Part of the debate – in the Senedd at 3:17 pm on 8 March 2023.
Diolch, Dirprwy Lywydd. Thank you to Jane Dodds, who co-submitted this motion, and to Carolyn Thomas and Jack Sargeant who supported it. I move the motion.
I have requested a debate on biometric data in schools a few times since being elected, so this is a significant day, and I am pleased and optimistic that we can discuss the legal, regulatory and equality and human rights aspects together today. I would like to thank Pippa King and Jen Persson from Defend Digital Me and Madeleine Stone at Big Brother Watch for their consistent research and help with this, which I will draw on today.
I am calling for our education Minister to write to all schools in Wales for a moratorium on biometric technology and use of bodily data in schools until the Information Commissioner carries out an assessment of the use of children's data across UK educational systems—this would include face, fingerprints, eye scans, vein and palm scanning, gait and emotional detection and processing—as well as writing to UK Government to ask what assessment has been made that these technologies are in line with the UK Data Protection Act 2018 to protect children at scale from overreach in this sector, and I will set out why.
As with most data technology changes in our public spaces, I became aware of fingerprint data collection in schools anecdotally. I was told by parents that it had been introduced by schools in my constituency, and then, when I asked more widely of parents and students if and where this was happening in other schools, I was surprised to discover that it is extremely prevalent. I then asked if consent had been requested for this to be introduced in schools, and I was shown one letter that parents had been sent to sign off on their children's fingerprint data being collected and stored to be used in exchange for payment for school meals. It stated, and I quote, 'If you choose not to have your children on biometric system, a four-digit PIN code will need to be allocated. Please note that the PIN codes do not have the same level of security, and it will be your child's responsibility to remember the code and keep it secure at all times.'
Minister, I cannot emphasise this enough: biometric data is not safer than a PIN code or passwords. Passwords and PIN codes can be reset. Once your biometric data is compromised, it is compromised for life. It potentially stops the children for the rest of their lives from being able to use their fingerprint for security reasons or whatever they wish. This is partly because data hacks are not an uncommon occurrence. We have seen it within NHS England, the Metropolitan Police and Lloyds Banking Group. Public bodies with high levels of security have fallen victim to their data being exposed, often with unknown consequences. The reality is that a primary or secondary school is not going to be able to afford or oversee this level of security, and therefore cannot commit to children's personal data being safe. I'm not speculating that this could happen; this has happened. In September 2022, parents in the US have reported receiving a notorious explicit image in a meme after hackers targeted the school app Seesaw, which has 10 million users, including teachers, students and family members. I was told this week that the Seesaw app is being rolled out in a primary school in my constituency, as I'm sure it is across all of your constituencies too.