Jim Knight, minister at the DCSF (isn’t there a furniture store called that already?) issued a written statement on school fingerprinting on Monday, just in time for Greg Mulholland’s adjournment debate.
All of this coincided with the publication of guidance on taking children’s fingerprints in schools. The problems around informed consent continue:
The Data Protection Act 1998 does not specify when a person is (or may be considered to be) too young to give consent. It is a matter of judgement that must be made on a case by case basis by the school as the data controller. Only where a pupil is judged to be unable to understand what is involved will his or her rights be exercisable by the parent or someone with parental responsibility for the pupil.
OK, so what data protection and information security expertise is made available to the child so that s/he can reach an informed decision? What are the criteria for assessing a child’s competence, and who makes that assessment? We would suggest that a teacher is no more qualified to assess a child’s understanding of data protection than a DP lawyer is to assess a child’s readiness to sit GCSE History. Is each child really assessed individually, or is there an assumption that because some children in a class will understand, all of them will?
Although we were originally promised joint guidance from the government, Becta and the Information Commissioner, the ICO has in fact issued their own, slightly more nuanced, guidance.
For the purposes of the Act the pupils themselves are “data subjects”: it is they who should in the first instance be informed and consulted about the use of their personal data. Deciding when children are mature enough to decide how their personal information should be used is difficult. On the one hand, as children mature they are entitled to an increasing measure of autonomy. On the other hand, while children might understand a simple explanation of why their fingerprints are being taken, they may well not appreciate the potential wider implications.
There is nothing explicit in the Act to require schools to seek consent from all parents before implementing a fingerprinting application. However, unless schools can be certain that all children understand the implications of giving their fingerprints, they must fully involve parents in order to ensure that the information is obtained fairly. Parents play a central role in their children’s education, in terms of support and guidance, and also in terms of legal liability, for example in case of truancy. They therefore rightly expect to be informed and consulted when biometric systems are introduced in their child’s school.
That’s a bit more like it, but misses some crucial points. Since there is nothing explicit about age in the DPA, we have to turn to the common law position that parents are responsible for their children until they reach 16. It’s not just a matter of consulting them because they can ‘rightly’ expect to be consulted: it’s a matter of law.
Yes, of course children as data subjects must have a say in what happens to their data – but they also have rights under Article 5 of the UN Convention on the Rights of the Child to consult their parents in the exercise of their rights, and parents have the corresponding right to give such guidance ‘in a manner consistent with the evolving capacities of the child’.
It would be a brave child who said in front of a whole class that she wanted to go home and talk to her parents about it first. It is up to teachers – and any other practitioners – to make sure that a child is given the opportunity to exercise her rights. Otherwise she is not giving informed consent.
Jim Knight says in his statement:
We give schools complete freedom to run their own affairs and I back every head teacher’s right and professional judgment to choose technology to improve their day-to-day running—but it is plain common sense for them to talk to parents about this and all issues relating to their pupils to demystify how schools operate.
I have seen at first hand how well these systems work. They can speed up lunch queues, remove the need for children to carry money and take away the stigma of singling out those on free school meals. Moreover, they can enable schools to register pupils more easily as they move from class to class.
Completely absent is any justification in terms of the best interests of the child, one of the four ‘cornerstone’ Articles of the UNCRC (Article 3).
This whole issue is a good example of the problems that arise when a government – or a school, or any other public body – forges blindly ahead without thinking through the full implications of their actions, and then tries to fit the law to the consequences.