Written evidence submitted by Pippa King (BIO0028)

Summary

Uniquely Britain was the first country worldwide to introduce biometric technology into schools in 2001.  As a consequence the civil population, most probably worldwide, used to biometric technology for everyday use is the youth of Britain as they have been routinely using the technology for over a decade.

UK schools have been using fingerprint, iris scanning, facial recognition, infrared palm and infrared fingertip scanning to verify children’s identity for food, library books, attendance, locker entry and to make payments for school trips.  However the biometric of choice appears to be the fingerprint reader mainly used in secondary schools.  We have a school population of around nine million children, with the technology in some school local authorities as prevalent as 72%[1].

Introduction

I campaigned against the way biometric technology was used in UK schools from 2005 onwards when my two children were nearly fingerprinted without my permission for a school library system when they were six and seven years old.  I lobbied MPs in parliament working with NO2ID, Privacy International and Action on Rights for Children to bring about a change in the law with regards to children’s use of biometric technology.  I assisted Action on Rights for Children’s submission to the Protection of Freedoms Bill Committee on the use of biometric technology used in schools.

The reason for my submission is that uniquely as a member of the public, outside of industry, I have had nearly a decade of experience dealing with biometric technology with children, parents and schools that have been using fingerprint , infra-red palm,  facial recognition and iris scanners in education.  In this I have communicated with local councils, councillors, developers, academics, politicians, privacy organisations, MPs and MEP’s on this subject.  I am also in contact with parents in the USA on this issue.

1   How might biometric data be applied in the future? Please give examples:

1.1   Current use

Biometric technologies are being deployed all over the world at a fantastic rate.  The UNHCR uses biometrics to look at refugee movement[2], Nigeria has partnered with MasterCard implementing a biometric ID[3] card used for travel and banking to its 160 million population.  Police and law enforcement agencies use facial recognition[4] through CCTV[5] to assist crime solving.  Healthcare uses biometrics to verify patients[6]. Cars[7] and telephone SIM cards[8] are traded using biometrics.  China[9] and France[10] are in the process of developing banking systems with integrated biometric ID.  Door locks on cars[11] and homes[12] use biometric ID.  Ireland use facial recognition[13] as verification for state benefits.  Every day tens of thousands of UK citizens are facially scanned[14] in UK shops and shopping centres, done by advertising companies with a view to giving the public the advertisements they need, retail companies in shops to track customer’s eye movements[15] and facial expressions[16] when interacting with products.  This is only a fraction of examples.

The age of biometrics is here and very rapidly rolling out in society for all manner of uses, with localised use in the commercial sector and larger national and international projects emerging, cataloguing populations.  All manner of individual biometrics are taken worldwide, with and without permission.

The most commonly used biometrics in society are fingerprint, facial scans, iris scans and voice.  The more unusual biometrics yet to be used to any great extent are skeletal to measure gait, heartbeat, brainwave, and behavioural traits.

1.2    Future application

The future application of biometric technology will be primarily to authenticate oneself, verification that you are you.  There is also massive scope using biometrics for predicting trends logging population behaviour by movement, facial expressions, eye movements, etc.  The growth in future use appears to be on the back of current trends, to use biometrics for money transactions, including state benefits, traveling (as is used now in the biometric passport), advertising, predicting trends for advertising, population movement, purchases, unlocking computer services i.e. in the home, lighting heating, gaming consoles.

One of the largest recent deployments of biometrics recently is the Federal Bureau of Investigation (FBI) in the use of the Next Generation Identification[17] (NGI) database in biometrics which has over 100 million records, utilizing fingerprint, palmprint and facial recognition data.  Last year the first conviction[18] using facial recognition software behind CCTV occurred in Chicago.  And in the last year facial recognition has been trialled at large crowd event to scan faces.  The ways of applying biometric technology is rapidly growing for many applications to all sections of society, commercial and state run.

The biometric which can be used with increasing accuracy, without user knowledge therefore deployed on massive scale socially, is facial recognition. This particular biometric now can be more accurate than human sight[19] in recognising faces and the potential of this use can only be limited by ones imagination.

1.3   Profiling

Using ones biometrics across many applications can be used to accurately profile an individual’s habits.  Computer programmes exist that enable biometric databases to communicate[20] with one another.  Data mapping habits over many databases has the potential to gather an immense amount of information about an individual and the potential of biometrics enabling accurate identification of one’s data is immense.  However, just because biometric verification enables massive, accurate data sets does not necessarily mean it should be applied when less intrusive methods could be used.

