Legislative context
5. The legal position and the Data Protection Act 1998
5.1 The introduction of biometric technology systems in schools is a matter for education authorities to consider.
Section 1 of the Education (Scotland) Act 1980 places a duty on every education authority to secure that there is made for their area adequate and efficient provision of school education and further education. Section 17(1) places a further duty to provide for their area sufficient accommodation in public schools and other educational establishments under their management to enable them to perform their functions. The education authority may, for the purposes of fulfilling this duty, provide, alter, improve, enlarge, equip and maintain schools and other educational establishments outwith as well as within their area.
Under section 2 of the Standards in Scotland's Schools etc. Act 2000 where school education is provided to a child or young person by or by virtue of arrangements made or entered into by an education authority, it shall be the duty of the education authority to secure that the education is directed to the development of the personality, talents and mental and physical abilities of the child to their fullest potential. Section 2(2) provides that in carrying out this duty the education authority shall have due regard, so far as reasonably practicable, to the views (if there is a wish to express them) of the child or young person in decisions that significantly affect that child or young person taking into account their age and maturity.
5.2 If an education authority decides to introduce and use such systems, it must also comply with the Data Protection Act 1998. This is because the systems record biometric data and that data must be treated just like any other personal data under the terms of the Act. What this means is set out more fully below.
6. The Data Protection Act 1998
6.1 Education authorities hold personal data about pupils in order to run the education system effectively and, in so doing, must follow the requirements of the Data Protection Act 1998 (hereinafter referred to as "the Act"). Further guidance on the Act is available from www.ico.gov.uk/for_organisations/topic_specific_guides/education.aspx .
6.2 Education authorities are "data controllers" in terms of the Act since they determine the purpose(s) for which, and the manner in which, any personal data are processed. Data which relate to individual pupils who can be identified from that data (or from that data and other information which the education authority holds) will qualify as personal data in terms of the Act. The pupils to whom the information relates are the data subjects. When personal data relating to and identifying pupils are obtained, education authorities must ensure that the pupils and/or the parents/guardians as appropriate ( see section 9 below) are provided with a Fair Processing Notice which will contain information as to:
- the name of the data controller (the education authority);
- the purposes for which the data are held;
- any information required to make the processing fair, including any third parties to whom the data may be passed.
6.3 In addition, education authorities must comply with the following Data Protection principles which state that data must be:
- fairly and lawfully processed;
- processed for limited purposes;
- adequate, relevant and not excessive;
- accurate;
- kept no longer than necessary;
- processed in accordance with data subjects' rights;
- secure;
- not transferred to other countries without adequate protection of data subjects' rights.
6.4 As far as the Act is concerned, biometric data must be handled in the same way as any other personal data and the same principles as above apply when an education authority decides to record pupils' biometric data. Please see paragraph 9.4 for further information.
7. Other legislation
7.1 While this document primarily provides guidance in respect to the Act in relation to the collection of biometric data, there are other legal considerations that apply to the collection of data more generally, such as the Human Rights Act 1998 and the common law duty of confidentiality. As they judge appropriate, education authorities will wish to seek their own legal advice on these matters.