School is slammed by watchdog for illegally installing facial recognition cameras in lunch canteen without consulting parents or pupils

An Essex school broke the law when it installed facial recognition cameras in its canteen, the data watchdog has ruled.

The Information Commissioner’s Office (ICO) has reprimanded Chelmer Valley High School, in Chelmsford, saying it should have consulted parents and students before installing the cameras.

The school began using facial recognition technology in March 2023 to take cashless payments from students in the lunch hall.

The controversial technology has been pitched as making the payment process for meals quicker and more hygienic than using cards or fingerprint scanners. 

The cameras process biometric data to uniquely identify students, which is likely to result in high data protection risks, the ICO warned.

Chelmer Valley High School (pictured), in Chelmsford, has been reprimanded by the Information Commissioner’s Office (ICO) for installing facial recognition cameras in its canteen without consulting parents or pupils

The hugely-controversial system has been pitched to make the payment process for meals quicker and more hygienic than using cards or fingerprint scanners (stock image – not a pupil at Chelmer Valley High School)

To use it legally and responsibly, organisations must have a data protection impact assessment (DPIA) in place. 

This is to identify and manage the higher risks that may arise from processing sensitive biometric data. 

Chelmer Valley High School, which has around 1,200 pupils aged 11-18, failed to carry this out before starting to use the cameras, the ICO said.

This meant no prior assessment was made of the risks to the children’s personal information. 

The school had not properly obtained clear permission to process the students’ biometric data and the students were not given the opportunity to decide whether they did or didn’t want it used in this way.

Lynne Currie, head of privacy innovation at the ICO, said: ‘Handling people’s information correctly in a school canteen environment is as important as the handling of the food itself. 

‘We expect all organisations to carry out the necessary assessments when deploying a new technology to mitigate any data protection risks and ensure their compliance with data protection laws.

‘We’ve taken action against this school to show that introducing measures such as FRT [facial recognition technology] should not be taken lightly, particularly when it involves children. 

‘We don’t want this to deter other schools from embracing new technologies. But this must be done correctly with data protection at the forefront, championing trust, protecting children’s privacy and safeguarding their rights.’

In March 2023, a letter was sent to parents with a slip for them to return if they did not want their child to participate. 

Affirmative ‘opt-in’ consent was not sought at this time, meaning until November 2023 the school was wrongly relying on assumed consent from parents who had not specifically opted out.

The law does not deem ‘opt-out’ as a valid form of consent and requires explicit permission. 

The ICO’s reprimand also notes most students were old enough to provide their own consent, and therefore, parental opt-out deprived students of the ability to exercise their own rights and freedoms.

A spokesperson for Chelmer Valley High School said: ‘We accept the report’s recommendations and took action last year to ensure proper consent is gained when students use the cashless canteen. This includes having the choice to opt in or out as desired.’

 In 2021 another scheme to use facial recognition software to scan pupils in school canteens has been suspended after privacy concerns were raised by Britain’s data watchdog.

Nine schools in North Ayrshire, Scotland, became the first in the UK to start using the system on a long-term basis last week after a pilot project in Gateshead in 2020.

But its rollout was paused just days after launch after concerns were raised by privacy groups and the Information Commissioner’s Office. The ICO responded to the plans by saying that organisations should consider a ‘less intrusive’ approach.

Campaign group Big Brother Watch, which wrote to schools in the area urging them to drop the scheme, has called on councils to introduce a permanent ban on facial recognition in schools.

The group’s director Silkie Carlo previously told MailOnline: ‘No child should have to go through border style identity checks just to get a school meal. We are supposed to live in a democracy, not a security state.

‘This is highly sensitive, personal data that children should be taught to protect, not to give away on a whim.’