Chapter 2 of Part 1: Protection of biometric information of children in schools etc.
Section 26: Requirement for consent before processing biometric information
140.Subsections (1) to (3) provide that proprietors of schools or the governing bodies of colleges must notify the parents of a child that they intend to process the child’s biometric information and that parents may object, in writing, to the processing. If no parent objects to the processing, the written consent of only one parent will be required. A child means any person under the age of 18 (see section 28(1)). Consent under this provision is only required if the information is to be used for the purposes of an automated biometric recognition system (defined in section 28(4)), such as a finger-print recognition system.
141.Subsection (5) provides that proprietors of schools and the governing bodies of colleges must not process, or continue to process, a child’s biometric data if that child objects to its processing, irrespective of the child’s age, maturity or ability to understand. This is the case even if consent has been given by a parent to the information being processed.
142.Subsection (7) requires schools and colleges to provide a child with a reasonable alternative to an automated biometric system where the child objects to the processing of his or her biometric information, or where any parent objects in writing to such processing. Such alternatives must allow the child to access any facility (for example, library facilities) that they would have had access to if using the biometric system, and to be subject to any monitoring or control (for example, monitoring of attendance) that they would have been subject to if using the biometric system.
Section 27: Exceptions and further provision about consent
143.Subsection (1) sets out certain exceptions to the requirement that consent be obtained from a parent including circumstances where a parent cannot be found, a parent lacks the mental capacity to consent and where the child’s welfare requires that a parent is not contacted.
144.Subsection (2) provides that a notification from the school or college to parents about the processing of biometric information must be made in writing and that any objections from parents must also be in writing. Where consent is given verbally, the school cannot process the child’s biometric information; any withdrawal of consent must also be in writing.
145.Subsection (3) provides that consent given by a parent to a school or college to process their child’s biometric data can be withdrawn at any time. Subsection (4) provides that consent must be given, and (if withdrawn), withdrawn, in writing. Once consent is withdrawn, the proprietors of the school or college must stop processing the child’s biometric data. The Data Protection Act 1998 will, in such circumstances, require that any personal data held by the school or college for the purposes of a biometric identification system must be destroyed; the school or college should do so as soon as practicable.
Section 28: Interpretation: Chapter 2
146.This section defines various terms used in Chapter 2 of Part 1.
147.Subsection (2) defines ‘biometric information’ as information about a person’s physical or behavioural characteristics or features from which he or she can be identified, and which have been obtained or recorded so that it can be used for the purposes of an automated biometric recognition system. Subsection (3) provides a non-exhaustive list of biometric information that includes data pertaining to fingerprints, skin patterns, features of a person’s palm, features of a person’s eye, and information about a person’s voice or handwriting. Subsection (4) defines a biometric recognition system as a system which operates automatically and processes biometric information in order to recognise or identify an individual.
148.Subsections (5) to (8) define who is a ‘parent’ for the purpose of Chapter 2. The definition is such that, under section 26, consent must be obtained from a child’s mother, father or any other individual who has parental responsibility for the child. Subsections (6) to (8) apply where it has not been possible to obtain consent from any of these individuals; in such circumstances consent is to be sought from the child’s carers unless the child has been placed with the carer by a local authority or a voluntary organisation, in which case, parental consent must be obtained from the local authority or, as the case may be, the voluntary organisation.
