Is it legal for school to take my child's fingerprints without my permission?

Posted by Little-Berry-539@reddit | AskUK | View on Reddit | 752 comments

Fingerprint set up for school dinners as they are cashless. In the sign up pack I specifically ticked 'no' for this, assuming he could give his name or pin etc instead. However, he has just told me that a dinner lady made him sign up with his fingerprints. Is this legal? And if it is, what is the point in sending out permission forms in the first place?

Reply to Post

Reply

752 Comments

[-]

MitchellsTruck@reddit

100% not legal. I work in IT at a school, running a cashless catering system, and we have a handful of kids whose parents don't understand the system, and have refused permission. The dinnerladies always want them to have a fingerprint as it's quicker, and can't be used by anyone else. When we only had codes, people used to use other people's codes, or just guess a random one, and get free food. So, the answer to your question is no, it is not legal, and you're well within your rights to request deletion of your child's biometric data. However, of the big three cashless catering systems I've worked with, all have encrypted databases for biometrics, so no-one can get the fingerprints "out" of the system, if that makes sense. What it actually stores is a number of data points from the fingerprint, and the distance they are apart. Even if someone managed to unencrypt the database, they couldn't recreate a fingerprint from that data. Have a word with the school's Business Manager on how they managed to ignore your request, and ask their IT how the fingerprint is stored - most likely it's fine for you to give permission.

Reply

[-]

space_absurdity@reddit

Hi mate, you seem to know what your talking about so i hope you can answer my question. Sorry if it's daft. In the old days. We used to have dinner tickets. Hand in your ticket and have dinner. Was pretty simple. Why is there a requirement for databases, fingerprint systems, encryption etc. What changed that having dinner now requires It support? Is it cheaper?

Reply

[-]

aljama1991@reddit

Removes the admin behind issuing tickets. Reduces the chance that the kids are going to nick each others tickets.

Reply

[-]

Jambronius@reddit

I wouldn't be surprised if It also allowed you to track what each child's buying.

Reply

[-]

AlgaeFew8512@reddit

It does. It's quite helpful when you want to make sure they are eating properly, or even just eating at all

Reply

[-]

MissionSorbet2768@reddit

It tells you what food they where given, not what they ate/if they ate it. My sister had a real issue with eating at school and in the end had to have a responsible adult with her over lunch as she would line up and get food with the other children, but wouldn't actually eat any of it. Other kids (Inc me) would get the "healthy" option so if my mum checked I wouldn't get in trouble, but that's not what if actually eat, I'd swap with other kids and wind up eating junk instead.

Reply

[-]

Sea-Television2470@reddit

This is actually a really good idea. I had an eating disorder as a teenager as well as a drinking problem and my mum would give me £3 a day for school lunches which I never bought, which meant £15 to spend on vodka. That went a lot further in 2007 of course.

Reply

[-]

ReadyInformation2649@reddit

I sold my dinner tickets for cigarette money

Reply

[-]

Sea-Television2470@reddit

Because I'm old, I got that 15 a week for lunches plus 10 for pocket money, and it would buy me 2x cheap bottles of vodka about £5 for 1l in aldi plus the mixer, a cheap pouch of baccy for about £2.30, and the remaining tenner used to get me a teenth of weed. Ah the good old days. Of course getting hold of it was easy too because I had a bunch of men in their 20s trying to get in my pants... :/ not so good old days. Damn my teenage years were bleak and I'm so glad my nieces are not having these experiences lmao.

Reply

[-]

RepresentativeNo3680@reddit

I'm 22 I had the exact same experience as you, just as a male with 40yo women trying it on in return for crack and smack lol My sisters 18 and she's having same experience just without the hard drugs. I hope...

Reply

[-]

ParsnipFlendercroft@reddit

If you were in school in 2007 you’re not even close to being old.

Reply

[-]

Beebeeseebee@reddit

I don't know about bleak. It sounds gritty, dangerous, traumatic perhaps. But bleak, to me, is trudging to school (no point trying to hunk off when your attendance is monitored by technology) and getting food using your fingerprint so everything you buy can be controlled and monitored by computers. It's hard to see how it could get more bleak, but we all know there are people outvthere watching Black Mirror who think it's an instruction manual.

Reply

[-]

ReadyInformation2649@reddit

HONESTLY 😭 I want to reach back in time and hug us, it was a hard time to grow up.

