Nine schools in Scotland have started using facial recognition technology to speed up canteen queues during pupils’ lunch breaks. Starting today, the schools in North Ayrshire will be using facial biometrics to allow contactless payments of meals, instead of using fingerprint scanners or card payment systems already in place.
Although North Ayrshire council said that 97% of children or their parents had given consent to the implementation of the new system, experts have raised concerns about the implications that normalising facial recognition in schools might have – as well as the possible GDPR implications that could lie ahead.
Who is deploying facial recognition in the schools?
In August, North Ayrshire Council published a notice on its website announcing that from October 18, a new system called iPayimpact would be introduced to allow touchless meal payments removing the need “to bring cash and cheques to school making all school purchases completely cashless.” Those students who do not want to use iPayimpact can opt out and continue using a PIN verification service.
According to CRB Cunninghams, the company deploying the facial recognition technology in the North Ayrshire schools, the system can cut the average transaction time for a pupil paying their lunch to five seconds. Speaking to The Financial Times, CRB Cunninghams’ managing director, David Swanston, said that facial recognition is the fastest way to recognise someone at the till.
“In a secondary school, you have around about a 25-minute period to serve potentially 1,000 pupils. So we need fast throughput at the point of sale,” Swanston told The Financial Times. The system, which is different from live facial recognition, was piloted by Kingsmeadow Community school in Gateshead in the summer of 2020.
In March, North Ayrshire Council published a tender notice for a contract valued up to £340,000 for three procurement lots, including a cashless catering system, an online payments system and kitchen management software. A contract award notice seen by Tech Monitor shows that the first two lots were awarded to Cash Registers (Buccleuch) Limited, a company acquired by CRB Cunninghams in 2013.
Earlier this year, CRB Cunninghams was also awarded a £32,000 contract with the Leathersellers’ Federation of Schools in south-east London to provide cashless payment systems. Tech Monitor attempted the contact the Federation to ask if the group will also be implementing facial recognition technology, but had not received a response at the time of publication.
What are the risks of using facial recognition in schools?
Paul Bernal, professor of information technology at the University of East Anglia, says there are two main risks of using facial recognition in schools: data security and the normalisation of facial recognition. On the first, he said that biometric data is permanent and as such it needs to be held completely securely to avoid its compromise and fraudulent use.
“Do the companies, schools, and even councils have the ability to keep it securely?” asks Bernal. “Anyone who’s worked in schools knows that the IT is always breaking down. Can the companies be trusted? They will be looking to monetise their data – that’s the nature of the beast.”
On the risk of normalising facial recognition, Bernal says that once children get used to giving up their biometric data, they lose the sense of its value and facial recognition becomes the norm for any kind of check: “which means a surveillance regime that just grows and grows.”
In the US there is a major debate about the use of facial recognition in schools. Although its supporters argue that it could prevent mass shootings and stop sexual predators, campaigners warn about the racial bias and privacy concerns of implementing such systems.
Bernal is sceptical about the benefits that implementing facial recognition in schools could bring and thinks the ulterior motive behind it is financial.
“Tech companies want to make more money,” said Bernal. “Then they have a foot in the door, and can sell the same tech to more places, and apply it to more situations. It’s a classic ‘slippery slope’.”
He adds that there are many ways to deal with serving school meals that can bypass the 'queues at the till' problem without the need for facial recognition. These could include having children paying for their meals in advance. "Use a payment model that isn’t item-by-item, but meal by meal, and there's no need for tech," he says.
Another way of avoiding queues and the need to make them faster is making lunchtimes longer, added Bernal. According to some nutrition studies, a 30-minute lunch break allows students to have the recommended 20 minutes of seat time. Among the benefits of pupils having a longer lunchtime are increased consumption of food and key nutrients, eating more fruit and vegetables and less food waste.
What about GDPR?
An additional problem that could lie ahead for schools deploying facial recognition in British schools is the data protection legal hurdles it could face.
In 2019, two Swedish and French schools were fined by their national data protection authorities (DPAs) after implementing facial recognition tech in schools to keep track of students’ attendance and control entry access. Both Sweden and France’s DPAs found a breach of GDPR, and the Swedish DPA fined the public authority managing the school €20,000 – the first GDPR fine issued by the Swedish DPA. It was ruled that the school had processed sensitive biometric data unlawfully and failed to do an adequate impact assessment including seeking prior consultation with the Swedish DPA.
Though Britain is set to move from GDPR to its own post-Brexit data regime, for the moment it remains signed up to the European rules, and Dr Sam De Silva, technology and data partner at the law firm CMS, says something similar could happen in the case of the North Ayrshire Council if it is found that consent was not enough in this context.
“Whilst it is arguable that the proposed system by the Scottish schools is different to ‘live facial recognition’ or LFR, the subject of the detailed opinion by the Information Commissioner's Office (ICO) issued in June 2021 [information commissioner Elizabeth Denham said she believed LFR was often being used 'inappropriately, excessively or even recklessly'], the important question whether consent is the most appropriate legal basis for the processing of the facial images, still needs to be addressed and considered,” De Silva says. “It would also be interesting to see the Data Protection Impact Assessment, if any, undertaken by the schools as part of the implementation of the solution.”
University of East Anglia’s Bernal added that the main issue in the UK is that the ICO, which is the country’s DPA, is not nearly as strong a regulator as many European DPAs, and favours a “light touch” approach in most areas. On Monday the ICO said it would be "making inquiries" with Ayrshire County Council about the system. “We need to be very careful about this," Bernal adds. "It’s a form of tech which has huge implications that we’re still not facing up to.”
CRB Cunninghams had no one available for comment when approached by Tech Monitor.
