Aipedia: Schools, academies and governors

Facial recognition and biometrics in schools

Aipedia, by the Apex broking team · Last reviewed 2026-10-30

Schools must carry out a DPIA and obtain valid consent before using facial recognition or other biometrics, as the ICO's 2024 reprimand of Chelmer Valley High School showed. Getting it wrong brings regulatory action, complaints and costs that insurance only partly meets.

Part of: AI in schools, academies and governors

In short

Biometric systems for canteen payments, library loans and site access are common in schools. In July 2024 the ICO reprimanded Chelmer Valley High School in Chelmsford for introducing facial recognition for cashless canteen payments without a DPIA, without consulting its DPO, parents or pupils, and relying on an opt-out slip rather than opt-in consent. Most pupils were old enough to consent themselves. Governors approving such systems should see a DPIA first. Regulatory fines are excluded from RPA governors' liability, while response costs and civil claims may fall under cyber, PI or D&O.

Where schools use biometrics

Fingerprint and facial recognition systems are used to speed up canteen queues, manage cashless payments, issue library books, record attendance and control site access. Suppliers present them as convenient and secure. They are also biometric processing of children's data, which data protection law treats as particularly sensitive, and facial recognition in particular can involve AI-based matching that pupils and parents may not understand.

The Chelmer Valley reprimand

On 23 July 2024 the ICO reprimanded Chelmer Valley High School, a school of about 1,200 pupils aged 11 to 18. The ICO found that:

facial recognition technology was introduced in March 2023 for cashless canteen payments;
no DPIA was carried out before it was used;
the school used an opt-out slip instead of seeking opt-in consent, and relied on assumed consent until November 2023, although most pupils were old enough to consent for themselves;
the DPO was not consulted, and nor were parents and pupils.

The ICO said a DPIA "is required by law" and is "not a tick-box exercise". The lesson for boards is that a supplier's assurances do not replace the school's own assessment as controller.

The duties that apply

DPIA: required for high-risk processing such as biometrics, before the system goes live.
Consent: valid, opt-in consent is needed, and many secondary pupils can give it themselves.
DPO involvement: DfE's data protection in schools guidance expects the DPO or IT lead to confirm tools are safe and approved before personal data is used, and privacy notices must explain how AI tools collect, process and store data.
Automated decisions: where a system makes significant decisions without human involvement, such as refusing access, UK GDPR Articles 22A to 22D may apply.
Transparency: DfE's generative AI policy asks schools to be open about automated decision-making and profiling.

What can go wrong

Illustrative scenario: an academy trust rolls out facial recognition at site entrances across several schools after a supplier demonstration. The contract is signed centrally, no DPIA is completed, and parents are told by newsletter that they may opt out. A parent group complains to the ICO. The trust has to suspend the system, carry out a DPIA, seek fresh consent and answer complaints, while the supplier contract continues to run. Trustees are asked why the decision was approved without the DPO's advice.

How cyber, PI and governor cover respond

Regulatory action: an ICO reprimand carries no fine, but the cost of responding is real. Fines and penalties are excluded from RPA Section 5, and charity trustee insurance cannot cover regulatory penalties under Charities Act 2011 s.189. Some commercial policies cover investigation costs, subject to the wording; see GDPR fines versus civil claims.
Civil claims by parents or pupils may fall under cyber or PI, depending on definitions and data exclusions. See cyber cover for pupil data.
Claims against governors for approving the system may involve RPA Section 5 or D&O, subject to the exclusion for acts done in reckless disregard of duty.
Contract losses from suspending a system are usually the school's own cost.

Practical controls

Complete and sign off a DPIA, with DPO advice, before any biometric system is procured or switched on.
Use opt-in consent, offer a real alternative and respect pupils' own consent where they are old enough.
Consult parents and pupils, and update the privacy notice.
Build data and exit terms into the supplier contract.
Record the board's approval and the evidence it saw, under the AI policy.

How Apex helps

Apex arranges governors' D&O for independent schools and academy trusts. A broker can check how your cover treats a regulator investigation or data claim following a biometric roll-out.

Sources

Frequently asked

Do schools need consent for facial recognition?

Yes. The ICO reprimanded Chelmer Valley High School for relying on an opt-out slip and assumed consent. Valid opt-in consent is needed, and most secondary pupils are old enough to give it themselves.

Is a DPIA required before using biometrics?

Yes. The ICO said in the Chelmer Valley case that "A DPIA is required by law" and is not a tick-box exercise. It should be done before the system is used, with the DPO consulted.

Can governors approve a biometric system on the supplier's assurance?

They should not. The school is the controller and must carry out its own DPIA with DPO advice before the system is used. Governors should see the DPIA, the consent approach and the alternative offered before approving.

Did Chelmer Valley receive a fine?

No. The ICO issued a reprimand. Even so, a school in that position bears response costs, and any future fine would not be recoverable under RPA Section 5, which excludes regulatory penalties.

Check your PI covers how you use AI

Tell us about your firm and the work you do. A broker will review how your current PI treats AI-assisted work, or arrange new cover. No fee for a quote. Or call 0117 325 0027.

Start a PI quote Request a callback

Apex Insurance Brokers Limited is authorised and regulated by the Financial Conduct Authority. Registered in England and Wales, company number 07014570. This page is general information about how AI is used in the profession and how insurance may respond. It is not legal, regulatory or insurance advice on your circumstances, and it does not guarantee that cover will be available or on what terms.