The use of facial recognition technology deployed in a number of school canteens across the UK has been put on hold for the time being after the Information Commissioner's Office (ICO) intervened to ask some questions.
Some nine schools in North Ayrshire, which is a Scottish authority that includes the Isle of Arran, were scheduled to start processing payments for school meals via facial scanning technology.
This was intended to speed up the delivery of lunches from an average of 25 seconds to five, and potentially reduce COVID-19 infections compared to card payments and fingerprint scanners.
However, campaigners told The Reg last week that using facial recognition in canteens was the wrong solution given the highly sensitive and personal nature of the data, which was to be stored on school servers.
North Ayrshire Council confirmed on 22 October it is pausing the use of the tech, saying: "Having received a number of enquiries in recent days, we have temporarily paused the contactless payment system, which uses facial recognition, in our secondary schools from this afternoon while we consider and respond to the enquiries received."
The Council has said that 97 per cent of parents, carers and children had consented to the use of facial scanning.
"Whilst we are confident the new facial recognition system is operating as planned, we felt it prudent to revert to the previous PIN (Personal Identification Number) system while we consider the enquiries received."
The company behind the system, CRB Cunninghams, announced the introduction of the tech in June as the "next step in cashless catering". David Swanston, the MD of the supplier, said the cameras would verify the pupils' IDs against "encrypted faceprint templates. Some 65 schools had signed up to the deployment," he told the FT.
UK data watchdog, the ICO, told us last week it was "making enquiries with North Ayrshire Council with regards to the processing of pupil's faces."
It said: "Organisations using facial recognition technology must comply with data protection law before, during and after its use.
"In addition, data protection law provides additional protections for children, and organisations need to carefully consider the necessity and proportionality of collecting biometric data before they do so.
"Organisations should consider using a different approach if the same goal can be achieved in a less intrusive manner," it said.
The principal at Great Academy Ashton, in Ashton-under-Lyne, David Waugh, confirmed to the BBC that it had dropped deployment of facial recognition tech.
"The combined fingerprint and facial recognition system was part of an upgrade to the catering cashless system, so that the time it takes to serve students is reduced, thus giving a better dining experience," he said. "However, we will not be using the facial recognition aspect."
Privacy campaigners previously voiced disapproval with Silkie Carlo, director of Big Brother Watch, saying "no child should have to go through border style identity checks just to get a school meal."
Jen Persson, director at digitaldefendme, pointed out that Sweden had issued its first GDPR fine to a school using facial recognition, and data protection folk in France had ordered schools in Marseille to stop the local programme. She told us today:
"We welcome the North Ayrshire decision and it must be made permanent. All UK schools should now follow their lead, and switch from using biometrics of any kind from children, to cashless payment cards, or the least intrusive option available.
"Consent isn't valid as a data processing basis in these disempowered situations, where it's hard to fully understand and consent cannot be truly freely given."
She added that "normalising" a situation where children think that their bodies should be "casually used in these trivial transactions", particularly where consent is a tick in a box, "should be something every adult should recognise as dangerous and unnecessary."
The UK government's Surveillance Camera commissioner, Professor Fraser Sampson, told The Register last month that facial recognition tech was "a fast-evolving area and the evidence is elusive but it may be that the aspects currently left to self-determination present the greatest risk to communities or simply to give rise to the greatest concern among citizens."
We have asked CRB Cunninghams to comment. ®
MongoDB CTO Mark Porter: 'It is 34 per cent compatible, through our tests'
PostgreSQL a better option for open source RDBMS, he claims
Does anyone have the stones to revive this long-forgotten software?
Put crypto back in the crypt
Plus: A drug designed by machine learning algorithms to treat liver disease reaches human clinical trials and more
Your four-legged open-source friend? CIMON says 'Maybe'
Q&A with the developer of BetterDummy: from macOS secrets to his motivations