3. What assessment has the Minister made of the collection and use of pupils' biometric data in schools? OQ57698

From our meeting in December, you will, I know, be aware that we can't legally prevent schools from collecting and using biometric data. However, as a consequence of the discussions and the issues that the Member helped us understand better, officials are currently revising the guidance for schools and local authorities to ensure that where data is collected and used, it is done in the appropriate way.

Thank you. In March 2020, the European Data Protection Board imposed a fine on a Polish school for using biometric data, or fingerprints, for 680 children in the school canteen in exchange for their school meals. Whilst it was noted that the school had received written consent from parents, the board stressed that biometric data was not essential for lunchtime practices. They could not carry out means that do interfere with children's privacy. Minister, you can imagine my horror when it was brought to my attention that these same practices are taking place in schools across Bridgend and Porthcawl and all over Wales. Even more worryingly, the use of biometric data is being sold to schools and parents by unscrupulous companies as a safer option. Minister, I cannot emphasise this enough: it is not safe or proportionate. Passwords and PIN codes can be reset. Once your biometric data is compromised, it is compromised for life. It stops the children, for the rest of their lives, being able to use their fingerprint for security reasons. We're also teaching our children and normalising them using their bodies in exchange for meals as part of a transaction in our schools everywhere. I believe this topic needs a debate of its own, but, in the meantime, will the Minister ensure that data protection is a priority for this Government and ensure that, at the very least, children do not fall victim to data breaches as emerging technologies enter our schools?

This is a very, very important matter, and I absolutely applaud the Member for her consistent and, if I may say so, expert advocacy of this issue, both in the Chamber and beyond. Schools have the option, as she says in her question, to use biometric systems as one of the authentication methods that they use to provide, for example, cashless catering in the context of free school meals and so on. That has helped remove some of the stigma.

However, as I say, as a consequence of the discussions that we've had, officials have been engaging with the Information Commissioner's Office, the Children's Commissioner for Wales, as well as the Biometrics Commissioner for England and Wales, in order to revise that guidance. The guidance will include detailed information regarding schools' obligations in relation to data protection, impact assessments and, importantly, children's rights impact assessments prior to making a decision to introduce a biometric system. It'll be published on our website and it'll be available to parents, to carers, and to young people themselves. The privacy of young learners is absolutely fundamental, and the guidance will reinforce the message that participation in a biometric system is not mandatory and that parents and carers must provide written consent before any biometric data can be collected. And I hope she would welcome the fact as well that a child-friendly version of the guidance will also be published so that children and young people in Wales understand their own rights to privacy in how they engage with these kinds of questions in schools. We'll be seeking direct feedback from young learners later this month regarding the content of that guidance.

Minister, I've seen the benefit of biometric data in schools, as a local authority councillor. It was introduced to help reduce the stigma around free school meals. When everyone is using the same queue and the same payment system, it does reduce the potential for bullying and harassment. However, some parents and children and rightly worried and concerned about the use of the biometric data and where their details are being stored and whether they are very secure. So, Minister, will you take this opportunity to reassure parents and concerned individuals about the risks of data breaches following the installation of biometric devices, and can you confirm whether there have been any data breaches in schools or colleges across Wales? Diolch, Llywydd.

I thank James Evans for that question. I refer him to the answer I gave to Sarah Murphy a moment ago in relation to that. I'm not aware of any schools or colleges in Wales using the newer biometric technology such as facial recognition systems, for example, but I will reassure him, as I did with Sarah Murphy, that the guidance will set out for schools and parents and carers, but also for learners, the framework of rights and their entitlements in relation to this. Also, in an area where the technology is often changing very rapidly, we will undertake to keep that proactively under review as new technologies emerge.