Reply

[-]

Pretty-Fee9620@reddit

I couldn't disagree more. I was in high school in the eighties with the freedoms that came pre mobile phone. It's today's kids that need a hug. Constant surveillance and social media have reallly mesed them up. Any Gen X or older complaining about "the youth of today" should bear this in mind before judging them

Reply

[-]

Jambronius@reddit

I think we all had a different experience and it was just as bad as each other. I keep seeing this rhetoric about how damaging mobile phones and social media are and I understand that they can be used for bad things, but there are also great things they provide that we didn't have. I once fell off my bike 4 miles from home, completely buckled my front wheel and broke my collar bone. I had to walk home pushing my bike while holding the front wheel off the ground, with a broken collar bone. If I had a mobile phone I could have called someone. For context, I am only in my 30s. We all had different experiences growing up we don't need to justify the things by one upping each other. Yes mobile phones can be bad, but life was also bad without it.

Reply

[-]

Sea-Television2470@reddit

It's actually scary how common it is for our age group, basically all of my friends my age had the same teenage experience :(

Reply

[-]

Fun-Breadfruit-9251@reddit

Fucking hell it's like you attended my first year at college for me. At secondary you'd get a ten deck for about 3 quid, sell some cigs for between 50p and a quid, and we had a mate with a beard who'd go down the offie on a lunchtime and come back with something horrendous. And yes, the men in their 20s. Am eternally surprised I'm a relatively well adjusted adult.

Reply

[-]

fugigidd@reddit

This sounds eerily familiar ...

Reply

[-]

TheDemonBunny@reddit

I sold cigarettes for dinner money 🤣

Reply

[-]

ReadyInformation2649@reddit

Prison rules at secondary school for sure 😂

Reply

[-]

Realistic-River-1941@reddit

Does that lead to issues with big boys who walk or cycle to school not eating like a small girl with an eating disorder who is driven everywhere?

Reply

[-]

ithika@reddit

Nonsense on stilts. I literally can't make my child eat while I'm sitting in front of her, I can't begin to imagine how you would believe a fingerprint database could do it.

Reply

[-]

RodneyRodnesson@reddit

It does although I suspect my schools caterer is gaming the system as a lot of the options my child has chosen which have meat have been entered on the system as vegetarian. I've a sneaky feeling when selling themselves to other schools they can say (with numbers to back it up) that they provide tons of veggies to the students, cos veggies "better" ofc. I'm probably being overly cynical but who knows.

Reply

[-]

trainpk85@reddit

Exactly. I can see that my child eats a bag of crisps and a cornflake cake and a bottle of water every day except a Tuesday when the year 9’s have PE so go to lunch later so she gets to the front quicker so that day she gets a chicken burger 😂😂

Reply

[-]

EdgeCityRed@reddit

Your child gets protein once a week at lunch???

Reply

[-]

trainpk85@reddit

Yeh it’s really bad. Thankfully she finishes at 2.30 every day and it’s next to a sainsburys so she gets a meal deal straight after school most days but the actual school is terrible for the kids getting time to actually get fed because of the queues.

Reply

[-]

EdgeCityRed@reddit

What a shame! I'm glad she gets the deal afterward, but that's just poor planning by the school.

Reply

[-]

PompeyLulu@reddit

It does. It came in handy with my nephew when he complained he hadn’t been given lunch as he didn’t have money on his account. It was his first day and nobody had explained to him that snack wasn’t free anymore, if there wasn’t the access online to that his Mum wouldn’t have known and been able to explain the issue to him. Now he knows and is doing loads better. Granted he is being a typical 11 year old and spending the majority on sweet treats but he is being responsible with his own budget now

Reply

[-]

BeagleMadness@reddit

It does. I remember a discussion with my eldest son about why was he only eating a piece of cake every day for lunch. The answer was that the cooked meals were extortionateky priced, so he and his mates would sneak off to a sandwich shop nearby instead, which wasn't technically allowed. The cake was bought at morning break from the school café.

Reply

[-]

LlamaDrama007@reddit

The meal offerings are poor and, as you say, expensive and they seem to get more and more time shaved off their lunch break each year to the point some days there is no food even left by the time they get out of lessons for lunch. I hope your child still sneaks off for a decent sandwich or that the fact the kids were doing so sparked a change?

Reply

[-]

miaow-fish@reddit

Exactly this. I could see what my son was eating and when.

