Dirprwy Lywydd, as noted in the motion, schools and colleges must consider the UN Convention on the Rights of the Child, and that's also clearly set out in our guidance. This includes the right to express their views, feelings and wishes in all matters affecting them; to have their views considered and taken seriously; and the right to privacy. It's therefore vital that learners understand that participation in a biometric system is not mandatory. Alongside the main guidance, we produced a version specifically for children, as Sarah Murphy referenced in her speech, to help young people understand their rights in relation to this area. This document was developed with the help of young learners, including the children's rights advisory group and Young Wales, and I'd like to thank them as well for their valuable contribution.

Schools and colleges are required to obtain written consent from a parent or carer before any biometric data can be collected. They, or indeed the learner, have the right to opt out at any point. Schools and colleges must be transparent here, making clear that participation is optional, providing clear information on its intended use and data protection procedures. Where either a parent, a carer or a learner chooses to opt out, schools and colleges must find a reasonable alternative means of providing the service. This is an especially important point. Learners should not be disadvantaged or receive access to fewer or indeed different services because of a school's decision to introduce biometrics.

Schools are legally responsible for any data they gather and use. They must ensure that any biometric data is stored securely, is not kept longer than needed, is used only for the purpose for which it is obtained and is not unlawfully disclosed to a third party. This should be considered as part of a data protection impact assessment, which should be undertaken at the outset. Schools and colleges must ensure that they only award contracts to biometric suppliers that provide sufficient guarantee to implement appropriate measures in line with the general data protection regulation. Article 28 specifies minimum contractual requirements, which, in essence, ensure suppliers can only act on instructions of the school or college, and may not use the data for any other purposes. If a school or college were to procure a system without a fully compliant contract, then they would be likely to bear full legal liability for the actions of the system provider.

Where biometric systems are implemented, the school or college should monitor and review their effectiveness against their original purpose. This will ensure that the technology continues to be used for the reason it was intended, and that it meets the legal duties, the requirements and responsibilities under the data protection legislation. Any failure in meeting the required data protection requirements could result in referral to the Information Commissioner's Office, as Sarah Murphy mentioned in her speech. The ICO can provide advice and instruction to help ensure schools get this right, and serious breaches, obviously, can result in enforcement action.

Schools and colleges, I am satisfied, have the support and advice available to ensure they can properly implement the required data standards when adopting the use of biometric systems. At present, there is no specific intention to introduce general legislation for use of biometric data in schools due to the existence of a broader legal framework with relevant checks and balances. The decision to introduce a biometric system is one for individual schools to make based on operational needs, impact assessments, and in consultation with staff, learners, parents and carers. This is consistent with a principle of school autonomy, but within a clear regulatory framework.

The Welsh Government will object to the motion in order to abstain on it, as is its convention, but the Member has raised important points with me here in the Chamber today. As she has previously done this, it has allowed us to look together at what more we can do. As she has recognised, and I am grateful for this, the Government has acted. I give her the assurance that I will approach the request she has made today in the same constructive way and will update her and the Senedd accordingly. In the meantime, we will continue to remind schools of their legal obligations and keep our guidance under continual review to reflect developments in this fast-moving area.