10 ms·

> According to the DPA ruling, although the school secured parents' consent to monitor the students, the regulator did not feel that it was a legally adequate r

• jdietrich 7y ago
  The GDPR doesn't specify what you can't do with personal data, it specifies what you can do. Personal data is private by default; you can only use my data if it is explicitly lawful for you to do so. If you're not absolutely sure that what you're doing is in line with the GDPR, you shouldn't do it. That's by design, not by accident. The GDPR's fundamental principles are set out in article 5. You should collect the least amount of data possible, you should process it only for specific, explicit and legitimate purposes and you should delete it as soon as possible once you've finished. Can anyone legitimately argue that a facial recognition system is the least intrusive way of collecting attendance data? Would any reasonable person believe that constant video surveillance with facial recognition technology is no more intrusive than taking the register at the start of class? I think not. The actions of the school authorities were in flagrant breach of the GDPR and they fully deserve to be fined. There's no second-guessing in this case, no grey area, just an organisation that used advanced surveillance technology to monitor children without giving a moment of thought to the privacy implications. This fine is precisely in line with the intentions of the European Parliament when they signed the GDPR into law. https://gdpr-info.eu/art-5-gdpr/ https://gdpr-info.eu/art-5-gdpr/
  • tapland 7y ago
    Afaik the ruling also stated that parents abd children dont have a resonable ability to consent towards a school.
    • cameronbrown 7y ago
      That makes sense. Opt out for even just one individual would be effectively impossible, otherwise how would the system know who's opted out without remembering them in some way.
      • tpxl 7y ago
        A person who has not opted in has opted out. No tracking necessary.
        • cameronbrown 7y ago
          You really think they're going to design things opt in and not opt out?
          • tpxl 7y ago
            The question was how do you track whether people have opted in or not, by not having biometrics for people who have opted out. The solution is simple, if you do not recognise the person, they have not opted in. According to the article, the experiment was constructed as opt in and several students have opted in.
            • cameronbrown 7y ago
              The thing is, aren't all the efficiency gains wasted if even just a couple students opt out? You've still got to take a register, even if shorter. It can't be worth it for a few extra minutes.
      • zaroth 7y ago
        This was a tech trial where 22 students and their parents (both separately) opted in to take part over 3 weeks. The teacher also opted-in.
    • xxs 7y ago
      It's covered by recital 43 which deals with public institutions and power imbalance. There is no practical way for a student (or their parents) to say no, given the circumstances.
  • tomatocracy 7y ago
    I don't think the argument was that it was not in line with GDPR. The argument is that GDPR is wrong itself in not allowing people to consent to anything which goes beyond "minimal" data collection for the purpose needed, because whether it is "minimal" is, in some sense, a value judgment as to how much convenience and innovation matter. It seems to me that the principle should be personal "ownership" of personal data - and "ownership" of data should imply the owners have the right to alienate that data as the owner sees fit, with the right safeguards to ensure this isn't coerced or a result of fraud. On the other hand, this type of scenario doesn't feel much like the consent given was really voluntary - (1) because noone wants to be the one person who stopped the school from doing something which everyone else was on board with and (2) because it involved adults consenting on behalf of children for something which the children may not be happy about in future when they are adults and it's too late.
    • crooked-v 7y ago
      The reason that the GDPR is so expansive is that 'voluntary' consent means nothing when your only alternatives to not 'voluntarily' consenting are moving to a different city or going completely without a given service. See how, for instance, literally every major internet provider in the US have contract clauses that amount to 'we can do whatever we want with your personal information forever, neener neener'.
    • sokoloff 7y ago
      As a parent, I constantly make choices on behalf of my children that they (or I) may not be happy about in the future and it’ll be too late.
  • mytailorisrich 7y ago
    The issue with the GDPR as worded and this ruling is that they remove the possibility of informed individual decisions. In this case it seems that all involved were informed and OK with it but that did not matter. I would also think that knowing where pupils are at all times is quite a legitimate aim for a school.