Reply

[-]

BeagleMadness@reddit

At my school (terrible comp, early - mid 1990s) all the kids who got FSM were given a paper ticket to hand over each day. They had to spend all of morning break time (20 mins) queueing in the hallway to get that ticket each day. While all the other kids got to have a full break time or could stand there making jokes about the "council house kids" who got FSM. So I can see how anything that removes the need for that is a good thing? My own 12yo son gets FSM. It's registered on the school system, so he gets £3 per day towards lunch and just scans his fingerprint the same as the kids whose parents can put £££ in credit on the system. I pay the extra if it goes over £3 (often, a standard cooked meal and drink costs £5+). But he doesn't feel "different" to everyone else, which is a big thing for him as only 2% of his school get FSMs.

Reply

[-]

Morriganalba@reddit

My school changed to a plastic card with your name on it in 97 or 98, but you had to physically add money to your card (unless a FSM) via one of 4 machines in the canteens. It was an absolute pain, I remember standing all break with my friend on a Monday, so she could top it up for the week, and then she'd stand with me all break on a Friday so I could put my money for that day on. I started going down the street for food when I got older because it was easier. But if you lost your card, had to go to the office for a replacement and it was the same as losing money. You could give your card to someone and swap a FSM for money, it was a rubbish system.

Reply

[-]

BeagleMadness@reddit

They still have a machine you can use to top up your "finger" with cash at my son's school. But the main way to add funds is online via Wisepay (worst website ever, btw). I can also see on there what my son has bought, whether with his FSM money or the extra I stick on there now and then to cover extras. Which doesn't always work perfectly - it appeared as though my eldest son was only buying "cake" for lunch for ages. It turned out that one of the barcodes wouldn't scan on one of the Radnor Fizz drinks in the café. So the dinner lady would just stick it through as "cake" as she had memorised the code for that 😄

Reply

[-]

Morriganalba@reddit

We have ParentPay! Also a truly awful website. I don't know how my son's school works, he's only 9, in a base, and the staff deal with it all. He gets FSM and they have a 3 week cycle for the menu. There's only one thing he'll eat on it. I do worry that when he goes to high school I won't know what he's had for lunch so it's good if you can see that!

Reply

[-]

BeagleMadness@reddit

My sons' primary school used ParentPay and my daughter's primary school uses it. Also a terrible site! Yes, you can usually see what they've bought on Wisepay, when the site is working and if you can find the correct page (it is such a badly designed site! My 12yo has designed a better looking/working sites in computer science lessons). The page updates at about 4pm each day with that day's purchases.

Reply

[-]

PompeyLulu@reddit

This was still the set up for a while. I was on free school meals in 2006ish, I’d have to go up to the office every day at break and queue up to get the paper ticket. They were pink and she’d sign the back after she’d checked your name on her list. It was worth £1.45 which could either do you a sandwich and drink, maybe a piece of fruit. Or if you could top up they did those big pasta pots for £1.50. The current worth is about £2.50-£2.60 (though may be a tiny bit more in some areas), which for my nephew is a wrap and two hash browns. So his Mum gives him an extra £10 a week on it and he budgets that extra. He’s doing good so far and it’s teaching him responsibility, plus he gets to fit in with his mates which is nice.

Reply

[-]

BeagleMadness@reddit

Yes, that's pretty much what I do with my son. I stick a tenner on via Wisepay every couple of weeks (he takes a packed lunch some days, when he goes to Beekeeping club and Computing Club) and he can use it on extra food or getting a drink or a bun at breaktime when all his mates do. IIRC the FSM amount is set nationally at £2.60. So I've no idea who/which budget is covering the extra 40p my son is allocated? We're in Lancashire - maybe the council?

Reply

[-]

PompeyLulu@reddit

Yeah it was £2.53 as of August 2023 (I haven’t found an updated number for 2024). Some schools get additional funding based on having kids from forces or foster care attending, that to my knowledge isn’t specifically for the kid but is to assist the school so can be shared between kids. So there are definitely other funding pots available.

Reply

[-]

BeagleMadness@reddit

Ah, okay. It was £2 20 a couple of years ago, then went up to £2.60 and I hadn't checked since. What you said re: forces kids is interesting, as my son goes to a grammar school that is also a state boarding school. There's about 100 boarders out of 1250 students, many of whom are kids of forces parents. They pay for accommodation, meals etc, but not the education bit, so it is far, far cheaper than any private/public school. So perhaps they qualify for extra funding as a result.

Reply

[-]

thekittysays@reddit

This was me in the 90s. I thankfully didn't have to line up to get my ticket each day (one was issued at the start of the term) but everyone else paid with cash and I had a bright red laminated bit of paper I had to show to go through the till in the canteen. I got very adept at hiding it in my hand to make it look like I was handing over money.

