Facial recognition: School ID checks lead to GDPR fine • Hacker News Board

Re: Facial recognition: School ID checks lead to GDPR fine

#161

Post by rndgermandude » Sat, Aug 31, 2019, 4:03 PM UTC

mytailorisrich wrote: post #55

rndgermandude wrote: post #17

Earlier quoted context omitted.

Everybody was informed and OK.... Except for the students they tracked, nobody asked them. Sure, they are still minors, and it's up to the parents to decide what goes and what not. But by law the parents in Sweden (and a lot of other places around the world) have an obligation to act in the best interest of their children to their best ability. I'd argue exposing their children to mass surveillance in school and face…

This is turning into a religious war, with facial recognition being branded absolutely evil. As I already wrote, I think that being able to locate pupils at all times is a legitimate concern for schools, and parents. Certainly schools already work hard to achieve this especially with younger children. I think facial recognition can bring real benefits without many drawbacks if used properly. An effective blanked ban…

>As I already wrote, I think that being able to locate pupils at all times is a legitimate concern for schools, and parents.

Depends on the age, really. It goes from all the time for really young children, to "locate in a reasonable amount of time, if needed". How long that is depends on the comfort zone of the parents of course, but has to account for allowing children to develop, learn by themselves and grow, or else it's wrongful imprisonment to be honest.

By the way, the "being able to locate all the time" wasn't even the goal of the school. It was to take attendance.

Re: Facial recognition: School ID checks lead to GDPR fine

#162

Post by labawi » Sat, Aug 31, 2019, 4:45 PM UTC

SiempreViernes wrote: post #129

nmstoker wrote: post #83

Earlier quoted context omitted.

The figure I saw (on the BBC article and the linked Swedish article) was 17,000 hours per year in this school. That still seems suspect: estimating a school year of 35 weeks that's 175 days, thus 97 hours per day across all teachers. Even if it were some mega school of 1,000 pupils and maybe 100 teachers that seems high, would imply they spent perhaps ten minutes of every hour in a six hours day taking & dealing with…

The new system could well have automated more than just the role call, and so they can add in savings in the post processing of the attendance records.

Perhaps .. But what processing was enabled that could not have been done without camera surveillance?

Re: Facial recognition: School ID checks lead to GDPR fine

#163

Post by gwright » Sat, Aug 31, 2019, 4:51 PM UTC

jdietrich wrote: post #74

gwright wrote: post #22

Earlier quoted context omitted.

Thank you for surfacing this language. In the more general case, I was under the impression that informed consent was sufficient to authorize a data controller to collect/process private information and so the ruling didn't make sense to me. I'm using "informed consent" here as a short hand for all the applicable GDPR requirements on consent (reasonable language, etc). It isn't clear to me from this language in Recit…

>It seems like this ruling destroys the clarity of "consent" and replaces it with "(consent AND balanced relationship) OR (imbalanced relationship AND legally adequate reason AND prior approval from regulator AND consent)" Consent is not always necessary, nor is it always sufficient. If you rely on consent as a lawful basis for data processing, the burden of proof lies with you to demonstrate that such consent was in…

Why were they in an imbalanced situation? In this particular case, I believe it was a trial. So parents could have withheld consent with no negative consequences as far as I can tell.

I realize that this particular situation is about facial recognition, but I was trying to point out that this ruling changes the game for everything, basically creating a situation where the only way for a data controller to minimize legal risk would be to get prior authorization from the data authority. That is a problematic.

Re: Facial recognition: School ID checks lead to GDPR fine

#164

Post by m0xte » Sat, Aug 31, 2019, 4:54 PM UTC

lowercased wrote: post #149

m0xte wrote: post #110

Earlier quoted context omitted.

I was one of the kids who peed himself in class due to one of those teachers. I had asked three times to go. Ripe age of of 12 no less. It destroyed my fear of and respect for arbitrary authority instantly so I look back on it as a good thing today. I realised that rather than my peers turning on me on a shame basis they turned on the teacher because it was going to be them next. It also positioned me well for dealin…

happened to me at age 7(?) - I remember the grade and room, just not the date. it was one of those things that chipped away at my respect for authority - it didn't destroy it, but still dinged it. Peers still turned on me - no one thought "it could be me next". We were 7/8(?) - I'm not sure most people could reason that far ahead vs living in the moment. What sticks with me is that we had an announcement earlier (few…

I think at the age of 7/8 your metric of success is tied strongly to how you control your body, probably due to all the reinforcement of this from years before. At 12 things were likely easier for me.

They use that ridiculous methodology now. For example my eldest's entire class was held back at the end of the day for 15 minutes due to one child's behaviour. Unfair and her ASD younger sister relies on her to get home and had a complete panic and breakdown over the routine change. Teachers surprisingly never available for comment after such things due to the layer of bureaucracy over everything. Formal complaint raised, pushed to the very end of their own self-inflicted process every time they screw up!