    • deleted 7y ago
      [deleted]
    • ziddoap 7y ago
      Do you have any evidence that all parties provided informed consent? i.e. The consent form detailed out what could happen in the (somewhat likely) event the data is breached and how the data may be used? What other parties have access to the information and how that information is stored? How the information is transmitted? And they understood it all, with the attached implications? Considering the only words the person who oversees both high schools had to say on record was that the technology is "fairly safe", I am somewhat doubting that the parents had a fully formed view of what the potential downfalls of the program are if/when it is breached or misused, or even malfunctions. I think when we are dealing with advanced tech such as facial recognition it is analogous to the informed consent issues doctors face. How can someone possibly obtain informed consent from non-experts over something that requires years of schooling to understand?
      • mytailorisrich 7y ago
        This is going over the top. It was just about using facial recognition in a school, not about having brain implants in children... Schools already have pictures and detailed personal details of all pupils. This new technology can have real benefits. For example it could be used to locate a pupil that does not show up in class when they should, or to trigger an alert if a pupil leaves school when not expected to or when someone unknown is detected. To me the law should protect but not prevent useful applications that people agree to, and I think that this specific case shows that, as they stand, the GDPR can be over-restrictive.
  • jimmaswell 7y ago
    Choosing between European internet laws and having a tech sector, I'd pick having a tech sector any day. It's all totally unnecessary strangling of innovation. The entire idea that you own data pertaining to you is absurd.
    • intertextuality 7y ago
      This is not a dichotomy. We can have a tech sector that’s also compliant with laws like GDPR.
      • ggreer 7y ago
        No, you can't. Since GDPR was rolled out, venture capital investments in the EU have dropped by a third.[1] According to that paper, the companies most hurt are early stage startups. 1. The Short-Run Effects of GDPR on Technology Venture Investment: https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3278912 https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3278912
        • maldeh 7y ago
          That presumes all early stage startups (as made in the US) are created equal, and any regression in their success rates is bad. Given that 9/10 startups fail even without GDPR, it's not surprising that early stage cos form the Lion's share of failures, and it surely can't be good for any data that was slurped up during whatever these experiments at market fit were doing. And given that the ultimate goal of GDPR is to protect privacy, it doesn't make sense to exempt startups, especially when the early stage stakes are high and a failure to squeeze out every drop of value legally possible out of your data (while your competitors do) could mean the death of your venture. As such, comparing to American standards or even current European standards doesn't quite work when there's a clear shift of the moral bar for GDPR compliance.
          • ggreer 7y ago
            You misunderstand the point I'm making. After GDPR, investments in early stage startups dropped by almost 50% in the EU. If you cut investment in half, you're going to cause some startups to fail that otherwise would have succeeded. Startups are a "hits" enterprise. Most fail. Some are mildly successful. A few are responsible for almost all of the upside. Cutting investment by 50% means that instead of getting a Dropbox and a Spotify, you'll only get a Dropbox. That missing upside is bad for the economy. I'm saying that you can have GDPR or you can have a thriving startup ecosystem. The data shows that you can't have both. Personally, I think the GDPR is a colossal waste of time that only benefits incumbents. I've had to help implement GDPR compliance at a company and it did absolutely nothing to protect the privacy of customers. However it did cost several hundred thousand dollars.
  • downandout 7y ago
    This fine is precisely in line with the intentions of the European Parliament when they signed the GDPR into law. That is certainly a statement that no one could argue with. I think the argument is whether those intentions are actually good, logical, or workable. For example, the fine structure is explicitly designed so that they could take all of the assets of a small business and wipe it off the face of the map, but only take 5% of annual revenue of a large business. Does that reflect an intention to consolidate market power in the hands of a very few companies? That would be a bad intention in IMO.
    • xxs 7y ago
      >but only take 5% of annual revenue of a large business It's 4% global revenue and it's really a lot. Fines are issued based on the amount of data and amount of people affected. Small companies rarely need anything but contact information. Storing the data securely is no trivial task for any size of organization, though. Small companies would have significantly less data and customers to be worthy of a hefty fine. Again, if you can't keep the data secure, don't go into such a business.
