single database in the world, including the CIA, that hasn’t been hacked. So for a council to say they can guarantee that wouldn’t happen, it is unlikely.
“These are children, so if you can run something as invasive as this tech on that data you are opening yourself up to a lot of legal liability. The dangers are far too risky, and what is the benefit? To get through the lunch line quicker?”
Council delete data
A spokesperson for North Ayrshire Council said: “We welcome the clarity which has now been received from the Information Commissioner's Office.
“Following the initial interest of the Commissioner’s Office in October 2021, we immediately ceased use of the facial recognition system and thereafter deleted all biometric data.”