Facial recognition: School ID checks lead to GDPR fine • Hacker News Board

Re: Facial recognition: School ID checks lead to GDPR fine

#81

Post by cbluth » Sat, Aug 31, 2019, 8:49 AM UTC

lwkl wrote: post #77

Iv wrote: post #73

Earlier quoted context omitted.

School is the most authoritarian experience one typically experiences in a democracy. Here is a place where a strict hierarchy is enforced, through means of parental and peer pressure, anxiety over your future. Your schedule is planned by the minute, even peeing requires an authorization. Chatting is banned except on very limited time spans. The fact that we have kept a part of middle-age inside our modern societies…

Since I was a teenager I never asked to pee or drink in school. I just got up and told them: „I’m going to pee now.“ I see these things as my basic human rights. And nobody should accept having them restricted. In the country where I live the school has the authority by law to be more restrictive and enforce their own rules. Which I see as necessary to some point. But I think we should teach kids and teenagers to mak…

Yes, "discovering" that path is difficult when you're forced-fit into school at such a young and impressionable age.

Re: Facial recognition: School ID checks lead to GDPR fine

#82

Post by smooc » Sat, Aug 31, 2019, 8:56 AM UTC

Zenst wrote: post #38

codedokode wrote: post #35

Collected data can be used later - for example, the school or teachers can sell face models to advertisers, shopping mall owners, data brokers, Facebook, Google etc. So it is a right decision to shut down such a dubious project. The school could simply use RFiD cards for tracking attendance.

Which results in the same dataset. Same with mobile phones. But that's ok as long as you obfuscate the data too give the illusion of privacy. So You could have a tracking on a map of a dot moving, but as soon as you associate that dot with a person in the same dataset - that causes dramalama. But you can have that dot associated with a person in a separate dataset held by somebody else and skirt around the fact that…

No it doesn't. In no way an RFID token is equal to biometrical information. I can throw away the token, choose not to have it on me etc.

The dataset you are talking about is not just in/out but is a lot more comprehensive than that.

Re: Facial recognition: School ID checks lead to GDPR fine

#83

Post by nmstoker » Sat, Aug 31, 2019, 8:59 AM UTC

Iv wrote: post #75

havkom wrote: post #48

The main parts of the wrong-doing: - The school had obtained consent from the pupills and each one of the pupills could opt out at any time. The Swedish Data Protection Agency (DPA) did however find that due to the power balance of a school vs a pupill, these consents are not ”freely given”, and thus are void. The school therefor have no legal basis of processing special categories of data/sensitive data, which proce…

> the school claimed this way of taking attendance saves a calculated 72,000h of teachers time per year in just this school Which is 197h per day. I find this number extremely dubious.

The figure I saw (on the BBC article and the linked Swedish article) was 17,000 hours per year in this school.

That still seems suspect: estimating a school year of 35 weeks that's 175 days, thus 97 hours per day across all teachers. Even if it were some mega school of 1,000 pupils and maybe 100 teachers that seems high, would imply they spent perhaps ten minutes of every hour in a six hours day taking & dealing with attendance on average! (obviously based on assumptions, so this could vary)

It feels like a number that was come up with (or at least inflated) to justify the project.

Re: Facial recognition: School ID checks lead to GDPR fine

#84

Post by TazeTSchnitzel » Sat, Aug 31, 2019, 9:01 AM UTC

Iv wrote: post #73

Barrin92 wrote: post #11

Good. Not only does this ensure that the students enjoy privacy, monitoring children in school with surveillance systems could have come straight out of foucault's discipline and punish. Maybe we should think about how we make schools spaces of freedom for our children rather than turning them into the next panopticon.

School is the most authoritarian experience one typically experiences in a democracy. Here is a place where a strict hierarchy is enforced, through means of parental and peer pressure, anxiety over your future. Your schedule is planned by the minute, even peeing requires an authorization. Chatting is banned except on very limited time spans. The fact that we have kept a part of middle-age inside our modern societies…

I think it comes down in part to ageism: there are a lot of adults who can't stand children. And then there is everyone who grew up suffering and therefore rationalised it as important and requiring repetition.

Re: Facial recognition: School ID checks lead to GDPR fine

#85

Post by TazeTSchnitzel » Sat, Aug 31, 2019, 9:03 AM UTC

pkz wrote: post #65

bigiain wrote: post #51

Earlier quoted context omitted.