Reply

[-]

BeagleMadness@reddit

Whereas my son didn't even realise he was getting the £3 a day FSM allowance for a few weeks at first. He's the sort of kid who would be far too mortified to hand over a ticket or laminated pass - he'd just go without eating instead. So, whilst I am not overly keen in theory on some random company keeping his fingerprint on file, it is so much better than it was in my day. We had about 40% of the school having to miss break time to queue for their tickets, kids selling tickets to others for cigarette money, kids robbing kids for their tickets, kids being picked on for getting free lunches, you name it.

Reply

[-]

GoldFreezer@reddit

And lots of families not signing up for the FSM because they're aware of the above and don't want their children to go through it, so either the children go hungry or the family struggles to pay for lunches. Uptake rose massively where I live when all the schools when cashless. It's in the school's interest to get all the kids who qualify for FSM signed up as well - they get a chunk of funding for each pupil on FSM.

Reply

[-]

BeagleMadness@reddit

They do - Pupil Premium. And for up to six years after the FSM eligibility ends, IIRC. So it is well worth encouraging anyone who is eligible, even if it's just temporarily for a few weeks between jobs, to sign up for FSM! It's worth it even if they still send their child in with a packed lunch instead, as I used to do in primary school with my son. The tiny slop meals provided there were appalling. I went without food myself to ensure my son got a decent, healthy lunch at times. But at least his school got the extra funding they were eligible for because I put the claim in.

Reply

[-]

GoldFreezer@reddit

It's absolutely vile that anyone is going without food so their kids can eat. I didn't know about the Pupil Premium continuing after the eligibility ends! I know how precious that money is though, I used to work in a special school where quite a few pupils were tube fed or on medically prescribed diets and I remember the Head writing to all the parents asking them to apply for FSM even if their child didn't eat so the school would get the funding.

Reply

[-]

frozensirop@reddit

I got this in college, £3 a day, 2x a week, and I didn't even know I was getting it for a year. I found out on the last week I had over £400 on my account so everyone got free food that day, and I am still using the stationery I bought with it from the college shop 6 years later lol.

Reply

[-]

BeagleMadness@reddit

Lol, not sure your college had their system set up correctly there! If my son doesn't use the daily £3, it doesn't get added onto his account at the end of the day. Some days he takes a packed lunch as he is going to a lunchtime club. If he buys something from the café during morning break, it will use some of the £3 allowance. If not, it just shows nothing for the day. Hell, I'd be sending him with a packed lunch every day and saving up for him if it worked the way it did at your college! 😉

Reply

[-]

thekittysays@reddit

Exactly. 1000% better system now.

Reply

[-]

One-Yellow-4106@reddit

wow it was the same in the United States when I was growing up! except we had to stand in line at the beginning of lunch and miss out on lunch time .

Reply

[-]

Fun-Breadfruit-9251@reddit

That sucks so badly. I was in school in the late 90s/early 00s and we didn't know who had FSM unless they told us. Think they were just all given a wee ticket or card at the start of the term to flash to the dinnerlady and that was that. Fortunately it was one of the few things kids wouldn't get bullied for.

Reply

[-]

dogdogj@reddit

Yep, I replied seperately about this but a fingerprint system instantly stopped this kind of thing at my school, everyone paid in the same way. Excellent use of the technology.

Reply

[-]

WaltzFirm6336@reddit

I went to a similar school at a similar time. We also had a school tuck shop with just sweets that worked on cash only. A lot to the FSM kids would ‘sell’ their token to none FSM kids at a discount. Thus the FSM kids had cash to spend entirely at the tuck shop. Then the none FSM kids had the difference between the value of the token and what they paid for it left in the cash their parents sent them to school with. Also spent at the school tuck shop.

Reply

[-]

KatelynRose1021@reddit

Yes I think this is important. I went to a grammar school in the mid 90s-2000 and I had free school meals. I was given 5 dinner tickets for the week every Monday morning, had to go up to the form teacher and collect them. The tickets were worth £1.25 each and I could just buy pizza and beans and a donut every day, there wasn’t enough money for more choices unless I paid extra in cash. I had to hand over the ticket to the dinner lady every lunchtime, it was really embarrassing and most people at my school were more well off than me so I really stood out and hated it. I think the current systems are surely a big improvement over that.

Reply

[-]

enchantedspring@reddit

(and 'hides' the fact some will be receiving free school meals to prevent bullying etc).

Reply

[-]

JameSdEke@reddit

Also reduces waste and cost of constantly printing tickets I’d imagine.

Reply

[-]

Ivashkin@reddit

You've replaced this with all the waste associated with manufacturing all the computer and communications equipment required to operate the service, plus the electricity needed to operate the system.

