LTKA considers it a matter of considerable regret that despite the widespread use of biometrics in schools for nearly five years, neither the DfES nor the Information Commissioner's office have issued clear and specific guidelines to governors. ( See the Guardian's take on this ).
Over the past few months, we have been approached by a number of governors and head teachers and asked for our understanding of the matter; the following represents the position as far as we are aware. We have sought clarification from a number of leading QCs and barristers in producing these guidelines, and have used our best endeavours to cover as many of the relevant issues as possible. Nonetheless, we cannot be held liable for any inaccuracies or omissions.
Most independent security experts we have approached (ie working outside of the school biometrics firms, their parent companies or subsidiaries) express the view that schools need to exercise the greatest caution in deploying biometric systems in educational establishments. Banks. passport offices and the like have multi-million pound ongoing budgets to secure their biometric systems against abuse. Clearly schools could not hope to match this level of expenditure.
Manufacturers' claims that mere numbers are stored, and not actual scans of fingerprints or irises, etc, do not really hold water in the case of sustained attacks on these systems by professional identity fraudsters who could target these systems in much the same way that cash machines are targeted. Banks have to deploy considerable resources to stay one step ahead of the increasingly sophisticated methods used by fraudsters. The data that could potentially be acquired from these systems could potentially jeopardise a pupil's future ability to interact with the biometric society we can expect in (say) twenty years time, and this could leave a school or LEA open to accusations of serious negligence.
Certainly a standard personal computer connected to a fingerprint scanner lying around in a school library would not generally be considered adequately protected.
The former information comissioner Robert Mechan acknowledged that information obtained from biometric systems in schools could in theory be used (for example) to match data obtained at a crime scene. However in July 2001 he expressed the view, widely quoted in manufacturer's promotional materials. that the use of such technology did not fall within his remit. He did not deny, however, that the school has a duty to safeguard all the information held on biometric systems in accordance with the Data Protection Act.
As you will be aware, school governors are not individually liable - so long as they act in good faith and follow professional advice. There is a corporate liability which would end up ultimately with the Local Authority in most cases. But governors can only be held personally liable in cases of bad faith.
Nevertheless, with some parents already threatening legal action, it would be prudent to ask manufacturers if they are prepared to underwrite whatever liabilities may arise as a result of shortcomings in hardware or software that allow security to be breached.
In a very worrying development German researchers claim they have now succeeded in extracting full fingerprint scans from cheap scanners such as the ones used in schools. If your pupils' biometric data, which cannot ever be changed like a PIN, were to leak into the public domain as the result of such a breach, your school would not only compromise their future ability to have a passport, ID card, or to access their bank account, but you would face the possibility of litigation and multiple claims for substantial damages. If your school is already using, or considering installing, a biometric system, we strongly recommend that you seek the opinion of an independent data security consultant and arrange comprehensive insurance cover for such an event which would place both a considerable financial and time burden on the school. It would be the school and not the LEA, DfES or manufacturers that would bear the full brunt of any legal challenge in such an event.
There is a general recommendation to consult with parents. Schools are being encouraged to engage with parents. Children of engaged parents generally perform better. So the implication of presenting fingerprinting as a fait-accompli is that some parents will be less engaged, even if they don't object formally. If there is no problem with fingerprints then why not consult the parents before implementing such systems?
Governors have a duty to obtain 'best value' for their delegated budget. So an argument could be made that spending significant sums of money on optional modules may not be the best way to use the delegated budget.
We feel that it is important that governors are made aware that the claims made by manufacturers of biometric systems supplied to schools are not uncontroversial. The claims are presented by the manufacturers and their sales representatives as statements of fact, but this is not the case and many experts disagree.
You may be interested to read the document on school biometrics by computer security expert Andrew Clymer, a computer security expert (8 years with Cisco Systems, Visa, Fidelity, Merrill Lynch, etc).
At least one Local Education Authority has already sent out guidelines to all its schools restricting the use of biometrics without express parental consent.
Taking children's biometrics at school may be illegal on several grounds. Article 8 of the Human Rights Act (1998) states that everyone has the right for his private and family life, his home and his correspondence. There shall be no interference by a public authority with the exercise of this right. Fingerprinting children just for a few library books or the morning register seems an unjustified, disproportionate and unnecessary invasion of this fundamental right.
It is highly significantly that central Government have distanced themselves from the issue of legality.
You might be interested to see Janette Owen's view, published in the Guardian, on the position governors find themselves in with regard to the use of biometrics.
You may also be interested in reading, and perhaps contributing to the discussion currently underway on UKGovernors
...and there is a shorter one going on at GovernorNet.co.uk, on the DfES governors site Discussion Board.
click 'back' on your browser to to return to our site OR click here for the main menu