Policy: Biometric Data Usage

Policy details

• Date approved - 08/09/2024
• Next review date - 08/09/2026

This policy outlines the legal obligations of Co-op Academy Belle Vue regarding the use of biometric information for automated biometric recognition systems.

Key Points

Data Protection Compliance:

Schools that use students' biometric data must handle this information with care and comply with the data protection principles outlined in the Data Protection Act 1998.

When biometric data is utilised as part of an automated biometric recognition system, the academy must also adhere to sections 26 to 28 of the Protection of Freedoms Act 2012.

Parental Notification and Consent:

The academy must notify each parent of our intention to use their child's biometric data as part of an automated biometric recognition system.

Written consent from at least one parent is required before any biometric data is collected or processed. This requirement applies to all students under the age of 18. No biometric data will be processed without obtaining this consent.

Pupil and Parental Rights:

The academy will not process a student’s biometric data if the student objects, if no parent has provided written consent, or if a parent objects in writing, even if another parent has given consent.

The academy will offer reasonable alternative methods for accessing services for students who do not participate in the biometric system.

What is Biometric Data?

Definition:

Biometric data refers to personal information based on an individual’s physical or behavioural characteristics that can identify them, such as fingerprints, facial patterns, retina or iris data, and hand measurements.

Legal Considerations:

Biometric data is considered personal data under the Data Protection Act 1998 and must be obtained, used, and stored in compliance with this Act.

The Protection of Freedoms Act 2012 imposes additional requirements for using biometric data in schools when such data is used in automated biometric recognition systems.

Processing of Biometric Data

Definition:

Processing includes any operation on biometric data, such as collecting, recording, storing, or comparing the data within an automated system.

For example, the academy processes data when it records a student’s fingerprint via a scanner or uses stored data to identify or recognize students.

Legal Framework: Protection of Freedoms Act 2012

Notification and Consent:

The academy must inform each parent if we intend to collect and use their child's biometric data.

Consent from only one parent is required, provided the child or other parent does not object. Any objections from a child must be respected, regardless of parental consent.

Exceptions:

In cases where a parent cannot be notified or is unable to consent (e.g., due to mental incapacity or safety concerns), the academy will seek consent from other authorised persons, such as local authorities or caregivers.

Parental Responsibility:

Schools must maintain an admissions register with the contact details of both parents. If a parent's details are missing, reasonable steps should be taken to locate them.

Pupil’s Right to Refuse:

If a student objects to the processing of their biometric data, the academy will not proceed with collecting or using the data. The student's refusal takes precedence over any parental consent.

Providing Alternatives

The academy will offer reasonable alternative arrangements for students who do not participate in the biometric system, ensuring they can still access all services without disadvantage.

Data Protection Act 1998 Compliance

Data Security:

As data controllers, the academy must process biometric data in accordance with the Data Protection Act 1998. This includes securely storing the data and ensuring it is only used for its intended purpose.

Data Retention and Deletion:

Biometric data will not be retained longer than necessary and will be destroyed if a student no longer uses the system or leaves the academy.

New Legislation:

The academy is aware of upcoming changes to data protection legislation and will seek legal advice to ensure ongoing compliance.

Associated Resources

For further guidance, the academy refers to relevant DfE guidelines, ICO guidance on data protection, and British Standards Institute information on biometric systems.