Reply

[-]

harris_kid@reddit

Convenience created by IT comes at an environmental cost, but there are far more wasteful things in IT you should be more worried about. The heat lamps in a dining hall waste more electricity a week then that system would use in a year I bet.

Reply

[-]

robbertzzz1@reddit

>The heat lamps in a dining hall waste more electricity a week then that system would use in a year I bet. That's... An argument against heat lamps, not an argument for fingerprint scanners.

Reply

[-]

harris_kid@reddit

Heat laps are a convenience not a necessity, like the fingerprint system.

Reply

[-]

robbertzzz1@reddit

Which, again, is an argument against heat lamps and not an argument for fingerprint systems. There are alternatives to such a system, that's what started this whole thread.

Reply

[-]

harris_kid@reddit

The argument for the fingerprint system is it's more convenient, the passes can't be stolen, auditable and less paper is used. There are tradeoffs, but it's not some environmental disaster the other commenter made it out to be.

Reply

[-]

Wolifr@reddit

You think these paper tickets are written out by hand? They'll be created on a computer and printed out by a printer according to information that's stored in a different computer...

Reply

[-]

Ivashkin@reddit

More of a general point that making a system digital doesn't automatically save resources because digital systems (especially cloud-based SaaS) use tremendous amounts of power and resources.

Reply

[-]

Wolifr@reddit

Cloud based SaaS uses significantly less than if everyone still ran their own data centres and servers.

Reply

[-]

LlamaDrama007@reddit

Im of an age where (secondary) school was cash only and the free school meals were a ticket. Admin aside, it completely highlighted who the 'poor kids' were. It was me. I was a poor kid. So I mean there may be other things that have you stand out as a free school meal kid but any system at lunch time that means you all look the same on the surface is a bonus to me. Not to mention the pupils dont miss valuable lunch time queuing up just to get the damn ticket.

Reply

[-]

zerotrace@reddit

Used to trade my ticket for a few ciggies and then sell them for more than the ticket was worth. Good times.

Reply

[-]

ApprehensiveElk80@reddit

Stops kids being beat up for their lunch money.

Reply

[-]

gigglesmcsdinosaur@reddit

Adds the admin of issuing fingers though, where are the schools sourcing them?

Reply

[-]

BobbieMcFee@reddit

While it's possible to steal a finger, it's not easy or unnoticed.

Reply

[-]

Spare-Reception-4738@reddit

Actually you don't need to steal the finger just the print....

Reply

[-]

BobbieMcFee@reddit

That still uses a knife, though maybe the victim will recover faster. "You wouldn't download a finger..."

Reply

[-]

Spare-Reception-4738@reddit

Actually no it does't https://uk.pcmag.com/security/137235/hacking-fingerprints-is-actually-pretty-easy-and-cheap

Reply

[-]

BobbieMcFee@reddit

That's copying, not stealing!

Reply

[-]

Spare-Reception-4738@reddit

1. You have to lift the print from person or item they touched so yes it's stealing. 2. Just proves it's possible

Reply

[-]

RepresentativeNo3680@reddit

/s

Reply

[-]

Leelze@reddit

I think they were just making a joke

Reply

[-]

Zavodskoy@reddit

If they're using a shitty scanner you could probably get away with an ink print of their finger

Reply

[-]

idwthis@reddit

Nicolas Cage stole Diane Kruger's fingerprint off a champagne glass when stealing the Declaration of Independence. No knife required.

Reply

[-]

MehImages@reddit

depending on the scanner they're actually easily replicated from a picture of it

Reply

[-]

NYX_T_RYX@reddit

Then whoever sourced the system needs a written warning, because that's obviously insecure, and schools don't have loads of money for ICO fines

Reply

[-]

MehImages@reddit

well sorry to tell you, but most things are insecure. someone with experience can probably pick your door lock in under 20s. as long as it's not widely abused, nobody cares

Reply

[-]

Divi_Filus_@reddit

You can't pick encryption, though.

Reply

[-]

TheProfessionalEjit@reddit

Bass kicks in *You wouldn't steal a finger.....*

Reply

[-]

Itchy_Harlot58008@reddit

And tends to create a wee bit of mess, something dinner ladies notoriously *hate*.

Reply

[-]

Seal-island-girl@reddit

Just put a wet paper towel on it?

Reply

[-]

Spicymargx@reddit

Get the blue roll out!

Reply

[-]

CarlMacko@reddit

This is sitting at 666 upvotes talking about stealing fingers. I cannot touch it.

