DATA PROTECTION ACT 2018 AND UK GENERAL DATA
PROTECTION REGULATION
REPRIMAND
TO: Chelmer Valley High School
OF: Court Road, Broomfield, Chelmsford, Essex, SM1 7ER
1.1 The Information Commissioner (the Commissioner) issues a
reprimand to Chelmer Valley High School in accordance with Article
58(2)(b) of the UK General Data Protection Regulation (UK GDPR) in
respect of certain infringements of the UK GDPR.
The reprimand
1.2 The Commissioner has decided to issue a reprimand to Chelmer Valley
High School in respect of the following infringements of the UK GDPR:
• Article 35(1) of the UK GDPR which states a controller shall, prior to
the processing, carry out an assessment of the impact of the
envisaged processing operations on the protection of personal data,
where this processing is likely to result in a high risk to the rights
and freedoms of natural persons.
1.3 The reasons for the Commissioner’s findings are set out below.
1.4 The controller, Chelmer Valley High School, are an academy school
located in Essex providing education for around 1,200 students ages 11 to
18. This reprimand concerns the processing of biometric personal data for
the purposes of managing their cashless catering system.
1.5 Chelmer Valley High School introduced facial recognition technology in
March 2023. Prior to this, their cashless catering was managed through
fingerprint recognition technology, which had been in place since 2016.
The facial recognition technology was provided to Chelmer Valley High
School by CRB Cunninghams, which acts as a processor on behalf of
Chelmer Valley High School.
1.6 On 29 January 2024 Chelmer Valley High School’s Data Protection
Officer (DPO) ‘IGS’ contacted the Commissioner and provided a DPIA that
had been completed in November 2023. IGS considered the processing to
1
be high risk, and submitted the DPIA for review. IGS confirmed that no
DPIA had been completed for the introduction of facial recognition
technology prior to the processing commencing in March 2023.
1.7 Through further correspondence with IGS it was established that
from March to November 2023 the controller had been relying on
assumed consent for facial recognition, except where parents or carers
had opted children out of the processing. Article 4(11) of the UK GDPR is
clear that consent requires an affirmative action, and as such consent on
an opt-out basis would not have been valid or lawful. Further to this, the
majority of students would have been considered sufficiently competent
to provide their own consent. The parental opt-out deprived students of
the ability to exercise their rights and freedoms in relation to the
processing between March and November 2023.
1.8 The controller also failed to seek advice from their DPO in relation to
the introduction of the facial recognition technology, nor did they consult
with parents or students before commencing with the processing. The
Commissioner believes that had Chelmer Valley High School sought
advice from their DPO, many of the compliance issues would have been
identified prior to the processing commencing.
1.9 Under Article 35(4), the Commissioner has published a list of
processing activities that require a DPIA to be completed prior to the
processing. The Commissioner’s published list states that the processing
of biometric data requires a DPIA where this is combined with any of the
criteria from the European guidelines1. These guidelines include the
processing of data concerning vulnerable data subjects (such as children),
and the use of new technological solutions.
2.0 Chelmer Valley High School has therefore failed to complete a DPIA
where they were legally required to do so. This failing meant that no prior
assessment was made of the risks to data subjects, no consideration was
given to lawfully managing consent, and students at the school were then
left unable to properly exercise their rights and freedoms.
2.1 Chelmer Valley High School were invited to provide representations.
Chelmer Valley High School failed to provide any representations.
1
JUSTICE AND CONSUMERS ARTICLE 29 - Guidelines on Data Protection Impact Assessment (DPIA)
(wp248rev.01) (europa.eu)
2
Remedial steps taken by Chelmer Valley High School
2.2 The Commissioner has considered and welcomes some of the
remedial steps taken by Chelmer Valley High School. In particular, the
completion of a DPIA in November 2023 and refreshing of consents by
obtaining explicit opt-in consent from students.
Decision to issue a reprimand
2.3 Taking into account all the circumstances of this case, including the
remedial steps, the Commissioner has decided to issue a reprimand to
Chelmer Valley High School in relation to the infringements of Article
35(1) of the UK GDPR set out above.
2.4 While several areas of non-compliance are apparent, the
Commissioner has decided to focus on the controller’s actions prior to the
processing. The completion of a comprehensive DPIA before the
processing commenced would have provided Chelmer Valley High School
with the opportunity to asses the risks of the processing, and avoid the
subsequent compliance failures.
Further Action Recommended
2.5 The Commissioner has set out below certain recommendations which
may assist Chelmer Valley High School in rectifying the infringements
outlined in this reprimand and ensuring Chelmer Valley High School’s
future compliance with the UK GDPR. Please note that these
recommendations do not form part of the reprimand and are not legally
binding directions. As such, any decision by Chelmer Valley High School to
follow these recommendations is voluntary for Chelmer Valley High
School. For the avoidance of doubt, Chelmer Valley High School is of
course required to comply with its obligations under the law.
2.6 If in the future the ICO has grounds to suspect that Chelmer Valley
High School is not complying with data protection law, any failure by
Chelmer Valley High School to rectify the infringements set out in this
reprimand (which could be done by following the Commissioner’s
recommendations or taking alternative appropriate steps) may be taken
into account as an aggravating factor in deciding whether to take
enforcement action - see page 11 of the Regulatory Action Policy
Regulatory Action Policy (ico.org.uk) and Article 83(2)(i) of the UK GDPR.
3
2.7 The Commissioner recommends that Chelmer Valley High School
should consider taking certain steps to improve its compliance with UK
GDPR. With particular reference to Article 35 of the UK GDPR, the
following steps are recommended:
1. Prior to new processing operations, or upon changes to the nature,
scope, context or purposes of processing for activities that pose a
high risk to the rights and freedoms of data subjects, complete a
DPIA and integrate outcomes back into the project plans. Types of
processing that require a DPIA to be completed can be found in our
website guidance.
2. Amend the DPIA to give thorough consideration to the necessity and
proportionality of cashless catering, and to mitigating specific,
additional risks such as bias and discrimination.
3. Review and follow all ICO guidance for schools considering whether
to use facial recognition for cashless catering. A case study on North
Ayrshire Council schools and their use of facial recognition
technology can be found on our website.
4. Amend privacy information given to students so that it provides for
their information rights under the UK GDPR in an appropriate way.
5. Engage more closely and in a timely fashion with their DPO when
considering new projects or operations processing personal data,
and document their advice and any changes to the processing that
are made as a result.
4