Biometrics for school lunches

[insideoutsider]

We received a letter last week from my DC's primary school saying the children will have to have their fingerprints / biometrics recorded as part of the school payments process. They already have a payment app where we make payments such as school lunches, music lessons, trips etc

I thought - I would not be consenting for my children's biometrics to be collected. Today, I rang the school for clarification and they said they will not be able to buy ANY school lunches or any trips without biometrics. Sounds like something from a dystopian fiction.

Am I being unreasonable to think this is a little OTT? Fingerprints are such a powerful means of identification that really shouldn't be in the hands of just anyone. I'm happy for biometrics to be scanned at airports and security agencies or to keep people safe. This, however, is some random company, collecting and storing their fingerprints.

It's not space camp; it's school lunches!

AIBU? Please share your thoughts and the consequences if you declined to give consent.

@Kazzyhoward and @EmeraldRubyShark
They don't "need" to at all. If you don't comply, then the child can't have school meals. Simples

Turns out they do. Thanks to @TinyGhostWriter who provided the government link saying so on page8. It says reasonable alternative arrangements must be provided for those who don't consent and they must not be disadvantaged in not participating: www.gov.uk/government/publications/protection-of-biometric-information-of-children-in-schools

Wait till microchipping is mandatory 😱😂

Given it has now been explained they don't actually store the fingerprint, why are you still worried?

But that doesn't matter, the code generated from the fingerprint is every bit as identifying as the fingerprint - it does remove the risk of someone copying the fingerprint and impersonating the child, but it does not remove the risk of the code being used to identify the child from a fingerprint - that fingerprint can be converted to the same code.

In any case, the school cannot require consent and must make alternative arrangements, so it's completely reasonable.

it does not remove the risk of the code being used to identify the child from a fingerprint - that fingerprint can be converted to the same code.

What do you think ANYONE is going to do with that information? A random few letters and some points on a fingerprint?

In any case, the school cannot require consent and must make alternative arrangements, so it's completely reasonable.

The school are under no obligation whatever to provide alternative methods of payments - if you don't want them using your child's thumbprint then you're more than welcome to make them a lunch yourself.

I personally see your concerns but think the risk is small. We have cash cards at our school and kids are always losing them. If you have just sent your child in with a £20 note then they lose their cash card you have lost your £20. The fingerprint system is designed to avoid this quite common scenario. It.could potentially be misused but I see it as unlikely.

What exactly are people suggesting the code attached to your childs fingerprint would be used for?

We hear about data storage failures all the time, some of them affecting 100,000s of people. I don’t know what they use the data for now or in the future, but I know that data is hacked all the time - I don’t want my children’s data held purely to make life easy at school lunchtime, that’s not a big enough reason for me to permit their data to be held.

And yes, if it means I provide lunches, I’m fine with that.

@Usernumbers1234
If you read my original post, you'll note that I mentioned having no problem with fingerprints and biometrics being used for security and I especially mentioned airports. And I do travel to a Africa once a year so I know this happens. I am also happy for my fingerprints to be scanned if I'm accused of a crime even or to keep people safe or any other serious issue.
Buying school lunches doesn't seem a serious issue to me.

To those suggesting I make a packed lunch, we already do. It's the one-off school lunches or activities that we will need.

I've just finished looking through the school's policy on this. Turns out there are alternative arrangements - a pin code will be provided. I'm quite happy with that.

You can't recreate the fingerprint from the code though. It only goes one way.

You use the original fingerprint to create a code, which is stored.

Each time you "pay" with your fingerprint, a code is generated from that and if the codes match then your account can be charged.

It doesn't really matter what the code is, and it wouldn't necessarily be the same code generated in a different system. All you're looking for is a way of generating at least a few thousand unique codes from the fingerprints.

The school are under no obligation whatever to provide alternative methods of payments - if you don't want them using your child's thumbprint then you're more than welcome to make them a lunch yourself.

However authorising activities it would, and I suspect also for lunches, certainly if the child receives FSM they have the obligation.

It doesn't really matter what the code is, and it wouldn't necessarily be the same code generated in a different system

That doesn't matter - if you have a fingerprint from another source, you can generate a code from it - if that code matches the one stored, then you have identified the individual from the fingerprint.

If for example, the person's name flashes up on the tills when they pay, then a fake finger from a fingerprint will likely reveal it, sure the risks are very low, but they are not zero, and that is why biometric processing is sensitive.

Fabulous system for my dc. They've managed to lose practically everything but still have their fingers.