Reply

[-]

BobbieMcFee@reddit

The moment has passed... Boo!

Reply

[-]

Curious_Ad3766@reddit

Also you don't really pass off the stolen finger as your own

Reply

[-]

BppnfvbanyOnxre@reddit

There was a case in Malaysia where a high end car was stolen by stealing the [finger](https://www.theregister.com/2005/04/04/fingerprint_merc_chop/). Admittedly this was 20 years ago more or less.

Reply

[-]

MikeIn248@reddit

That episode of Alias...

Reply

[-]

allthingskerri@reddit

Not a comment I expected but a comment I appreciate

Reply

[-]

GrandAsOwt@reddit

And apparently they don’t work for long. I did ask this of the people who supplied our library system, because I knew the kids would ask me.

Reply

[-]

Fit-Secret5724@reddit

This made me laugh too much

Reply

[-]

Deep-Procrastinor@reddit

I used to sell my tickets and go to the chippy instead.

Reply

[-]

Leeno234@reddit

Me and my best mate may have contributed for this downfall as we may have copied a ton and sold them at a profit till we were discovered and spent a term in isolation at the risk of isolation. Sorry guys

Reply

[-]

datageek9@reddit

We had those at our school, they came in a little pad in various denominations. Probably too easy to forge these days with some coloured paper and an inkjet printer. Also handling physical cash or cash equivalent is quite time consuming due to the need to reconcile takings each day and secure it against theft, same reason shops are moving to prefer card payments.

Reply

[-]

Four3nine6@reddit

I heard an increasing number if kids were already giving the lunch lady the finger anyway

Reply

[-]

Coyltonian@reddit

Back in my day the kids that got free dinner tickets would sell them for cash to buy fags. Also less stigma, was obvious who was on free meals. Now the account is topped up instead and everyone uses the same system.

Reply

[-]

enchantedspring@reddit

It's basically because of choice... meals in the past used to be one price = one ticket. Now there's all kinds of prices plus, some learners (apparently the word for pupils these days) receive free or discounted school meals - they can't be differentiated visibly to protect them from harassment. So the electronic systems cover the variable prices and 'credits' for free meals alongside a parent pay account parents can top up remotely.

Reply

[-]

HotSpacewasajerk@reddit

I used to just... take dinner money to school and learned to keep track of it....

Reply

[-]

caspararemi@reddit

At my secondary school in the mid 90s (in Scotland), they introduced contactless cards you could tap - like Oyster cards. Kids could top them up with cash, or I think parents could phone a number with their debit or credit card. It means kids with free meals just tapped to pay for them rather than the old system where they told the dinner lady who checked them against a list on a clipboard. I guess fingersprints are the evolution from there. I don't know how I'd feel if I had kids about them being used, but I'd probably accept it's a fast and secure way to verify their payments.

Reply

[-]

red_skye_at_night@reddit

It changes in the mid 90s?! My school still had cash and the clipboard in 2013

Reply

[-]

TheMrViper@reddit

Online platform for parents to load up accounts. Allows schools to be mostly cashless. It also means that children eligible for free school meals use the same system.

Reply

[-]

Big-Orchid-850@reddit

Works similar to a card. Parent loads money onto card/fingerprint(so people cant steal other kids money). Kid chooses what they want to eat (set up very similar to restaurant mass variety of drinks, cold food, snacks different options on hot food) then use fingerprint to pay with whats been preloaded by parent. Cash is too “much hassle” for most schools and when using standard ID Cards or Codes to load people tend to steal cards, loose them or make up and guess codes. Biometric data bypasses the risk of kids getting their lunch money stolen

Reply

[-]

No_Alps_1363@reddit

I imagine dinner tickets haven't been a thing in a looong time. I was in secondary school when fingerprints were brought in and before then it was cash. The reasons my school gave for fingerprints is : faster, can't get stolen, means children with free school meals aren't as obvious (could get bullied for being 'poor'), parents could make sure kids were spending the money on food (not crap after school).

Reply

[-]

Easy-Rider-9210@reddit

A company I worked at 18 years ago was pitching for a plastic card-based system to replace dinner tickets, so about that long. I remember the pitch because, excruciatingly, we'd prepared to pitch to the buyers and they instead made us pitch to the kids.

Reply

[-]

doughnutting@reddit

My school switched to fingerprints around 2013. I had a dinner ticket before that!

Reply

[-]

Farscape_rocked@reddit

Same. Late 90s switched from tickets to a barcode.