2   What are the key challenges facing both Government and industry in developing, implementing and regulating new technologies that rely on biometric data?  How might these be addressed?

2.1   Performance

As with any system, biometric systems are not perfect.  False positive and false negative can occur and precaution needs to be taken so that such anomalies are flagged and dealt with effectively.  Although very accurate and increasing in accuracy, biometrics alone should not be relied upon for authentication but used as a part of a verification process especially if the impact of such an error could impact on an individual’s right to services, money, travel, etc.

Reliability of systems not only relies on the biometric reading being accurate but also the data logged against it.  If biometrics are to be used alongside other verifiers for one to access a service, the data linking together verifying data fields needs to be secure and accurate.

2.2   Acceptance

2.2.1   Compulsory biometric systems

With state or industry lead biometrics where giving up one’s biometrics is necessary to participate in society, where take up is compulsory i.e the British Passport, people may still choose to opt out putting themselves at a disadvantage thereby denying access to services.  The idea of compulsory biometric identification failed in the UK[21].  Doubts still exist as to, can my fingerprint be duplicated, can a mask bring about a false facial reading, what happens if my biometric data is compromised? What crimes could be committed with you as hostage to your biometrics[22]?   Many people still feel using one’s biometrics is a step too far[23], with governments and corporations having too much insight in an individual’s life.  Once your biometric data is out there exactly how can an individual control their personal biometric data and other data associated with it, where it goes?

At the moment the technology is relatively unknown in society to know what the consequences are of one’s biometrics being compromised, biometrics are not replaceable as a password or pin are.

2.2.2   Voluntary biometric systems

With voluntary biometric systems good efficiency cannot be achieved unless there is a near 100% take up.  This was the situation in schools pushing the technology by not informing parents they were retaining and processing their children’s biometrics so to get a near 100% take up.  Since Chapter 2 of the Protection of Freedoms Act 2012[24] was enforceable in September 2013, dealing with written parental consent for schools to process their children biometrics, take up levels for the technology have dropped[25].  One of the provisions of the Act is that schools have to provide two systems running side by side for those that do not wish to participate.  It is common view by parents that to use a child’s biometrics for daily mundane operation in schools is an excessive level of data to give up in order to access these services when less data/privacy invasive methods are equally as adequate.

The younger generation having used their biometrics generally without question in schools use their biometrics mainly to access mobile telephones and gaming consoles.  Biometrics are becoming more prevalent in the workplace with biometric time systems[26] but the voluntary/compulsory nature of these systems is not without controversy[27].

2.3 Security

Once an individual’s biometric data is compromised how else is that individual to authenticate themselves in a society that, in all probability, will be using biometrics for a variety of purposes?  The challenge then is to provide assurance that the database or data relating to an individual’s biometrics is not compromised or to offer biometric encryption[28] so that the individual has control over who uses their data.

If biometric data needs to be secure for that individual’s lifetime.  Past government failures in data security breaches puts into question whether or not keeping data secure for decades is achievable.  At the moment as biometric technology is not that prolific, nor does it control essential aspects of living in society but there are potential long term problems for an individual if their biometric data is compromised.

3   How effective is current legislation governing the ownership of biometric data and who can collect, store and use it?

3.1   Legislation

The only current legislation dealing specifically with biometric technology in the UK is the Protection of Freedom Act 2012, Chapter 2, The Protection of Biometric Information in Schools.

The salient points of the Act dealing with biometric technology in schools are:

• Each parent of the child should be notified by the relevant authority that they are planning to process their child's biometrics and notified that they are able to object.
• In order for a school to process children's biometrics at least one parent must consent and no parent has withdrawn consent. This needs to be in writing.
• The child can object to the processing of their biometrics regardless of parents’ consent.

As far as is known this is the only legislation globally, specifically dealing with consent for under eighteen year olds and biometric technology.

The effectiveness of the Clauses in the Protection of Freedoms Act 2012 dealing with biometrics in schools has varied having only been in effect since September 2013.  However is appears that consent is gained in various differing ways, despite the Department of Education issuing template letters[29] clearly outlying a parents and child’s  right to consent or not, demonstrating that schools have not fully embraced the issues of consent.  With the legislation being new both schools, parents and children are still coming to terms with the legislation and how consent is obtained.  There is no regulation on how the law is applied and those with knowledge of what their rights are seem to be the ones highlighting when anomalies regarding consent happens.   Many communications on this come through the ‘Biometrics in schools’[30] website.

