26Requirement to notify and obtain consent before processing biometric information
(1)This section applies in relation to any processing of a child’s biometric information by or on behalf of the relevant authority of—
(a)a school,
(b)a 16 to 19 Academy, or
(c)a further education institution.
(2)Before the first processing of a child’s biometric information on or after the coming into force of subsection (3), the relevant authority must notify each parent of the child—
(a)of its intention to process the child’s biometric information, and
(b)that the parent may object at any time to the processing of the information.
(3)The relevant authority must ensure that a child’s biometric information is not processed unless—
(a)at least one parent of the child consents to the information being processed, and
(b)no parent of the child has withdrawn his or her consent, or otherwise objected, to the information being processed.
(4)Section 27 makes further provision about the requirement to notify parents and the obtaining and withdrawal of consent (including when notification and consent are not required).
(5)But if, at any time, the child—
(a)refuses to participate in, or continue to participate in, anything that involves the processing of the child’s biometric information, or
(b)otherwise objects to the processing of that information,
the relevant authority must ensure that the information is not processed, irrespective of any consent given by a parent of the child under subsection (3).
(6)Subsection (7) applies in relation to any child whose biometric information, by virtue of this section, may not be processed.
(7)The relevant authority must ensure that reasonable alternative means are available by which the child may do, or be subject to, anything which the child would have been able to do, or be subject to, had the child’s biometric information been processed.