Biometric Processing in Schools - Freedom of information requests

Title or Description: Biometric Processing in Schools
FOI Number: 15725
Date Received: 22/10/2021
Type of Request: FOI
Request or Question: I seek to understand if biometric data is collected within your LA. I therefore request the following information under FOISA:1. Do you collect any form of biometric data relating to children and if so confirm the type?2. What are the stated purposes?3. Did you undertake an assessment with regards to privacy and necessity/proportionality?
4. Is your processing based solely upon consent ?
5. Where data processing is undertaken by a third party supplier confirm:
i. Did you undertake an assessment of the security risks?
ii. Is the data stored in house or via a cloud provider?
iii. What arrangements are in place to remove data if consent is withdrawn?
iv. Confirm, if any, how many complaints in relation to data subject information rights have been received?
v. Confirm number of data breaches recorded relating to biometric processing and how many were reported to the ICO.
Response: 1. Do you collect any form of biometric data relating to children and if so confirm the type? Yes, fingerprints.
2. What are the stated purposes? The purposes of processing are either for security of device or account. Optional fingerprint is in use for Inspire iPads. In addition Catering service use optional biometric fingerprint for pupils to access their cashless catering account in one school.
3. Did you undertake an assessment with regards to privacy and necessity/proportionality? Yes.
4. Is your processing based solely upon consent? Yes.
5. Where data processing is undertaken by a third party supplier confirm:
i. Did you undertake an assessment of the security risks? Yes.
ii. Is the data stored in house or via a cloud provider? Providers.
iii. What arrangements are in place to remove data if consent is withdrawn? Processing stops and pupils engage with their school to carry out the deletion process.
iv. Confirm, if any, how many complaints in relation to data subject information rights have been received? Zero data protection concerns recorded in relation to biometric data.
v. Confirm number of data breaches recorded relating to biometric processing and how many were reported to the ICO. Zero data breaches recorded in relation to biometric processing.