Facial recognition: School ID checks lead to GDPR fine

That presumes all early stage startups (as made in the US) are created equal, and any regression in their success rates is bad.

Given that 9/10 startups fail even without GDPR, it's not surprising that early stage cos form the Lion's share of failures, and it surely can't be good for any data that was slurped up during whatever these experiments at market fit were doing.

And given that the ultimate goal of GDPR is to protect privacy, it doesn't make sense to exempt startups, especially when the early stage stakes are high and a failure to squeeze out every drop of value legally possible out of your data (while your competitors do) could mean the death of your venture.

As such, comparing to American standards or even current European standards doesn't quite work when there's a clear shift of the moral bar for GDPR compliance.

You misunderstand the point I'm making. After GDPR, investments in early stage startups dropped by almost 50% in the EU. If you cut investment in half, you're going to cause some startups to fail that otherwise would have succeeded. Startups are a "hits" enterprise. Most fail. Some are mildly successful. A few are responsible for almost all of the upside. Cutting investment by 50% means that instead of getting a Dropbox and a Spotify, you'll only get a Dropbox. That missing upside is bad for the economy.

I'm saying that you can have GDPR or you can have a thriving startup ecosystem. The data shows that you can't have both.

Personally, I think the GDPR is a colossal waste of time that only benefits incumbents. I've had to help implement GDPR compliance at a company and it did absolutely nothing to protect the privacy of customers. However it did cost several hundred thousand dollars.

I work in public digitalisation in Denmark, and I can’t think of a single reason of why you would ever even want this.

What’s the use case? Automatic student registration? If it is, and I can certainly imagine some HR consultant going “weeeeeell we can squeeze five minutes of extra education in if we remove this teacher-student interaction of registration, that’s a gazillion hours of extra education a year!”. I know this is a strawman of my experience, but it’s frankly the only way it would happen at my place. Which would be crazy considering the primary focus of Schools in Scandinavia is to educate democratic citizens, and automating something as meaningful as presence registration is damaging to that focus because the “AI” won’t be able to have a conversation about the usefulness of attendance.

So I absolutely agree with you. This is completely crazy, but what I really wonder is why no one asked “why?”.

The main parts of the wrong-doing:

- The school had obtained consent from the pupills and each one of the pupills could opt out at any time. The Swedish Data Protection Agency (DPA) did however find that due to the power balance of a school vs a pupill, these consents are not ”freely given”, and thus are void. The school therefor have no legal basis of processing special categories of data/sensitive data, which processing face recognition data (”biometric information”) for identification purposes is. Violation of GDPR Article 9.

- The school had not completed a sufficient Data Protection Impact Assesment which properly identified risks of this processing. In addition, due to the nature of this processing, they would have been obliged to consult with the DPA about this impact assessment before starting. Violation of GDPR Article 35&36.

- The DPA also found that the processing was more extensive than necessary, since attendance could be taken in less invasive ways. This a violation of GDPR article 5.1c (the data minimisation principle).

I hope the decision will be appealed by the school, which is run by the municipality. There are several interesting questions, such as if consent can be freely given in schools, if the data minimization principle was really breached (the school claimed this way of taking attendance saves a calculated 72,000h of teachers time per year in just this school), etc. I am not sure however that the municipality has the right resources and competency to make a competent appeal.

I've worked as a teacher before. I'm a bit confused as to the 17,000 hours time claimed to collect attendance information (and hence the justification that you need to automate it). Where is that number coming from?

As part of my job, I had to be able to recognise and put a name to all of my students. This is legitimately difficult and I spent a lot of time doing it. However, it was not for doing attendance! If you are in a school system below university and your teacher doesn't recognise you or know your name... I mean... I can't even comprehend what a bad situation that is. How could you ever teach a student if you know so little about them that you can't even recognise them? When you are marking their paper and see their name, if you don't even know who they are, how can you give appropriate guidance? That kind of situation would be shocking. And to be fair... because it is really, really hard I know a lot of teachers who have no clue... but seriously, this is not what we aim for!

Once you know the students, attendance is easy. Why is that chair empty? Who is supposed to sit there? Look at your seating chart (seriously, it's the best way to learn their names...). Is that person anywhere else in the room? No? They are absent. Mark it on your list. That takes all of 2 seconds. If you are really doing your job, you can ask why the person is missing. Maybe you can have their friend take them some homework. A surveillance system can't do that.

I mean... Why would you ever want an automated system in this circumstance? It just makes no sense.

I think the reality of the situation is that they really wanted a surveillance system. They didn't want to record attendance, they wanted to know where the students were in every second of the day. They wanted to time home long they are in the toilet so that they can catch them smoking or dealing drugs. They wanted to see them leaving the school o that they can lie in wait and nab them as they cut class: students 2 and 5 are supposed to be in band class but they are headed in the opposite direction -- go all you zigs! For great justice!

I just can't imagine any other reason you'd want this. Perhaps I'm wrong. I certainly hope so!