Biometric systems deployed by commercial service providers and schools [30/05/2011]

During 2010 a customer of a large fitness chain contacted us.  She reported that she attended the gym every day where she scanned a keyfob to record her attendance.  Without any notice, the scan system was removed and she was told that in future she would be required to record her attendance using a new biometric system.  She was asked to provide her fingerprint to facilitate use of the system.  She was given no information about the processing of personal data involved in using the biometric system and she was given no opportunity to opt out.  As a result of this and related reports from customers of the gym, we commenced a detailed and lengthy engagement with the fitness chain.  It was clear that the organisation was not aware of the data protection issues arising from the use of its new biometric system until we made contact.  It was also clear that frontline staff lacked the knowledge of data protection necessary to handle queries from concerned customers.  We achieved a satisfactory outcome involving the removal of the mandatory requirement to use the biometric system and the provision of detailed information to customers about the processing of their data if they chose to use the system.  For those customers who chose not to use the biometric system, a proximity card system was introduced.  Consent is a critical consideration for the use of a biometric system.  Customers should not normally be asked to use a biometric system unless they have given their consent and their consent must be informed; they must be given detailed information about the processing of their personal data before they decide whether to use the system.  People must be told what their biometric data will be used for, who has access to it, what security measures are in place to protect it and how long it will be retained.  They must receive assurances that their data will not be disclosed to third parties.  Furthermore, those who choose to opt out must not be penalised.  In this case the organisation attempted to impose a charge on customers who wanted a proximity card.  We intervened to prevent this because a person may not be charged for exercising their legal right to opt out under the Data Protection Acts (we have no objection to the imposition of a small fee to cover the cost of supplying replacement cards to customers who lose or damage a proximity card). 

In 2010 we continued to receive reports about the introduction of biometric systems in schools and other places of education to record student attendance.  For example, it came to our attention that a large secondary school introduced such a system in January 2010.  It announced the deployment of the system in a short note in its news bulletin.  The notice was headed “Education (Welfare) Act, 2000” and stated that the provisions of that Act required it to promote school attendance.  It went on to state that the board of management had invested in a biometric attendance system.  No reference was made to data protection issues and there was nothing to suggest that students had any choice about using the system.  Our guidance note on the use of biometric systems in educational institutions emphasises the requirements to obtain the signed consent of student users (and the consent of parents or guardians in the case of minors) and to give them a clear and unambiguous right to opt out of the system without penalty.  When we contacted the school we were informed that attendance at the school implies acceptance by students and their parents of the school’s policies and procedures.  We responded that it was obvious that the informed consent of students and parents had not been obtained in line with our guidance and that, as a result, the continued use of the system was unlawful.  We required the school to immediately seek the written consent of students and parents and to put an alternative system in place for those who do not consent or who subsequently withdraw consent.  The matter was resolved to our satisfaction.  I expect any educational establishment which has deployed a biometric system to keep a record of all written consents for as long as the relevant students are using the system.  Authorised officers from my Office will examine the audit trail of consents in the event of an inspection.