CHAPTER 2Protection of biometric information of children in schools etc.
26Requirement to notify and obtain consent before processing biometric information
(1)This section applies in relation to any processing of a child’s biometric information by or on behalf of the relevant authority of—
(a)a school,
(b)a 16 to 19 Academy, or
(c)a further education institution.
(2)Before the first processing of a child’s biometric information on or after the coming into force of subsection (3), the relevant authority must notify each parent of the child—
(a)of its intention to process the child’s biometric information, and
(b)that the parent may object at any time to the processing of the information.
(3)The relevant authority must ensure that a child’s biometric information is not processed unless—
(a)at least one parent of the child consents to the information being processed, and
(b)no parent of the child has withdrawn his or her consent, or otherwise objected, to the information being processed.
(4)Section 27 makes further provision about the requirement to notify parents and the obtaining and withdrawal of consent (including when notification and consent are not required).
(5)But if, at any time, the child—
(a)refuses to participate in, or continue to participate in, anything that involves the processing of the child’s biometric information, or
(b)otherwise objects to the processing of that information,
the relevant authority must ensure that the information is not processed, irrespective of any consent given by a parent of the child under subsection (3).
(6)Subsection (7) applies in relation to any child whose biometric information, by virtue of this section, may not be processed.
(7)The relevant authority must ensure that reasonable alternative means are available by which the child may do, or be subject to, anything which the child would have been able to do, or be subject to, had the child’s biometric information been processed.
27Exceptions and further provision about consent and notification
(1)For the purposes of section 26(2) and (3), the relevant authority is not required to notify a parent, or obtain the consent of a parent, if the relevant authority is satisfied that—
(a)the parent cannot be found,
(b)the parent lacks capacity (within the meaning of the Mental Capacity Act 2005) to object or (as the case may be) consent to the processing of the child’s biometric information,
(c)the welfare of the child requires that the parent is not contacted, or
(d)it is otherwise not reasonably practicable to notify the parent or (as the case may be) obtain the consent of the parent.
(2)A notification under section 26(2) must be given in writing, and any objection to the processing of a child’s biometric information must be made in writing.
(3)Consent under section 26(3) may be withdrawn at any time.
(4)Consent under section 26(3) must be given, and (if withdrawn) withdrawn, in writing.
(5)Section 26 and this section are in addition to the requirements of the Data Protection Act 1998.
28Interpretation: Chapter 2
(1)In this Chapter—
“biometric information” is to be read in accordance with subsections (2) to (4),
“child” means a person under the age of 18,
“further education institution” means an institution within the further education sector (within the meaning given by section 91(3)(a) to (c) of the Further and Higher Education Act 1992),
“parent” is to be read in accordance with subsections (5) to (8),
“parental responsibility” is to be read in accordance with the Children Act 1989,
“processing” has the meaning given by section 1(1) of the Data Protection Act 1998,
“proprietor”, in relation to a school or 16 to 19 Academy, has the meaning given by section 579(1) of the Education Act 1996, subject to the modification in subsection (9),
“relevant authority” means—
(a)in relation to a school, the proprietor of the school,
(b)in relation to a 16 to 19 Academy, the proprietor of the Academy,
(c)in relation to a further education institution, the governing body of the institution (within the meaning given by paragraphs (a), (c) and (d) of the definition of “governing body” in section 90(1) of the Further and Higher Education Act 1992),
“school” has the meaning given by section 4 of the Education Act 1996, subject to the modification in subsection (10),
“16 to 19 Academy” has the meaning given by section 1B of the Academies Act 2010.
(2)“Biometric information” means information about a person’s physical or behavioural characteristics or features which—
(a)is capable of being used in order to establish or verify the identity of the person, and
(b)is obtained or recorded with the intention that it be used for the purposes of a biometric recognition system.
(3)Biometric information may, in particular, include—
(a)information about the skin pattern and other physical characteristics or features of a person’s fingers or palms,
(b)information about the features of an iris or any other part of the eye, and
(c)information about a person’s voice or handwriting.
(4)In subsection (2) “biometric recognition system” means a system which, by means of equipment operating automatically—
(a)obtains or records information about a person’s physical or behavioural characteristics or features, and
(b)compares the information with stored information that has previously been so obtained or recorded, or otherwise processes the information, for the purpose of establishing or verifying the identity of the person, or otherwise determining whether the person is recognised by the system.
(5)“Parent” means a parent of the child and any individual who is not a parent of the child but who has parental responsibility for the child.
(6)In a case where the relevant authority is satisfied that, by virtue of section 27(1), there is no person falling within subsection (5) who must be notified or whose consent is required, “parent” is to be read as including each individual who has care of the child, but this is subject to subsections (7) and (8).
(7)In a case to which subsection (6) applies where the child is looked after by a local authority (within the meaning given by section 22(1) of the Children Act 1989), “parent” is to be read as meaning the local authority looking after the child.
(8)In a case to which subsection (6) applies where the child is not looked after by a local authority (within the meaning given by section 22(1) of the Children Act 1989) but a voluntary organisation has provided accommodation for the child in accordance with section 59(1) of that Act by—
(a)placing the child with a foster parent, or
(b)maintaining the child in a children’s home,
“parent” is to be read as meaning the voluntary organisation that so placed or maintains the child.
(9)A reference to the proprietor of a school is to be read, in relation to a pupil referral unit for which there is a management committee established by virtue of paragraph 15 of Schedule 1 to the Education Act 1996, as a reference to that committee; and for this purpose “pupil referral unit” has the meaning given by section 19(2) of that Act.
(10)A reference to a school is to be read as if it included a reference to any independent educational institution (within the meaning given by section 92 of the Education and Skills Act 2008).