Updated March 24, 2021 to reflect amendments made to the law.
Biometric technology, particularly facial recognition, has caught the attention of both public and private institutions in recent years, especially as Americans have become aware of its potential for inaccuracies and biases. Over the past year, facial recognition technology has sparked legislation banning its use in cities across the country until researchers better understand its short- and long-term consequences. In December, New York became the first state to enact a moratorium on biometric identifying technology in schools—prohibiting the purchase and use of such technology until at least July 2022. Although the law has received significant attention for its application to facial recognition technology for school security, it applies to all biometrics and bans technology schools rely on for facilitating certain special education services, school lunch payments, temperature checks, taking attendance, and logging in to school-issued devices. Noting the potential for some unintended consequences, in late January, the New York legislature amended a “technical error” in the moratorium, allowing a single exception for school districts to continue conducting fingerprinted background checks for prospective employees.
While several states, including Florida, Illinois, and North Carolina, have student privacy laws that prohibit or restrict biometric data collection, New York’s new law also requires the Director of the state’s Office for Information Technology Services to publish a report and recommendations about the technology’s appropriate use and necessary privacy safeguards before schools can move forward, if at all, with such technology. Specifically, the law directs the Director, in consultation with the state’s Education Commissioner to consult with stakeholders to study the privacy implications of collecting, storing, securing, retaining, sharing, and accessing biometric information in schools. It also directs the Director to consider the technology’s accuracy, whether it is appropriate for school settings, the potential for algorithmic bias, and whether and how students and school visitors should be notified of schools’ use of the technology.
Most news stories speculated that the law was a response to events in New York’s Lockport City School District, which, despite significant criticism, launched a $2.75 million district-wide facial recognition system in January 2020. A concerned parent called it a “wasteful and dangerous experiment,” citing fears of the chilling effects of such surveillance on students and staff. Civil society organizations have raised concerns about facial recognition technology in schools, citing its invasive nature and the potential for discrimination, as well as the unique sensitivity and vulnerability of the information collected. A coalition of more than 40 organizations released a letter in early 2020 calling for a ban on facial recognition on college campuses, and a study by the University of Michigan published in August 2020 recommended a ban on facial recognition in schools. FPF supports a targeted prohibition on the use of facial recognition for school security purposes, as these systems do not offer sufficient benefits that outweigh the risks of their use.
Based on the legislative justification, it appears policymakers were seeking to address concerns stemming from facial recognition software used for school security and school safety. Although the moratorium effectively stops such uses–for example, it does require schools like Lockport to stop use of its facial recognition security system–the enacted law goes well beyond that scope by prohibiting the purchase or use of all forms of biometric identifying technology “for any purpose.” In FPF’s 2019 letter to the legislature, we advised that any such moratorium should be “targeted” and “specifically focused on pausing the use of facial recognition systems for security purposes at public school facilities, rather than . . . all biometric technology.” In addition to facial recognition, biometric identifying technology also includes technology that recognizes fingerprints, handprints, retina and iris patterns, DNA sequence, voice, gait, and facial geometry, and we noted that prohibiting all biometric technology would “lead to unintended consequences.”
The law, fortunately, requires the Director of the Office for Information Technology Services to create a report on the risks and benefits of biometric technology in schools during the moratorium, which would allow for a measured future approach to biometrics in schools. However, the broad moratorium will not end until 2022 at the earliest. To comply with the law, school administrators need additional clarification regarding the scope of the law and its application, not only because of its broad prohibition of all “biometric identifying technology,” but also because it introduces a glaring ambiguity: it is unclear whether the law allows schools to disable biometric identification features in tools already in use—such as tablets where students can log-in with a fingerprint or face detection—or prohibits the use of those tools altogether, even if that functionality is turned off.
