Facial recognition: School ID checks lead to GDPR fine • Hacker News Board

Re: Facial recognition: School ID checks lead to GDPR fine

#121

Post by tastroder » Sat, Aug 31, 2019, 11:02 AM UTC

ggreer wrote: post #112

tastroder wrote: post #103

Earlier quoted context omitted.

Okay, let's say there is enough data and you are absolutely correct. How does that invalidate the "Even if it did, the trade-offs are worth it." response? The US-EU funding disparity was always there, in my book this leads to less people copying ethically dubious startup patterns from their US counterparts. If GDPR is the sole reason for the decline... doesn't the benefit of the population, of quite a few countries,…

The EU doesn't prevent the "bad" startups from existing. They just prevent them from starting in the EU, which means the EU misses out on a lot of the potential upside. Companies like Microsoft, Google, Uber, Facebook, and PayPal started in the US, but they eventually expanded to the rest of the world. Since those companies weren't founded in the EU, EU workers missed out on being early employees. That means those co…

> The EU doesn't prevent the "bad" startups from existing. They just prevent them from starting in the EU, which means the EU misses out on a lot of the potential upside.

To me that sentence just isn't logical. Yes, they'd prevent some them from starting in the European market with their exact original business model if they were starting out now (and not like half of them in the last millenium). None of them started out here back in their time so that sounds more like a question of market penetration than benefit for the startup culture anyhow. With the GDPR they will hopefully also prevent said market penetration for bad actors when the time comes for the next generation of startups.

If GDPR is the sole reason and, subsequently, the US chooses to foster such businesses to win in a market, more power to them. Your examples might be huge successes, but many of them are at this time considered to be either unethical (Facebook, for the most part; Google had their share of negative attention) or plain illegal (Uber for example still hasn't managed to really start out in Germany, let's throw in AirBNB for good measure - I think they were founded in about the same year - huge financial hit that leads users to break laws and contracts left and right).

The calculation of long term cost and benefit is honestly the point where this discussion switches from economical concerns to political, at least for me since I'm not versed enough in macroeconomics to begin to judge that and would always place society over monetary concerns. I'm sure neither of us can win over the other so I'd suggest we leave it at that.

Re: Facial recognition: School ID checks lead to GDPR fine

#122

Post by kzrdude » Sat, Aug 31, 2019, 11:05 AM UTC

SomeOldThrow wrote: post #4

Meanwhile in the US, we still use a 10 digit number for our identification, regardless of who is holding it. I'm not sure which is worse :/ EDIT: phone numbers are 10 digits, SSN is 9.

The swedish personal number it has about the same use as that, except even more pervasively and you can't get may societal services without one, including picking up parcels from the post, a bank account, a job etc etc.

It also plainly contains your birthday and sex.

So.. Sweden.., it's very convenient when you're in the system and impractical when you are not.

Re: Facial recognition: School ID checks lead to GDPR fine

#123

Post by Zenst » Sat, Aug 31, 2019, 11:06 AM UTC

m0xte wrote: post #113

TazeTSchnitzel wrote: post #86

Earlier quoted context omitted.

I am wondering if there was some private company involved that provided incentives perhaps. I know an IT consulting company was involved with the design but I don't know their relationship.

That’s likely. School IT is fraught with cash back handers and lies at least here in the UK.

maybe, though would appear it may well be a bigger issue in Sweden - where this took place.

Re: Facial recognition: School ID checks lead to GDPR fine

#124

Post by Caligatio » Sat, Aug 31, 2019, 11:08 AM UTC

mikekchar wrote: post #50

Caligatio wrote: post #43

Earlier quoted context omitted.

Speaking purely on the technical side of this problem: if you had to design a system to take attendance without some sort of human in the loop (e.g. a teacher), what other workable solutions are there? ID scanned by itself? A student could scan multiple IDs for their friends. ID + PIN? Due to the bursty nature of entering classrooms, that would cause a jam up at the PIN reader. Short of an ID shackle (that's a joke),…

I've worked as a teacher before. I'm a bit confused as to the 17,000 hours time claimed to collect attendance information (and hence the justification that you need to automate it). Where is that number coming from? As part of my job, I had to be able to recognise and put a name to all of my students. This is legitimately difficult and I spent a lot of time doing it. However, it was not for doing attendance! If you a…

The 17,000 number does seem incomprehensibly high unless it's across the whole district. I'm not a teacher but I'm guessing the attendance gets compiled together and stored? Maybe this starts from hardcopy and includes all the work until its in the final digitalized format?

Re: Facial recognition: School ID checks lead to GDPR fine

#125

Post by Faark » Sat, Aug 31, 2019, 11:14 AM UTC

sokoloff wrote: post #88

codedokode wrote: post #35

Collected data can be used later - for example, the school or teachers can sell face models to advertisers, shopping mall owners, data brokers, Facebook, Google etc. So it is a right decision to shut down such a dubious project. The school could simply use RFiD cards for tracking attendance.

My friend can use my RFID card too. Why not use a fingerprint reader if automation is needed, or just place trust in the teacher to not cheat and give them a web page or app to enter absences? Attendance is a safety thing (or viewed that way). If my 8 year old unexpectedly doesn’t show up to school, I would like to find that out at 8:30 rather than 15:00.

> My friend can use my RFID card too.

Yes, just like you and your friend can do a lot of other cheating in school. And the mechanism used to prevent that is severe punishments once caught by a teacher.

I don't see much difficulty in spotting an empty desk that should be occupied according to today's automatically generated seating chart.