To be fair "checking attendance" fundamentally erodes privacy. That's not the issue (at least as I see it). The big questions in my head include "Who's storing the biometric data? How are they securing it? Who has authorized access to it, and what processes and mechanisms are n place to ensure they only use it in authorized ways? What are authorized uses of the data? How is it ensured that authorized uses will ot be…

To be fair, they did the following: - Data and analysis was done at a server in the class room (locked in a cabinet) - All parents signed a consent form before the trial started. - All data was erased after the trial ended. The Swedish DPA decided that: 1. Consent is not valid of there is a power difference between the subject and the requester. 2. They should have documented a PIA (Privacy impact assessment). 3. The…

Hmm, when can parents consent on behalf of children? Can children retract the consent given for them by their parents?

Re: Facial recognition: School ID checks lead to GDPR fine

#86

Post by TazeTSchnitzel » Sat, Aug 31, 2019, 9:05 AM UTC

moksly wrote: post #46

Barrin92 wrote: post #11

Good. Not only does this ensure that the students enjoy privacy, monitoring children in school with surveillance systems could have come straight out of foucault's discipline and punish. Maybe we should think about how we make schools spaces of freedom for our children rather than turning them into the next panopticon.

I work in public digitalisation in Denmark, and I can’t think of a single reason of why you would ever even want this. What’s the use case? Automatic student registration? If it is, and I can certainly imagine some HR consultant going “weeeeeell we can squeeze five minutes of extra education in if we remove this teacher-student interaction of registration, that’s a gazillion hours of extra education a year!”. I know…

I am wondering if there was some private company involved that provided incentives perhaps. I know an IT consulting company was involved with the design but I don't know their relationship.

Re: Facial recognition: School ID checks lead to GDPR fine

#87

Post by ggreer » Sat, Aug 31, 2019, 9:07 AM UTC

tastroder wrote: post #47

ggreer wrote: post #33

Earlier quoted context omitted.

No, you can't. Since GDPR was rolled out, venture capital investments in the EU have dropped by a third.[1] According to that paper, the companies most hurt are early stage startups. 1. The Short-Run Effects of GDPR on Technology Venture Investment: https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3278912

From that paper: "Of course, there are caveats to these findings. First of all, GDPR has only been in effect in the EU for a short time, and the effects we’ve observed may be temporary, with investors potentially taking a wait-and-see approach." Given the year-over-year trends shown in [0] I feel like one should not overemphasize the timeframe that article looked at. The decline seems to be relatively contained at be…

It's not due to larger industry trends. The paper shows that startups in the US got more funding in the same time period, including early stage startups.

I remember warning about this when GDPR was being considered. People said it wasn't a concern. Later in 2018 I linked to a draft whitepaper that showed a decline in funding for EU startups. People replied that it was a statistical fluke and that we needed more time before we could draw conclusions. Now it's been a full year and the US-EU investment disparity is higher than ever.

At this point I don't know what would change people's minds. It's like talking to climate change denialists. I get the same response: "There's not enough data. The data doesn't support that conclusion. Even if it did, the trade-offs are worth it."

Re: Facial recognition: School ID checks lead to GDPR fine

#88

Post by sokoloff » Sat, Aug 31, 2019, 9:07 AM UTC

codedokode wrote: post #35

Collected data can be used later - for example, the school or teachers can sell face models to advertisers, shopping mall owners, data brokers, Facebook, Google etc. So it is a right decision to shut down such a dubious project. The school could simply use RFiD cards for tracking attendance.

My friend can use my RFID card too.

Why not use a fingerprint reader if automation is needed, or just place trust in the teacher to not cheat and give them a web page or app to enter absences?

Attendance is a safety thing (or viewed that way). If my 8 year old unexpectedly doesn’t show up to school, I would like to find that out at 8:30 rather than 15:00.

Re: Facial recognition: School ID checks lead to GDPR fine

#89

Post by lkhhj » Sat, Aug 31, 2019, 9:10 AM UTC

codedokode wrote: post #35

Collected data can be used later - for example, the school or teachers can sell face models to advertisers, shopping mall owners, data brokers, Facebook, Google etc. So it is a right decision to shut down such a dubious project. The school could simply use RFiD cards for tracking attendance.

rfid cards? I can just give mine to a mate and have him check in for me

Re: Facial recognition: School ID checks lead to GDPR fine

#90

Post by ggreer » Sat, Aug 31, 2019, 9:11 AM UTC

ganzuul wrote: post #64

ggreer wrote: post #33

Earlier quoted context omitted.

No, you can't. Since GDPR was rolled out, venture capital investments in the EU have dropped by a third.[1] According to that paper, the companies most hurt are early stage startups. 1. The Short-Run Effects of GDPR on Technology Venture Investment: https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3278912

This is like saying laws against human trafficking are bad because it hurts business.

You are comparing server logs containing your IP address to human trafficking. That's a fun bit of rhetoric, but it doesn't help anyone in this conversation discover what's true.