Reply

[-]

Eastern_Armadillo383@reddit

Cant get lost

Reply

[-]

rpycroft@reddit

It stops people knowing who’s on free school meals as it’s usually cashless as well (top up the money through a web site or whatever).

Reply

[-]

_MicroWave_@reddit

What's a dinner ticket? The kids are paying for their lunches from accounts topped up by their parents. To access this account they use a finger print. Everyone doesn't buy the same thing. One might buy a ho lunch another just a cake or sandwich.

Reply

[-]

thecrius@reddit

It's incredible to me that this question even need to be done and 300+ people wanted an answer for it as well.

Reply

[-]

space_absurdity@reddit

Sorry for that. I'm not a parent, don't have any interaction with schooling systems and I'm probably getting on a bit so my experience is very outdated. I think asking questions, politely, is really good and I've had some fantastic and truly informative responses. I am much more informed now than I was earlier today. I learnt, from many people that responded, that theft and being bullied for having free school meals was a common issue. I'm sorry for that and I can see a lot of support for this system from the people that answered.

Reply

[-]

nikhkin@reddit

Parents can top up a child's account online and the whole system is automated. Handing out tickets is an admin-heavy system.

Reply

[-]

crucible@reddit

Schools IT bid here: * Anonymises the kids on Free School Meals. Only Finance and the dinner ladies can see that info now. * No cash - avoids having to store it locally and bank it daily (a big risk given large secondaries can have over 1000 pupils on roll now) * Fingerprint is the least ‘worst’ option vs an RFID token or card that can be lost, damaged, stolen etc

Reply

[-]

MitchellsTruck@reddit

> The catering system can be set to flag children with allergies so a big red warning that Billy is allergic to garlic / Sarah is gluten free comes up on their page when they scan their finger. Oh yeah, that's another one I forgot. We have a lot of Muslim kids, and they're often shocked to discover the sausage roll, roast pork or ham sandwich isn't Halal.

Reply

[-]

crucible@reddit

Halal pork kinda seems like an oxymoron to me - though I remember a friend saying he’d been to a supermarket cafe offering vegetarian bacon once :P

Reply

[-]

space_absurdity@reddit

Good answer, thanks 👍

Reply

[-]

crucible@reddit

You’re welcome

Reply

[-]

Mandala1069@reddit

It prevents anyone knowing which are the kids on free school meals and which are not. As a kid who queued up for a free meal ticket while kids who paid went in a different queue, it makes sense (1980s)

Reply

[-]

The_Blip@reddit

I feel like I'm from another universe or something. My primary school just had us pick up our lunches, no system required. Secondary school we just used cash.

Reply

[-]

Wise-Application-144@reddit

Yeah I mean other posters have pointed out all the variables you need to account for (theft, kids spending all their money at once, free school meals). But I just can't understand how a whole fingerprinting system (plus all the inevitable admin, maintenance, cyber security, setting up ethernet and servers and dealing with the parents who don't wanna use it) is less effort than a bloody cash till with a card reader. My work canteen has worked its way through a few systems like this and the staff spend half their time faffing with it. And there's the inevitable bureaucracy when they need to "retender" the contract or the system goes obsolete.

Reply

[-]

crucible@reddit

Server, tills, fingerprint & RFID readers are generally sold as a bundle. So you replace it all every few years as the tills become outdated (yes they’re basically Windows PCs with a touchscreen etc). Once your school buys into it the management generally knows is is an ongoing cost eg annual subscription, replacing the kit eventually). IT side might be a few frantic reboots when the server occasionally fucks up right before lunch, lol. Otherwise it plugs into your existing school network and anyone competent will segment it on its own VLAN anyway. Am in a school in its 3rd such system in ~15 years and generally it works 99.9% of the time, we’re not talking crap like Fujitsu Horizon here even if the software is sometimes older-looking in places.

Reply

[-]

Wise-Application-144@reddit

Dunno who downvoted you. Cheers for the response. I kinda see it the same way as you, but I see a lot of hidden costs in there. You have the annual subscription, yes. But if you replace it every few years, that's generally a formal tendering process involving multiple people to set up, review, audit, do the compliance etc. Same for the VLAN and network stuff. And administering all the letters and permissions to use fingerprints, plus the GDPR compliance to back it up. I only point it out because I work in engineering management, and the administration of an IT system can easily cost many multiples of the actual IT system. My suspicion is that there will be a back office full of expensive admin staff who periodically have to get involved in all this stuff.

