In the UK, schools hold vast amounts of data on children – they are among the most monitored school populations in the world, not just in terms of their academic subjects, health and eating habits, but also through the use of biometric and geolocation RFID tags.
Between 2001 and 2012, biometric systems in education were first used for library systems in primary and secondary schools. By 2006, biometrics were increasingly being used for cashless catering, school lockers, and payment and registration for school trips.
In 2005, privacy groups and parents concerned about the use of biometrics in schools began lobbying Congress, focusing particularly on the fact that schools were biometrically identifying students without parents' knowledge.
An individual's biometric data does not fall under “sensitive personal data” under Part 2 of the Data Protection Act (DPA). In the case of a child, a school needs parental permission to use sensitive personal data. Therefore, as biometric data does not fall within this category in the DPA, a school can use a child's biometric data and does not have to inform parents.
The Protection of Freedoms Act was passed in May 2012, imposing obligations on schools to:
We will inform each parent of the child of our intention to process their child’s biometric information and that the parent may object at any time.
Under the Act, schools cannot process a child's biometric information unless:
At least one parent has consented, and neither parent has withdrawn or objected to the consent
If a child refuses at any time, the school cannot process the child's biometric information.The Act came into force in September 2013 and is the world's first national law on consent for children's biometric data.
Since 2001, private biometric companies have had free rein to the UK school market and children across the country. This has been extremely lucrative for the biometric industry, with many different types of biometric technology being tested on UK children, including fingerprint scanners, infrared face scans, iris scans, infrared palm scans and infrared fingertip scans.
An institution that obtains and uses a child's biometric information without parental permission sends a fundamental message to children: it devalues parental involvement in their upbringing and impresses upon children that the institution is responsible for making these types of decisions.
The issues raised by using biometrics of children in schools are manifold. Privacy, civil liberties, possible discrimination, violation of religious ethics, unnecessary surveillance etc. are some of the areas to consider that could have serious consequences if biometric data falls into the hands of “bad actors”. The development of technology combined with the establishment's views on the use of such databases could lead to the infringement of children's privacy and may lead these children to become accustomed to accepting high levels of surveillance even as adults.
From an early age, children grow up surrounded by a variety of technologies: baby monitors, radios, televisions, remote controls, iPods, iPads, bank cards, mobile phones, etc. Different technologies come with different responsibilities, and parents have a legitimate duty to ensure that their children use technology appropriately as they grow up. Part of this right has been arbitrarily taken away by schools when it comes to children's use of biometric technology.
With the impending date when schools will be required to obtain parental consent under the Freedom Act, this could spell the end of the era for biometric technology in UK schools and lead to regulations removing the technology from the UK school market. With the possibility of biometrics disappearing in schools and creating a technology vacuum, we can look to the US where RFID appears to be on the rise.
RFID – Radio Frequency Identification
There are essentially two types of RFID tags or chips: Passive RFID tags are dormant until they are placed within a few feet of a reader/receiver, which wakes up the tag, exchanges information and then powers off when the tag is moved away from the scanner. Active RFID tags have their own power source and continuously emit radio waves to transmit data to the receiver. Oyster cards, and increasingly credit and debit cards, have passive RFID tags built into them, and some schools in the UK use passive RFID for registration and copying.
If you see this symbol on a card, you can assume that the card contains an RFID tag that can communicate with a receiver, and if you are in a building that displays this symbol, there is a good chance that there is a receiver installed that can communicate with RFID tags.
Passive RFID tags were introduced in US schools in 2004, and active location tracking RFID tags in 2008. In 2007, Hunger Hill High School in Doncaster, UK, trialed RFID chips embedded in school blazers, which was heavily criticised by human rights groups and widely reported around the world. The trial was quickly halted. Since 2007, there have been no reports of active RFID tags tracking pupils in UK educational institutions until recently.
In May 2012, The Daily Telegraph and the Times Educational Supplement (TES) ran articles about British universities using RFID to track student movements. The articles detailed how West Cheshire College, a specialist school for 14-19 year olds with 20,000 students, uses active RFID tags to monitor student movements in real time.
West Cheshire College is believed to be the first in the UK, and possibly the entire EU, to RFID tag students. There is no mention of tracking RFID on the West Cheshire College website, but the following information is taken from RFID Journal and RFID supplier Zebra Technologies:
- Ultra-wideband RFID tags emit short radio frequency signals across the entire 6.35-6.75 GHz frequency band (close to Wi-Fi frequencies).
- The school introduced the technology in two phases, first at its Chester campus in 2010, and then at its newly built Ellesmere Port campus in 2011.
- The average battery life of a tag is seven years.
- Receivers that can pick up tag signals from up to 100 meters (328 feet) away are installed throughout campus buildings.
- It is designed to provide accuracy better than 1 meter (3.3 feet).
- The tag transmits once per second.
- Universities can view peer group affiliations for students and faculty
West Cheshire College has received various Freedom of Information requests about their RFID system, which are publicly available on Whatdotheyknow.com. Some of the requests have been answered, but some have not been fully answered. One such is how consent was obtained to track students; this is currently the subject of a formal complaint to the Information Commissioner's Office as of February 2013.
Privacy, Civil Rights, and Background Verification
The potential for human, privacy, and civil rights violations from RFID tags tracking humans in real time is far reaching, especially for children and students. RFID tracking, surveillance of groups, can discourage individuals from exercising their rights to freedom of thought, speech, and association. There are obvious privacy issues with staff knowing the exact real-time location of individual students, such as in restrooms, showers, or to the school nurse. Tagged students may be observed participating in sensitive groups or activities such as LGBT (lesbian, gay, bisexual, and transgender membership) or utilizing the college nurse for private, personal reasons. Also, RFID tracking systems only track tags. If a student does not have a tag, false inferences may be made about a child's whereabouts even when the child is not actually on the premises.
Apart from the privacy issues surrounding active RFID, well-documented health concerns have emerged surrounding Wi-Fi systems, cell phone use, smart meter use, etc. Active RFID tags worn on a lanyard around the neck could have unexpected health effects.
The benefits that RFID location systems bring to schools seem to be increasingly driven by financial pressures to increase attendance numbers for funding purposes. This is an attractive money-saving measure with the opportunity to consolidate student data and use of the system within the school. A unique feature of active RFID technology is that individuals do not need to take any conscious or physical action to identify themselves to interact with a data processing system; that is, placing a fingerprint on a scanner, swiping a card, or carrying a tag is enough. RFID is a “ubiquitous” technology, a phrase that is increasingly used in the contactless technology industry.
Children's identities and data held by schools are valuable not only to the government and private companies currently involved in UK education, but above all to children. Children's identities, what is stored on their identities, who has access to them, how secure their identities are, and how their identities are used may affect our children for years to come. Perhaps we need to not only enable and encourage children to participate in these systems, but also teach them about the value of the data being exchanged and that there is a choice in this. It is paramount that they can choose whether or not to participate in such systems, without compromising their rights and access to services, but with the “Internet of Things” technologically on the horizon, this may not be so easy.
We have very advanced technology in our society, and we need to use that technology responsibly, with honesty, and with thorough, open discussion and consideration for those who disagree with its use.