The use of facial recognition technology deployed in a number of school canteens across the UK has been put on hold for the time being after the Information Commissioner's Office (ICO) intervened to ask some questions.
Some nine schools in North Ayrshire, which is a Scottish authority that includes the Isle of Arran, were scheduled to start processing payments for school meals via facial scanning technology.
This was intended to speed up the delivery of lunches from an average of 25 seconds to five, and potentially reduce COVID-19 infections compared to card payments and fingerprint scanners.
However, campaigners told The Reg last week that using facial recognition in canteens was the wrong solution given the highly sensitive and personal nature of the data, which was to be stored on school servers.
North Ayrshire Council confirmed on 22 October it is pausing the use of the tech, saying: "Having received a number of enquiries in recent days, we have temporarily paused the contactless payment system, which uses facial recognition, in our secondary schools from this afternoon while we consider and respond to the enquiries received."
The Council has said that 97 per cent of parents, carers and children had consented to the use of facial scanning.
"Whilst we are confident the new facial recognition system is operating as planned, we felt it prudent to revert to the previous PIN (Personal Identification Number) system while we consider the enquiries received."
- Give us your biometric data to get your lunch in 5 seconds, UK schools tell children
- Volkswagen to stop making its best-selling product for Wolfsburg workers: VW-branded sausages
- How much would you pay me to develop a COVID tracking app that actually works? Ah, thought so: nothing
- Hey, it's Google's birthday! Remember when they were the good guys?
The company behind the system, CRB Cunninghams, announced the introduction of the tech in June as the "next step in cashless catering". David Swanston, the MD of the supplier, said the cameras would verify the pupils' IDs against "encrypted faceprint templates. Some 65 schools had signed up to the deployment," he told the FT.
UK data watchdog, the ICO, told us last week it was "making enquiries with North Ayrshire Council with regards to the processing of pupil's faces."
It said: "Organisations using facial recognition technology must comply with data protection law before, during and after its use.
"In addition, data protection law provides additional protections for children, and organisations need to carefully consider the necessity and proportionality of collecting biometric data before they do so.
"Organisations should consider using a different approach if the same goal can be achieved in a less intrusive manner," it said.
The principal at Great Academy Ashton, in Ashton-under-Lyne, David Waugh, confirmed to the BBC that it had dropped deployment of facial recognition tech.
"The combined fingerprint and facial recognition system was part of an upgrade to the catering cashless system, so that the time it takes to serve students is reduced, thus giving a better dining experience," he said. "However, we will not be using the facial recognition aspect."
Privacy campaigners previously voiced disapproval with Silkie Carlo, director of Big Brother Watch, saying "no child should have to go through border style identity checks just to get a school meal."
Jen Persson, director at digitaldefendme, pointed out that Sweden had issued its first GDPR fine to a school using facial recognition, and data protection folk in France had ordered schools in Marseille to stop the local programme. She told us today:
"We welcome the North Ayrshire decision and it must be made permanent. All UK schools should now follow their lead, and switch from using biometrics of any kind from children, to cashless payment cards, or the least intrusive option available.
"Consent isn't valid as a data processing basis in these disempowered situations, where it's hard to fully understand and consent cannot be truly freely given."
She added that "normalising" a situation where children think that their bodies should be "casually used in these trivial transactions", particularly where consent is a tick in a box, "should be something every adult should recognise as dangerous and unnecessary."
A spokesperson at the ICO told us: "We understand that North Ayrshire Council decided to pause using FRT in schools following our initial enquiries. Our aim is to ensure that children’s data is protected in line with the law and we will continue engaging with the Council on this issue."
The UK government's Surveillance Camera commissioner, Professor Fraser Sampson, told The Register last month that facial recognition tech was "a fast-evolving area and the evidence is elusive but it may be that the aspects currently left to self-determination present the greatest risk to communities or simply to give rise to the greatest concern among citizens."
We have asked CRB Cunninghams to comment. ®