      • downandout 7y ago
        I was referring to the maximum fine. It is 4% of global revenues, or 20M EUR, whichever is greater. So the maximum fine would wipe out any business that doesn’t happen to have 20M EUR lying around - that might be 1000% of what they have, but the damage to a large business is capped at 4% of their revenue regardless of how egregious the behavior. That kind of a fine structure has only one possible purpose: it was specifically designed to be able to decimate small businesses while being a minor speed bump for any large business. The ultimate effect is the consolidation of power into the hands of handful of large companies.
        • isostatic 7y ago
          Normal fines are “up to x million” The GDPR fine is specially done some large multinationals can’t ignore it.
• dannyw 7y ago
  And you think this is an appropriate use of facial recognition?
  • Caligatio 7y ago
    Speaking purely on the technical side of this problem: if you had to design a system to take attendance without some sort of human in the loop (e.g. a teacher), what other workable solutions are there? ID scanned by itself? A student could scan multiple IDs for their friends. ID + PIN? Due to the bursty nature of entering classrooms, that would cause a jam up at the PIN reader. Short of an ID shackle (that's a joke), nothing really comes to my mind that is foolproof.
    • whatshisface 7y ago
      If I had to design a system to track students without teacher's involvement, my first step would be to find the stakeholders and remind them that they are asking for a system that is worse, more expensive, and more dystopian than the simple system they already have. It's kind of a false question - like asking, "suppose that a boot was going to stamp on the face of humanity forever, what kind of leather would you make it out of?"
      • Caligatio 7y ago
        I'm not a proponent of facial recognition at all and would not endorse it especially in this use case. But, if you believe the 17,000 hours/year number, that's ~$500,000/year (assuming $30/hour, random guess) in potential savings. Are you saying there can't possibly be system that could be designed to take attendance while not further infringing on a student's privacy that's cheaper than that? What is probably happening is that this is some sneaky way of introducing facial recognition in schools and something benign like attendance was the excuse. That, however, is a separate conversation from my original post of how would you automate attendance without using facial recognition.
    • mikekchar 7y ago
      I've worked as a teacher before. I'm a bit confused as to the 17,000 hours time claimed to collect attendance information (and hence the justification that you need to automate it). Where is that number coming from? As part of my job, I had to be able to recognise and put a name to all of my students. This is legitimately difficult and I spent a lot of time doing it. However, it was not for doing attendance! If you are in a school system below university and your teacher doesn't recognise you or know your name... I mean... I can't even comprehend what a bad situation that is. How could you ever teach a student if you know so little about them that you can't even recognise them? When you are marking their paper and see their name, if you don't even know who they are, how can you give appropriate guidance? That kind of situation would be shocking. And to be fair... because it is really, really hard I know a lot of teachers who have no clue... but seriously, this is not what we aim for! Once you know the students, attendance is easy. Why is that chair empty? Who is supposed to sit there? Look at your seating chart (seriously, it's the best way to learn their names...). Is that person anywhere else in the room? No? They are absent. Mark it on your list. That takes all of 2 seconds. If you are really doing your job, you can ask why the person is missing. Maybe you can have their friend take them some homework. A surveillance system can't do that. I mean... Why would you ever want an automated system in this circumstance? It just makes no sense. I think the reality of the situation is that they really wanted a surveillance system. They didn't want to record attendance, they wanted to know where the students were in every second of the day. They wanted to time home long they are in the toilet so that they can catch them smoking or dealing drugs. They wanted to see them leaving the school o that they can lie in wait and nab them as they cut class: students 2 and 5 are supposed to be in band class but they are headed in the opposite direction -- go all you zigs! For great justice! I just can't imagine any other reason you'd want this. Perhaps I'm wrong. I certainly hope so!
• jplayer01 7y ago
  > although the school secured parents' consent to monitor the students, the regulator did not feel that it was a legally adequate reason to collect such sensitive personal data. But this is the exact kind of situation GDPR was designed to prevent. One in which the school obviously used its position to coerce consent, because that's not consent anymore. It means companies and institutions can't abuse their power to get consent for unnecessarily broad data collection. The law is absolutely crystal clear about this and spinning it as "second-guessing is concerning" is absurd. Any less onerous requirements would easily be loopholed and technicalitied to death because that's what companies and institutions do whenever they see the opportunity. If you're upset with GDPR, blame the companies who aren't respecting our rights.