WIREDGOV

New data protection guidance published for schools

DEPARTMENT FOR CHILDREN, SCHOOLS AND FAMILIES News Release (2007/0138) issued by The Government News Network on 23 July 2007

Guidance on how the Data Protection Act 1998 applies to the use of biometric data in schools is published today by Becta, the Government's schools ICT agency.

It advises schools to fully involve parents in any decision to introduce biometric or fingerprint technology to run cashless lunch queues, school libraries and attendance systems.

It restates schools' freedom to run their own affairs - including introducing new technology to free up teacher time and making day-to-day administration easier.

Schools choose biometric systems because they can speed up lunch queues; remove the need for children to take money into schools and remove any stigma with peers from pupils claiming free school meals because they are not identified. They also mean schools do not have to pay for the replacement of lost swipe cards and other identification.

Head teachers also choose to introduce biometric attendance systems at the school gate to save teachers time in taking registers and prevent unauthorised access to school premises. Similar systems can be used to record pupils' attendance at each class to identify whether particular pupils are not attending particular classes - and prompting schools to take action.

Today's guidance underlines that headteachers and governing bodies should be clear and open with all parents and pupils about this and all aspects of their education.

This could involve explaining what biometric technology is; how it will be used; what is involved; what data will be held and stored; why it is required; how it will be secured; and how long it will be retained.

It also advises that schools should recognise some parents' or pupils' concerns over the introduction of biometric technology and offer alternative systems, like smartcards, to access the same services if they want to opt out.

The guidance also describes how biometric systems are designed simply to validate a pupil's identity - not hold any other data. It is stored as complex algorithms or number streams, from which it is currently technically impossible to recreate an actual fingerprint image.

The guidance, produced in conjunction with the Information Commissioner, sets out how Data Protection Act 1998 applies to the use of biometric data in schools - building on Becta's existing guidance on data security and the data protection law.

The Data Protection Act requires that:

* schools cannot use biometric information other than for the express purpose for which it was collected. This means that data taken for the use on in a library, can only be used for that purpose;

* schools process all personal data fairly and lawfully. This means that schools ensure that all pupils, or their parents if schools judge they cannot understand, know what personal information they have on record and how they intend to use it;

* schools cannot pass on biometric information to any outside organisation nor can third parties access this information;

* schools cannot keep personal data for longer than it is needed for its specified purpose. Pupils' biometric data should therefore be destroyed when they have left the school.

* schools put appropriate security in place to safeguard personal data from unauthorised processing and accidental loss, destruction or damage. Becta gives clear guidance to schools on data and ICT security.

Schools Minister Jim Knight said:

"Becta and the Information Commissioner already give schools clear guidance on how to comply with the Data Protection Act. This additional guidance helps schools by confirming how the law relates to biometric data and advice to schools on operating within it.

"I have seen at first hand how well these systems work. They can speed up lunch queues, remove the need for children to carry money and take away the stigma of singling out those on free school meals. Moreover, they can enable schools to register pupils more easily as they move from class to class.

"I want parents to be fully engaged with every aspect of their children's education - this is at the heart of today's guidance. We give schools complete freedom to run their own affairs and I back every head teacher's right and professional judgement to choose technology to improve their day-to-day running. But it's plain common sense for them to talk to parents about this and all issues relating to their pupils to demystify how schools operate.

"Schools are well used to handling sensitive information like attendance registers, behaviour records and home addresses. But we are absolutely clear that they have to comply with data protection laws. That means that this data can only be used for its stated purpose; cannot be shared with third parties beyond this stated purpose; and it must be destroyed when a pupil leaves their school".

Becta Chief Executive Stephen Crowne said:

"This guidance makes it clear to schools what their responsibilities are under the Data Protection Act.

"Each school must make their own decisions over the systems they employ. Biometric technology can offer a means for streamlining the day to day running of the schools, but they must be aware of the sensitivities that surround this technology. Schools must ensure that they engage fully with parents and pupils and consider the provision of alternative systems if there are strong objections to the use of biometric technology.

