NORTH Ayrshire Council's controversial and short-lived school facial recognition technology (FRT) is "likely" to have breached data protection law.

The judgement comes following a review by independent watchdog the Information Commissioner's Office (ICO) more than a year after the system was abruptly removed from schools in the area.

FRT was introduced in nine North Ayrshire secondary schools in September 2021 - affecting more than 2,500 pupils - before being swiftly withdrawn from service the following month.

The system was designed to manage 'cashless catering' by scanning the faces of pupils at canteen tills and matching the photo to a digital record, at which point money would be deducted from their online account and transactions would be streamlined during the busy lunch break.

The council told the ICO that it had paused the use of the technology at the end of October 2021 after concerns were raised, and by the middle of November all data had been deleted.

The ICO issued a letter to the council last week listing its findings of the review, with the regulatory body saying it was "concerned that the technology had been deployed in a manner that is likely to have infringed data protection law".

The letter to the council said: "New technologies such as FRT can offer benefits and efficiencies, but their use is not without risk from a data protection point of view.

"That risk is heightened where children’s data is being processed."

The ICO letter stated that the council sent out consent forms to parents of S1-S3 students, and to S4-S6 students themselves.

However, the content of those forms was criticised, with the ICO claiming it "appears unlikely that consent was freely given".

The letter added: "Our view is that NAC was unlikely to comply with the requirements of [data protection laws] as it did not ensure that the content of its privacy notice was provided to children in a concise, transparent, intelligible and easily accessible form, using clear and plain language.

"In particular, it did not attempt to explain to children, in child-friendly terms, the potential impact of the processing of biometric data.

"In addition, the communications from NAC underplayed the complexity of the technology and suggested that biometric processing is an historic and well-tested practice.

"This could be considered misleading to the data subjects as there was no attempt to explain the fact that this is a relatively new technology which would result in the processing of children’s unique biometrics, nor was there any attempt to outline the potential risks this could present."

The ICO noted that NAC has taken "proactive steps" to improve its data protection compliance, including through the development of a children’s-specific privacy policy.

A spokesperson for North Ayrshire Council said: “We welcome the clarity which has now been received from the Information Commissioner's Office.

"Following the initial interest of the commissioner’s office in October 2021, we immediately ceased use of the facial recognition system and thereafter deleted all biometric data.”