The law defines a “biometric identifying technology” as “any tool using an automated or semi-automated process that assists in verifying a person’s identity based on a person’s biometric information.” Because of this broad definition, the moratorium has the potential to significantly disrupt day-to-day school operations. For example, some special education programs rely on assistive technology that analyzes voice data or facial expression. Schools have also relied on fingerprint readers to improve efficiency and equity for processing school lunch payments for more than 20 years. Notably, although the moratorium initially conflicted with requirements that schools ensure prospective school employees undergo a criminal history check, which includes a fingerprinting component, the law was amended in January to allow this usage.
As it stands, the law also creates ambiguities for New York’s education stakeholders. Beyond the tools schools rely on for their biometric identifying technology, many products that schools routinely rely on, especially in the age of remote learning, incorporate biometric features—for example, the iOS, Windows, and Android operating systems all support facial recognition and fingerprint login. In addition to user authentication, tools used for instruction, after school programs, and administration may include facial recognition or other biometric identification capabilities. For example, some photo editing tools, including school yearbook applications, incorporate biometric “face tagging” features. It is unclear whether schools may permissibly use these tools during the moratorium so long as they disable the biometric identifying features, or if they must discontinue using the tools altogether.
To understand the impact of the moratorium on day-to-day school operations and identify points of inquiry and potential unintended consequences, schools in New York should consider the following steps:
- Reviewing or creating an inventory of deployed technologies (both administrative and instructional) and cataloging any systems or applications that collect data for biometric identification.
- Working with technology providers to understand what biometric data they collect and how they store, use, share, secure, retain, and destroy that data.
- Seeking clarification on whether it is permissible to purchase and use technology with biometric identification capability so long as the feature is disabled or prohibited by school policy.
- If permissible, establish technical or administrative controls and ensure policies are effectively updated and communicated to appropriate stakeholders. Ensure any new technology purchased or used during the moratorium undergoes the same process.
- If prohibited, assess each technology to determine the impact of the moratorium and discontinue incompatible technology. If discontinued, ensure sensitive data is securely deleted.
In addition, school data protection officers and key stakeholders in New York should work closely with technology providers to ensure that contracts clearly specify any collection or use of biometric data. Further, all parties should maintain awareness of any feature updates that collect biometric identifiers. Between now and July 2022, they should also closely monitor this issue and ensure their voices are included in the Director’s report.
Technology providers should keep in mind that this law will likely raise questions for schools in New York, and should:
- Be familiar with how the law defines “biometric identifying technology” and determine if this applies to their technologies or services.
- Review policies to ensure they clearly indicate how their products collect, use, store, share, retain, and destroy personally identifiable data, including biometric data.
- Consider whether the moratorium impacts new features or services that may incorporate biometric data.
- Monitor any clarifications provided by the New York State Education Department. If schools may use these technologies so long as biometric identification is disabled, provide this option as an administrator-level feature where applicable.
- Be aware and consider providing inputs for the questions and concerns that the Director’s report must address, in particular:
- The risk of an unauthorized breach of biometric information and appropriate consequences, including any state breach notification laws already in place;
- The responsibility for how notice of biometric collection is handled (will this either be the responsibility of the technology provider, the school, or a shared responsibility);
- The question of auditing of datasets and systems for algorithmic fairness, accuracy, and effectiveness
- Follow a privacy-by-design approach, and provide administrative policies, documentation, training, and technical controls to prohibit the collection of biometric data.
Although the law is specific to New York, education stakeholders nationwide should be aware that the issues raised by school use of facial recognition in Lockport highlight significant concerns about the efficacy, privacy, and equity limitations of biometric technology shared by schools across the country. Not only do these issues illustrate the need for legislative guardrails, but they also increase the imperative for public awareness and research, especially as schools and other essential institutions consider when and how to rely on technology to keep people safe and provide streamlined and cost-effective solutions. Education stakeholders including schools, technology vendors, and policymakers should continue to analyze the impact of facial recognition technology in schools, carefully consider the potential for unintended regulatory consequences, and work together to minimize any negative impacts on students and parents. New York policymakers have taken a significant step forward in the facial recognition debate, but the broad scope of the law’s biometric moratorium will likely have unintended consequences that raise significant interim challenges for schools. Those questions should be answered before charting any permanent path forward for biometrics in schools.