"Becta and the Information Commissioner give clear advice to schools on data protection and ICT security. Becta leads the national drive to improve learning through technology. We do this by working with industry to ensure we have the right technology for education in place."

NOTES TO EDITORS

1. The guidance is published at: http://industry.becta.org.uk/display.cfm?resID=14615

2. The guidance sets out how biometric technology can underpin a range of systems supporting the efficient management and security of schools and other educational establishments. There follows some examples of such systems showing the role that biometric technologies can play in them. However such systems do not have to be supported by biometric systems and identification mechanisms (such as smartcards) can provide similar benefits.

Example 1 - Cashless catering

School A uses a cashless catering system for school meals. Parents pay in advance for pupils' school lunches, crediting the pupils' accounts with the amount paid in. Pupils then use this credit to pay for their school lunches. Individual pupils are identified at the till by an automated mechanism, with the cost of their lunch being deducted from the credit paid for by the parent.

There are several advantages to cashless catering. Pupils in receipt of Free School Meals are not identifiable, which can help to avoid a pupil being stigmatised. In addition, pupils do not need cash to pay for their lunches, reducing the opportunity for bullying and theft. Such systems can also speed up service in canteens and dining rooms.

In this instance, biometric technologies can offer some additional advantages over other identification mechanisms:

* pupils do not need to remember to bring anything with them to the canteen and there is nothing that can be lost;

* costs can be reduced as, for example, there is no requirement to replace lost or damaged smartcards;

* the risk of bullying and theft may be further reduced, as there is no opportunity for pupils to steal and use other pupils' smartcards to pay for meals.

Example 2 - Automated attendance and registration

School B uses an automated system for recording attendance. Pupils register via an automated mechanism at the school gate or entrance at the start and end of each day. Such systems can save considerable staff time and effort in taking registers. They can also help prevent unauthorised access to school premises.

School C takes this one step further by recording pupils' attendance at each class, so that truancy on the premises (which can be a problem in a large school) is recorded and can be dealt with, including by informing parents. The time spent while each pupil "keys in" for each class is minimal. Attendance data can also be used to help assess the impact of truancy on performance allowing any necessary steps to be implemented rapidly.

The advantages of employing biometric systems over other technologies are similar to those in the previous example. In addition, in this particular example, there is no opportunity for pupils to register absent pupils using their smartcards. Pupils must be physically present to register their attendance.

Example 3 - School library automation

School D uses biometric technology to help manage lending from the school library. An automated system identifies and records the pupil's name and the items they have borrowed or are returning. The advantages are similar to those outlined in the previous examples, in that,

* pupils do not need to remember to bring anything with them to use the library and there is nothing that can be lost, stolen or exchanged;

* there is reduced opportunity for bullying and theft; pupils must be physically present to borrow items and cannot use another pupil's identity to do so.

3. Further sources of information include:

* The ICO has also published technical guidance notes for schools in England, Wales and Northern Ireland on their responsibilities under the Data Protection Act regarding requests for access to pupils' information. This is available at: http://www.ico.gov.uk/tools_and_resources/document_library/data_protection.aspx

* Data processing and sharing: DCSF guidance to the law (Information on Data protection, the Human Rights Act and other related areas of law, largely in chapter 2 and Appendix 1: http://www.teachernet.gov.uk/management/atoz/d/dataprocessing

* Functional specification: institutional infrastructure, published by Becta, November 2005. http://industry.becta.org.uk/display.cfm?resID=14612

* Technical specification: institutional infrastructure, published by Becta, January 2007. http://industry.becta.org.uk/display.cfm?resID=14615

PUBLIC ENQUIRIES:0870 000 2288
info@dcsf.gsi.gov.uk

INTERNET ADDRESS :http://www.dcsf.gov.uk
http://www.dcsf.gov.uk/findoutmore

If you would like to receive email notification of new press notices in the subjects of your choice, please click on 'register' on our site:
http://www.dcsf.gov.uk, 'Latest News'.