Apart from legislation in the USA[31] dealing with biometric consent and in Florida’s case banning the use of biometric technology in schools, after over 700 children were iris scanned without parent’s knowledge or consent which resulted in the legislation SB188[32], the author is not aware of any other legislation dealing with the issues of biometric technology and consent.

3.2   Regulation

At the present time there is no regulation on the use of biometrics, except for the use of biometric technology in schools.  There has been two official guidance’s issued on the use of biometric technologies in the UK issued by the Information Commissioners Office[33] and British Educational Communications and Technology Agency[34] (BECTA), now defunct, in 2007.

These guidance’s came after pressure on the government from privacy groups and parents, they were non statutory and were largely ignored by schools.  Schools continued to implement biometric technology asking parents to opt out of the system, rather than asking parents to opt in.  In the process of schools communicating facts about biometric technology to parents the information given to parents and children was supplied by the vendors.  This invariably was weighted information about the technology with mis-information given about how the child’s biometric information could not be accessed by third parties, which is incorrect as detailed in the next section.

3.3 Transfer of biometric data

UK Police may access a schools biometric database to help solve a crime.  In 2007 David Smith, the Deputy Information commissioner revealed this fact to a Home Affairs Committee “A surveillance Society” (See questions 50 and 51)[35].  This is a little known fact and certainly parents and children are not informed that the biometric data may be shared, and possibly potentially be stored on the police Nation Fingerprint Database, when asked for consent for schools to use and process their children’s biometric information.

A Freedom of Information request was sent out in May 2013[36] to all 48 police forces in the UK to determine whether or not this transfer of biometric data had occurred:

4 forces failed to answer the request (8%)

2 forces answered stating they had no information (5%)

4 forces stated no they had not accessed a school biometric database (8%)

38 forces refusing to answer citing cost (79%)

Whether biometric data from a school database has been accessed or been transferred to another agencies biometric database is unclear, nevertheless the potential is there.

3.4 Data Controller

It needs to be very clear who the data controller is.  Data subjects need to be certain who is processing their data.  Confusion can happen when government projects are contracted out to Facility Management companies.

Such a case happened in 2013.  After St Ambrose Barlow School in Salford implemented a biometric system for school catering they were sent a Freedom of Information request by a parent to see who the data controller was of her daughter’s biometrics.  The school had entered into a Public Finance Initiative (PFI) under the Building Schools for the Future (BSF) scheme, consequently there was confusion on the school’s behalf as to who was the data controller was as the Facilities Management company owned the hardware the biometric system was run on.  No detail was given as to who owned the software and the school presumed they were the Data Controller, but there was a confusion as to who actually owned the biometric data.

3.5   Security

In the UK, as previously stated, the only section of society prolifically using biometric technology are school children.  The systems, hardware or software, used in schools have never been tested or seen by any government body.  Therefore the security of the systems can only be commented on by the vendors to schools, with no independent assurance.  There is no industry kite mark to assure data subjects reassurances with biometric technology.

4   Should the Government be identifying priorities for research and development in biometric technologies? Why?

The priority for research and development in biometrics, if the government requires biometrics to be used, in the author’s opinion should be in encryption and licencing.  The question of security and assurance of biometric technology could be backed up with an industry licencing scheme accompanied by robust regulation.  Thereby the public have faith that their biometric data is used only for the purposes intended and that companies running such systems are accountable for that data with possible introduction of a ‘kite mark’ standard.

Encryption his is an area that would warrant further research and development.  Encryption gave an individual a sense of ownership of their biometric, if it was differently encrypted for different systems, and would help allay security fears.

5   Conclusion

Having experienced biometric technology being rolled out in schools across the UK without consulting parents that their children’s biometric data was being processed with no, and then inadequate, regulation eventually resulting with the Protection of Freedoms Act 2012, I would highly recommend open dialogue and transparency when communicating with the public about biometric technology.  Lack of accountability and dialogue has resulted in distrust and some very damaged relationships between school staff and parents.  Lack of communication on this technology is still an ongoing issue in schools.

September 2014