« Previous | Contents | Next »
Listen
Consideration of the introduction of biometric systems
8. Issues to be carefully considered before electing to put in place a biometric system
8.1 An important question to be addressed when considering the installation of a biometric system is whether there is an identified need for this type of technology and its potential impact for data subjects, by considering factors such as:
- the school environment - does the nature of the school or college environment require high levels of security?
- existing systems - is the adequacy, efficiency or reliability of existing systems in doubt, such that a new solution is required?
- has there been an examination of a number of types of system solutions, both biometric and non-biometric that are available?
- what are the evidenced benefits of a biometric system over other options?
- could an alternative such as a smartcard be a less intrusive solution and provide the same outcome?
- has a privacy impact assessment been carried out (see 8.4 below)?
- can the biometric system provide transparency of operation, accuracy of data and appropriate security, to ensure the principles and requirements of the Act are met?
- is the biometrics application a self-contained system, whose templates cannot readily be used by computers running other fingerprint recognition applications?
- can an effective and user friendly system be put in place for pupils who wish to opt out of any biometric system?
- is the authority confident that pupils who are unable to provide biometric data, because of a disability for example, will not be discriminated against by being required to operate a different system?
8.2 Education authorities are reminded that it is not necessary to introduce biometric systems to meet the duty set out in the Schools (Health Promotion And Nutrition) Scotland Act 2007, to take reasonable steps to ensure that those in receipt of free school meals cannot be identified as such by anyone other than an authorised person. There is a variety of ways in which this can be achieved, which do not require a biometric type solution, e.g. smartcards. Given the necessity to cater for those wishing to opt out (section 9.6 below) and to take account of those with disabilities (section 15 below), a biometrics based system probably cannot be justified purely as a response to this requirement of the Act.
8.3 It is essential that the views of parents and pupils on the introduction of such technology should be sought by education authorities at this early stage.
8.4 A Privacy Impact Assessment is a risk management technique. The Information Commissioner's Office notes that:
"Projects that involve personal information or intrusive technologies inevitably give rise to privacy concerns. Where the success of a project depends on people accepting, adopting and using a new system, process or programme, privacy concerns can be a significant risk factor that threatens the return on the organisation's investment. In order to address this risk, it is advisable to use a risk management technique commonly referred to as a Privacy Impact Assessment ( PIA)."
A Privacy Impact Assessment Handbook is available online at the website of the Information Commissioner's Office www.ico.gov.uk or by following this link ICO - Privacy Impact Assessment.
« Previous | Contents | Next »