On another note, I feel like I'd be more okay with facial recognition and other biometrics in the form of you going to a scanner and initiating a scan. But certainly not surveillance with recognition built on top. Article doesn't seem to specify what they used, though the image chosen implies surveillance.

Re: Facial recognition: School ID checks lead to GDPR fine

#126

Post by balfirevic » Sat, Aug 31, 2019, 11:16 AM UTC

mytailorisrich wrote: post #102

TazeTSchnitzel wrote: post #85

Earlier quoted context omitted.

Hmm, when can parents consent on behalf of children? Can children retract the consent given for them by their parents?

This is a big issue these days. Parents should be able to consent on behalf of their children and retraction should come from parents as well. This used to be considered common sense but not anymore.

> This used to be considered common sense but not anymore.

Good! Some progress at least.

Re: Facial recognition: School ID checks lead to GDPR fine

#127

Post by moksly » Sat, Aug 31, 2019, 11:17 AM UTC

pkz wrote: post #68

moksly wrote: post #46

Earlier quoted context omitted.

I work in public digitalisation in Denmark, and I can’t think of a single reason of why you would ever even want this. What’s the use case? Automatic student registration? If it is, and I can certainly imagine some HR consultant going “weeeeeell we can squeeze five minutes of extra education in if we remove this teacher-student interaction of registration, that’s a gazillion hours of extra education a year!”. I know…

I would love to know more about how this discussion is in Denmark. Also how the Danish public sector is talking about GDPR/Cloud Act in relation to O365 and similar services.

I’m not personally aware of any facial recognition projects for attendance. Never seen it debated either. We have thousands of schools though, so who knows.

As far as the GDPR goes it actually didn’t have a huge technical impact on the public sector. We’ve had stricter local laws for decades, and have build our systems accordingly. We also don’t track you for advertising. So for us the GDPR has mostly been a bureaucratic change, and you’ll notice that’s also the majority of violations. It’s not that data aren’t protected, it’s that no one knows where the contract is, or that we haven’t documented elaborate procedures for whatever. 95% of the GDPR impact on the public sector had been law and legalisation. So the GDPR actually doesn’t impact O365 94 public cloud at all as long as you go to iso27000 certified vendors who provide privacy shield or whatever it’s called these days.

That’s not to say that we aren’t debating public cloud. Because we are. This has more to do with national laws though, we have war-time contingency plans from the cold-war era. Like I said, we had much stricter policies before the GDPR was even a thing.

The issue is that it makes public cloud illegal, but we can’t operate the most digitalised public sector in the world without public cloud. So far everyone is moving to AWS and Azure, pretending the flawed bureaucracy will eventually go away, but our politicians and national digitalisation agency has been refusing to give any meaningful heading, so who knows?

At some point though, someone is going to ask if the privacy bureaucracy is really worth the money it’s costing. At our place you could hire 10 extra teachers a year, just to cover the bureaucratic processes that don’t actually increase security, because a contract or a nice incident plan isn’t actually going to stop anyone from hacking you.

Re: Facial recognition: School ID checks lead to GDPR fine

#128

Post by cameronbrown » Sat, Aug 31, 2019, 11:21 AM UTC

tpxl wrote: post #67

cameronbrown wrote: post #13

Earlier quoted context omitted.

That makes sense. Opt out for even just one individual would be effectively impossible, otherwise how would the system know who's opted out without remembering them in some way.

A person who has not opted in has opted out. No tracking necessary.

You really think they're going to design things opt in and not opt out?

Re: Facial recognition: School ID checks lead to GDPR fine

#129

Post by SiempreViernes » Sat, Aug 31, 2019, 11:22 AM UTC

nmstoker wrote: post #83

Iv wrote: post #75

Earlier quoted context omitted.

> the school claimed this way of taking attendance saves a calculated 72,000h of teachers time per year in just this school Which is 197h per day. I find this number extremely dubious.

The figure I saw (on the BBC article and the linked Swedish article) was 17,000 hours per year in this school. That still seems suspect: estimating a school year of 35 weeks that's 175 days, thus 97 hours per day across all teachers. Even if it were some mega school of 1,000 pupils and maybe 100 teachers that seems high, would imply they spent perhaps ten minutes of every hour in a six hours day taking & dealing with…

The new system could well have automated more than just the role call, and so they can add in savings in the post processing of the attendance records.

Re: Facial recognition: School ID checks lead to GDPR fine

#130

Post by pbhjpbhj » Sat, Aug 31, 2019, 11:22 AM UTC

TazeTSchnitzel wrote: post #85

pkz wrote: post #65

Earlier quoted context omitted.

To be fair, they did the following: - Data and analysis was done at a server in the class room (locked in a cabinet) - All parents signed a consent form before the trial started. - All data was erased after the trial ended. The Swedish DPA decided that: 1. Consent is not valid of there is a power difference between the subject and the requester. 2. They should have documented a PIA (Privacy impact assessment). 3. The…

Hmm, when can parents consent on behalf of children? Can children retract the consent given for them by their parents?

Recently I traveled through UK airport security with minors and was surprised that the staff did not seek approval from a legal guardian for a body search (pat-down) of a minor.

I try to refer questions of consent to my kids, but in this case the question wasn't asked, they just said "hold your hands out" and went ahead.

I don't think minors can retract parental consent, but IMO schools should accommodate an individual's personal consent if practicable. Indeed schools should where possible be advocating for pupils before their parents if necessary (things like a tutor contacting a parent to request consent on a child's behalf).

Aside: I heard security staff make an exchange suggesting they'd chosen a particular person to search "because you like doing the $ageGroupIdentifier", which might have been innocent but came across as wholly wrong.