PI publishes UK guide to facial recognition in schools

Privacy International (PI) has published new guidance for UK educators and pupils examining the deployment of facial recognition technology (FRT) within educational institutions, outlining legal obligations, operational risks, and practical responses.

PI highlights that educational technology (EdTech) vendors increasingly market biometric systems to automate attendance tracking, monitor classroom conduct, and manage canteen transactions, citing nine secondary schools in North Ayrshire that adopted facial recognition at dining tills. Because FRT converts facial images into unique biometric prints that can be stored indefinitely, shared with external parties, or repurposed to train artificial intelligence (AI) systems, PI warns that school environments create acute privacy concerns. Given the statutory obligation to attend school, true consent is severely compromised by the systemic power imbalance between institutions and minors, echoing a precedent where the Swedish data protection regulator fined an institution €20,000 for using FRT for attendance.

The guide outlines multiple harms, including discriminatory misidentification affecting minority and gender non-conforming groups, security vulnerabilities leading to personal data breaches or commercial exploitation, and limiting free expression. 

Training announcement: Freevacy provides comprehensive training for new and existing practitioners on the changes introduced by the DUA Act to the UK General Data Protection Regulation (GDPR), the Data Protection Act 2018 (DPA18), and the Privacy and Electronic Communications Regulations 2003 (PEC-Regulations). Our courses are always up to date and provide a forum for learning and discussing how to ensure your data protection processes remain compliant. Find out more.