Data Protection

Data Protection Policy

Please see The Bishop Fraser Trust website.

Pupil Privacy Notice

Information about how the school processes the personal data of pupils can be found in our Pupil Privacy Notice.

Staff Privacy Notice

Please see The Bishop Fraser Trust website.

Governor Privacy Notice

Information about how the school processes the personal data of school governors can be found in our Governor Privacy Notice.

Recruitment Privacy Notice

Please see The Bishop Fraser Trust website.

Subject Access Requests

If you would like to make a Subject Access Request under the UK GDPR and the DPA 2018, please complete the form below and send it to the email address on the form. Please note:

• Where a request is made by a parent on behalf of a pupil, we will require the permission of the pupil if they are old enough to be able to understand their rights over their own information (this is generally considered to be age 12 and above). This will need to be in the form of a signed letter from the pupil stating that they give permission for their parent to make the SAR on their behalf.
• To protect the personal data that we hold, we are required to confirm the identity of the person making the SAR before releasing data. Therefore we will need to see a copy of photographic identification such as a driving license or passport.

Subject Access Request (SAR) form

All requests for access to information (under Schedule 2, Part 1 (2) Data Protection Act 2018) from law enforcement need to be submitted to the school using the form below:

Personal Data Request Form (Law Enforcement)

Cashless Catering System - Automated Facial Recognition

The school uses automatic facial recognition technology to allow pupils and staff to purchase meals in the school canteen as part of our cashless catering system. Please see the Frequently Asked Questions below for more information on the system.

What is biometric facial recognition?

Biometric recognition converts physical characteristics into a unique digital signature that can quickly and securely locate your child’s cashless catering account. We have found that fingerprint recognition is still too slow and unreliable. Facial recognition is a much faster, more reliable and more hygienic method of authentication which will allow your child more time to eat their food.

How does it work?

When the child looks at the camera, the software reads key features (e.g. distance between facial features for facial recognition) and compares this against the database of registered users. When it finds a match, it automatically opens their cashless catering account allowing the catering staff to complete the sale of their school meals.

How is the data stored?

Facial Recognition data is a unique string of characters known as a faceprint template. This data is encrypted using AES-256 and stored on a school server within the secure school network. We store a photo along with the faceprint template. The cashless system has always stored a user’s photo, which is used as an added verification by the canteen staff.

Can any other agency use these biometrics registrations?

No, the software turns your child’s physical characteristics into an encrypted (using AES-256) string of characters known as a template. Even if someone gained access to the data and broke the encryption, this template does not contain enough information to reverse engineer it into a usable photo.

What will happen to the fingerprint biometric data that the school were already using if I had given consent before?

All fingerprint biometric data will be securely deleted from our systems when we switch over to facial recognition.

Does Facial Recognition work with glasses, facial hair, face coverings or religious headwear?

Facial Recognition has no issues with users wearing or removing glasses and has been proven to work with users growing/removing facial hair before and after registering a template. Facial recognition is also able to work with religious items such as turbans, head scarves, and hijabs as the algorithm is only interested in facial features. Facial recognition has also been shown to perform relatively well with partial face coverage, however due to reduced visible facial features, users wearing such a covering may have more difficulty being identified.

How does the system deal with identical siblings?

When it comes to identifying users where their face template data will be very similar, for example with identical siblings, if there are multiple potential matches, these will be presented to the catering staff who will then be able to manually select the user from these available options.

What happens when my child leaves the school?

When a student leaves school, all data will be securely deleted.

I don’t wish to permit my child to participate in biometric recognition. Can my child still purchase school meals?

Yes, an alternative method of authentication will be a PIN number that you child will need to remember. If your child was already using a PIN previously then they may be given a different PIN for the new system.

What if I change my mind?

If you initially opt-in for your child to use biometric recognition but later change your mind, contact the school, and we will remove the permission from the system, automatically removing any biometric data associated with your child and providing your child with a PIN as an alternative authentication method.

How accurate is the technology?

The accuracy of the algorithm varies depending on the number of face templates stored within the database. Our system can hold a maximum of 10,000 users. According to independent testing performed by the National Institute of Standards and Technology (www.nist.gov), assuming that there are the maximum of 10,000 users with face templates enrolled with good quality templates, the likelihood of a false positive is 0.001875%, or in other words we can expect that in every 100,000 identifications performed over the database of 10,000 there will be 2 users incorrectly identified. In a typical school usage, the number of face templates registered would be circa 1,000, therefore the likelihood of a false positive is reduced 10-fold. However, as the use of FRT is a manual operation, the operator will be able to notice that an incorrect account has been opened and retry the identification. In addition to False Acceptance Rates, we also consider the False Rejection Rate. This is where a user who has been successfully enrolled is not identified by the system when the operator triggers an identification attempt. Using the same 10,000 users, for each identification attempt, there is a 0.34% chance that a previously enrolled user will be rejected and will be asked to try again.

Do the templates need to be periodically updated to maintain accuracy?

All faces age and while this usually proceeds in a graceful and progressive manner, changes in facial appearance increase with the time elapsed between initial enrolment and future identification attempts. This is especially true when dealing with users of school age. As ageing is unavoidable, it can only be mitigated by scheduled re-capture. Our software aims to handle this automatically, removing the requirement for manual re-enrolment. Each user can have up to 5 templates stored against their account (by default this is set to 3 and can be changed to as low as 1). When a user is successfully identified at the Point of Sale, if the most recent template registered for that user is older than a few weeks (default setting is 3 weeks), then the software will remove the oldest template and store the one just captured in its place. This process will ensure that a user’s face template evolves as they age.

Are there any racial and/or other biases present in the algorithm?

The facial recognition algorithm that is used by our system has been trained with increased datasets containing male and female images as well as images of all demographic regions and age groups. It has also been deployed all over the world – in Africa, many Asian countries, Latin America, but also Europe and Northern America, in a wide-range of use-cases where the number one condition is to be able to identify with a high reliability – i.e., extremely low False negative rates while keeping the False positive rates at the lowest possible values. The National Institute of Standards and Technology, who provide the dataset that the algorithm is trained upon, is also addressing this issue by increasing the test dataset – they currently test on 30 million images taken under different conditions and containing images varied by age, gender, and demography.

Are the templates stored used to further train the algorithm?

No. The templates processed by CRB Cunninghams use of the algorithm are not used to further train the algorithm.