What do you think anyone is going to do with a random set of letters/number connected to your child's name
Steal them and pass them on to people smugglers? Plus all the info on fb etc. Could steal your id.

sirfredfredgeorge - what's the difference between using a "fake finger" and typing in someone else's passcode though? I know you can change passcode, but if your fingerprint data was compromised by a "fake finger" maker, you could always record a different code by using a different finger.

AllNewCheeses I'm not interested in the fraud side of paying for others meals (although most people only have 10 fingers...) although that is certainly a concern, and you need to balance the risk of fraud by stolen fingerprints and coercion by threatening people for passcodes, it's not necessarily clear which is better.

The relevant point to the identifying from fake fingerprints is what if you lift a fingerprint off a glass, perhaps you're an overbearing parent trying to find out which boy had been in your daughters room. A passcode completely removes that risk, a fingerprint does not.

Mine both use this at secondary school. As it's the only way they can buy food that's what they do. I don't really even think about it, I just top up their money and they get their lunch.

sirfredfredgeorge - you'd need to retrieve the stored code from the school's system but then you'd also need the school's fingerprint reading system. A different one probably wouldn't generate the same code.

Far too many on this thread have said "I don't think about it."

That is the big problem and that is when sleepwalking into no privacy arises.

To the pp saying" I've got nothing to hide", what nonsense and I often think this is from a place of white and/or middle class privilege.

Many ethnic minorities and the working class also have nothing to hide but the legal system, the governmental system and corporations are not class or race blind. Yet.

Maybe no-one except criminals will have anything to hide when all bias has been removed from the system.

Until then I'll rely on my natural paranoia and ability to ask questions, instead of being herded unthinking into using new technologies that will end up owning us.

Completely agree Flirtygirl.
In fact, this kind of thing will continue to proliferate if people blindly go along with it.
If all parents opted for the alternative, it would show that we are not happy with sensitive date being requested from us, and held, for basically very little reason.
It's not that hard, and yet for some reason people seem to go along with the herd and agree to whatever.

you'd need to retrieve the stored code from the school's system but then you'd also need the school's fingerprint reading system. A different one probably wouldn't generate the same code.

The school's system is available in the lunch hall... Of course, it might not identify the individual on screen, you might need to also get a lunch supervisor involved etc.

There are certainly procedures you can put in place to mitigate the risks - but that's the point, is the value in the system worth the cost of all those mitigations and the subsequent risk. Of course codes have a different set of risks, how you manage and balance those risks is what matters - a system that provides both options, allowing individuals to decide is a sensible one - it's also the legal one.

I agree, I think the idea of DNA being held for everyone on the off chance that it might help solve crime is horrifying. We know minority’s groups already come under greater scrutiny by the authorities, are over represented in the criminal justice and child protection systems - it’s certainly not a case of “if you’ve nothing to hide”.

I don’t belong to the state, my children don’t belong to the state, statutory services don’t have the right to compel me or my children to use fingerprint identification for school meals, it’s not remotely a proportionate use of personal data. I’m not remotely a “tin foil hat” person and in many ways am firmly part of the statutory system - I just think the personal data held about individuals for no good reason is intrusive and excessive.

They were using biometrics in my work place 16 years ago, and the dc’s had it in high school, it’s not new. I think you aren’t grasping that it isn’t an actual fingerprint used.

What do you think anyone is going to do with a random set of letters/number connected to your child's name
Steal them and pass them on to people smugglers? Plus all the info on fb etc. Could steal your id.

Lol at this. Imagine the people smugglers coming to impersonate your kid in the school dining hall.

They don't "need" to at all. If you don't comply, then the child can't have school meals

This is in itself a breach of GDPR (and indeed of the previous data protection legislation) as consent must be freely given. It's not freely given if you have to give it to get school meals.

The school has to provide an alternative means of payment and the legislation a pp quoted above also makes that clear.

Not sure how it works if it doesn't store the fingerprint, how does it know what the code is, or does it generate the code afresh each time the kid presses their thumb on the reader?

I think you aren’t grasping that it isn’t an actual fingerprint used. I think it is the sheer convenience that makes you not grasp the dystopian possibilities!

Evey time one of these threads come up there is a 50:50ish split betwen those who love the convenience and those who can see exacltry how some governments, now or future could and would misuse the technology.

If you think that is a bit Flat Earth/Lizard King consider China....

i Remember when I was in school them introducing fingerprint scanners for library books.

And then three weeks in me having an accident in resistant materials which resulted in a massive scar on the right index finger (the one we scanned). For security you couldn’t change the fingerprint without...fingerprint authorisation!

I became school student librarian and manually checked it books for myself after that