Re: Facial recognition: School ID checks lead to GDPR fine

#165

Post by theferalrobot » Sat, Aug 31, 2019, 5:33 PM UTC

vangelis wrote: post #58

theferalrobot wrote: post #36

Earlier quoted context omitted.

Yeah, people have always been scared of new technologies. When people are scared of a computer being able to do a task that is mundane for people (recognize someone) you can know it is just hysteria.

Damn, I didn't know people's memories could be archived and replayed.

Schools are already under constant camera surveillance that isn't what is being discussed. The new thing here is facial recognition.

Re: Facial recognition: School ID checks lead to GDPR fine

#166

Post by zaroth » Sat, Aug 31, 2019, 6:26 PM UTC

dannyw wrote: post #32

zaroth wrote: post #2

> According to the DPA ruling, although the school secured parents' consent to monitor the students, the regulator did not feel that it was a legally adequate reason to collect such sensitive personal data. It’s this kind of second-guessing which is extremely concerning about GDPR-type regulation. Not that the information was not secure, or leaked, or mishandled, or consent wasn’t obtained, but even if all that is do…

And you think this is an appropriate use of facial recognition?

Actually I think it's a perfectly appropriate use of facial recognition in this case.

Firstly, the school district already has a picture of every child at the school. Second, they already track the child (manually) at all times throughout the day.

So, they are not collecting any more information than they already had, nor are they collecting any more information than is legally required (attendance tracking is likely to be legally mandated)

The end result is the same exact data exposure / privacy risk that they started with, and more classroom hours to actually teach instead of taking attendance.

The classroom setting is a particularly good example of the narrow use case when facial recognition is acceptable. Unlike, for example, in a retail establishment, where a casual customer who browses the store but does not buy anything would otherwise remain anonymous.

Quite the contrary, you do not want anyone in the classroom who is anonymous.

Re: Facial recognition: School ID checks lead to GDPR fine

#167

Post by zaroth » Sat, Aug 31, 2019, 6:42 PM UTC

mattlutze wrote: post #151

concordDance wrote: post #134

I'm struggling to see any actual harm from this use of facial recognition if the video is deleted promptly after processing and conversion to an attendance list.

In order to make a positive ID of a student, you need to have a biometric photo of them, or a set of unique indicators that your recognition system will be able to compare against. This facial fingerprint will need to be pretty strongly unique so as to avoid false positives or false negatives. If that information is stolen, the thief has the fingerprint for your face, which is very difficult for you to change. The le…

I couldn't find online if Anderstorp High has Student IDs, but assuming that they do, the school already has a photograph of every student.

Re: Facial recognition: School ID checks lead to GDPR fine

#168

Post by zaroth » Sat, Aug 31, 2019, 6:44 PM UTC

cameronbrown wrote: post #13

tapland wrote: post #6

Earlier quoted context omitted.

Afaik the ruling also stated that parents abd children dont have a resonable ability to consent towards a school.

That makes sense. Opt out for even just one individual would be effectively impossible, otherwise how would the system know who's opted out without remembering them in some way.

This was a tech trial where 22 students and their parents (both separately) opted in to take part over 3 weeks. The teacher also opted-in.

Re: Facial recognition: School ID checks lead to GDPR fine

#169

Post by zaroth » Sat, Aug 31, 2019, 6:50 PM UTC

codedokode wrote: post #35

Collected data can be used later - for example, the school or teachers can sell face models to advertisers, shopping mall owners, data brokers, Facebook, Google etc. So it is a right decision to shut down such a dubious project. The school could simply use RFiD cards for tracking attendance.

> The school could simply use RFiD cards for tracking attendance.

They actually studied this as well as the facial recognition system. Two different classrooms over an 8 week period.

The biggest problem they found with the RFID system;

> During the first week of testing (week 41) 38% of pupils didn’t bring their tag at each lesson, while in the second week of testing (week 42) 47% forgot it. [1]

[1] - http://pages.tieto.com/rs/517-ITT-285/images/SummaryFutureCl...

Re: Facial recognition: School ID checks lead to GDPR fine

#170

Post by t34543 » Sat, Aug 31, 2019, 7:16 PM UTC

m0xte wrote: post #110

noir_lord wrote: post #106

Earlier quoted context omitted.

When I was 9 I had an absolutely awful teacher (to the extent she'd refuse kids using the bathroom to the point where they'd pee themselves (it was the 80's)), I told my mum about it and her response was "If you need to go ask, if she says no, go anyway and I'll deal with the fallout". It was my first lesson in dealing with unjust authority and that most authority relies on the principle that most people under it wil…

I was one of the kids who peed himself in class due to one of those teachers. I had asked three times to go. Ripe age of of 12 no less. It destroyed my fear of and respect for arbitrary authority instantly so I look back on it as a good thing today. I realised that rather than my peers turning on me on a shame basis they turned on the teacher because it was going to be them next. It also positioned me well for dealin…

I had a similar experience in school, it still impacts me today. I don’t recognize authority for authority’s sake, only what I feel is reasonable and just. It’s liberating.