Is school fingerprinting out of bounds?

by Wendy Grossman
Obtaining biometric data from pupils, often without parental knowledge, shows how far this technology has already infiltrated society

Last week, news emerged that Primrose Hill primary school in north London had been fingerprinting pupils without their parents' consent. It seemed shocking yet should not have come as such a surprise. Micro Librarian Systems' Junior Librarian has been marketed in the UK since 2002 and is estimated to have fingerprinted hundreds of thousands of British children.

That so many schools have been happy to install such systems, often without thinking it necessary to consult parents, is a reflection of how this technology is infiltrating society. We can expect more of the same, for children and adults, should the ID card, debated once more this week in parliament, become reality.

Simon Davies, the executive director of Privacy International, says backing for such systems is "broad but shallow". As more detail, especially the cost, has emerged about the government's plans, support for the ID card has dropped from 80% to about 50%. There seems to be a similar attitude to biometrics in schools. One teacher and governor whose school is considering installing the same system says: "It's all internal so I can't see it's really any different from passwords giving computer access."

Davies responds that the demand for privacy "has two key drivers: systematic legal development and public relations disasters. There is something extremely personal about a biometric and if a computer holding children's stored fingerprints were stolen the psychological effect on parents would be massive."

Identity theft

Why does it all matter? Because a password is something you have; a fingerprint is something you are. A password can be reset, reissued, forgotten, copied, written down, or changed. A fingerprint is for life. Like the ID card, as biometric systems pervade society they will be used to secure data of a serious nature. Identity theft will become far more dangerous.

"One of the worries we have," says Terri Dowty, director of Action for the Rights of Children, "is the rather casual use of biometric data. If children get used to thinking biometric data can be used for trivial purposes - and a school library is a rather trivial purpose - how do they learn to be careful where they put their fingerprints and iris scans? The more you use biometric data and the more casually you use it, the more scope there is to exploit it."

It is not just to do with library books. A school in Sunderland experimented with iris scanning in the canteen and many schools around the UK are trying fingerprint registration. Dowty thinks the latter a terrible idea. "When I was teaching, attendance-taking was an important part of the day. You would call the name, look up, and make eye contact - notice them for a second. It was an important human part of the day."

Andrew Clymer, who fought to keep biometrics out of the school attended by his children, now six and eight, loves technology. An IT consultant who formerly worked for Cisco, he happily hands over his fingerprint to US border controls because "I see the benefit". But he believes the decision to hand over such information could affect his children all their lives.

MLS says the Identikit fingerprint module does not store images; it creates a mathematical template stored as a number. The data is encrypted and "cannot be used in any other database" and the fingerprint is immediately deleted when a child leaves school. Vericool, which supplies registration systems, says: "At no time can the encrypted digital signature be turned into usable, hard-copy data."

Clymer finds these claims laughable. "What we've seen in the last 10 years is what's true in IT today isn't necessarily true in future. Anybody who says it is secure and can't be compromised is a liar."

This is the kind of dispute you would expect the Information Commissioner's Office, responsible for enforcement of the UK Data Protection Act, to step into.

But a spokeswoman told the Guardian: "We haven't had any complaints. We would look into it if we did and encourage people to complain." The ICO would, she says, look into why schools were collecting information, how long they planned to keep it, what the safeguards were, whether information was obtained compulsorily and how they intended to ensure it wasn't "muddled".

Complaints procedure

In fact, the ICO has received complaints - from Privacy International, Action for the Rights of Children, parents like Clymer - and replied to them, saying much the same as the vendors about the system's workings. (MLS uses a letter from the ICO to promote its products as "safe").

"The Information Commissioner does not have any specific concerns relating to the use of such technology in schools for such purposes with respect to the provisions of the Data Protection Act 1998," wrote Suzanne McKay, the commissioner's casework and advice officer, in an email Pippa King received on Monday after a two-month wait. King has two children, aged seven and eight, whose Hull school did not ask permission before installing a fingerprint scanner in the library. McKay's email goes on to say: "The Commissioner accepts the introduction of such a system may be regarded as a sensitive issue and would suggest schools inform parents of their intention to introduce such a system. However, a failure by the school to [do so] would not necessarily represent a contravention of the Data Protection Act 1998."

Stephen Groesz, a partner with the law firm Bindmans, has been consulted by parents from Charles Dickens school in Southwark, and believes the system is illegal on several grounds. "Absent a specific power allowing schools to fingerprint, I'd say they have no power to do it." Police legislation, for example, is specific about when, by whom and how fingerprints may be taken and what they may be used for. "The notion you can do it because it's a neat way of keeping track of books doesn't cut it as a justification."

Privacy advocates say these systems have a more subtle danger: habituation. Andre Bacard, the author of The Computer Privacy Handbook, said if he wanted to build the surveillance society, "I would start by creating dossiers on kindergarten children so the next generation couldn't comprehend a world without surveillance." But who needs dossiers when you have fingerprints?