Reply

[-]

crucible@reddit

They’re ongoing things in some ways - we switched payment provider and till vendor at the first renewal and stayed with them the last time round. That said the education tech sector does consolidate and people get bought out, merge fairly frequently too. Building was fully networked when we moved in (we got a new site with Academisation), the boss set VLANs up from day one. Form letters are Admin team but they will be saved for reuse annually. Minor updates to the letterhead if we get a new Deputy Head or whatever. I see where you’re coming from but I’m removed from all the purchasing and tendering side of it all. Admin staff will do a mix of stuff anyway.

Reply

[-]

Iforgetinformation@reddit

Modernisation may come with additional costs, doesn’t mean it’s not worth it. We had books and whiteboards now we have tablets and huge touchscreens. Much more expensive and complex than paper yet we’ve gone ahead with it in almost every industry because the set up cost is worth it. There are also the costs of storing and moving physical cash. Take that away and now the school has no need to manage physical money

Reply

[-]

jackal3004@reddit

Dinner tickets were generally issued to people who qualified for free school meals (ie. poor people). If you never noticed anyone using a dinner ticket or similar you obviously went to a school in a reasonably wealthy area (or you didn't socialise with those people).

Reply

[-]

space_absurdity@reddit

Yeah, me too. That's why I had to ask. 😔 We had a bit of 'selling your lunch tickets to buy fags' but nothing worse than that. Halcyon days?

Reply

[-]

EmmaInFrance@reddit

Back in the 80s, I used to buy dinner tickets worth 65p for 55p, for years, so much so that when I lost one, the dinner ladies thought that I was entitled to free school meals because they were so used to me using them. The kids that I bought them from every week used to go out and buy chips for lunch from the local chippie instead. I bought them because my mum didn't understand that the price of school meals had increased since since I was 11 and it meant that I got dessert as well as mains. Yes, I was given the same dinner money every week from 11 in Form 1, right through to 19 in 6th Form - I repeated my first year of 6th Form, so that's 8 years, all told, with no accounting for inflation, and no, money was not **that** tight.

Reply

[-]

The_Blip@reddit

We'd all just go to the corner stop and buy sweets. Which is probably what this system was invented to stop, to be fair. Just seems like a really convoluted way to get a lunch.

Reply

[-]

space_absurdity@reddit

3 Bitcoin for a KitKat?! 🤣

Reply

[-]

MitchellsTruck@reddit

> Secondary school we just used cash. Me too, in the couple of years I wasn't a boarder. I was given £2 a day, which meant my Mum had to do to the bank all the time to get coins. I still used to stop in at the newsagents on the way, buy a single B&H for 20p, a samosa for 50p if I hadn't had breakfast, and leave myself only just enough to get a sandwich for lunch from the canteen.

Reply

[-]

cougieuk@reddit

Cash ? I've not been to a cash point since 2020!

Reply

[-]

Snazzles@reddit

The fingerprint system means that things like those pupils who get Free school meals are not known to their peers. I know at my school the dinner ticket system was colour coded and those who got free school meals all had yellow tickets. Everyone knew who go the free school meals and people were bullied for it. Similarly, in some schools the amount of stealing of passes and misusing of codes means fingerprints are easier.

Reply

[-]

MitchellsTruck@reddit

We do dinner tickets for Year 7s at the beginning of term, before we've had a chance to capture their biometrics. They don't work for the rest of the time due to various factors: Printing and issuing 850 tickets every day is time consuming, and a huge waste of paper. You could probably re-use *some* of them, but the vast majority will be beyond re-use by lunchtime. Plus kids are resourceful these days. We issue little tickets as rewards to jump to the front of the queue sometimes, last year some kid took one, scanned it, and started selling counterfeit ones. With something actually worth money, that would be rife. How would you pay for these tickets? Someone taking cash? Again, massively time-consuming. And it requires parents to remember to send cash in with their kid every day. And what if the kid decides to spend that money on sweets in the corner shop on the way in, instead? Hungry child by lunchtime. A ticket can only be valid for one amount of money. A lunchtime meal is usually one price, true, but the catering company offer many other things - do they want to add a bowl of salad, some biscuits, a pricier drink? Maybe they don't want a whole meal, just a sandwich? Also, the canteen is open at break as well as lunchtime. Bacon rolls, sausage rolls, sandwiches, pastries, toast etc. How would you issue a ticket for that? Staff have to pay VAT on their hot meals. How would you vary that pricing with a ticket? Parents can track what food their child is choosing every day with the cashless system. To do that with a ticket, the canteen staff would have to note down what every child had that day, then email 850 parents individually. That's all the reasons I can think of for now. Occasionally the system does go down - it's all run on their hardware, so not as reliable as the kit I'm in charge of - and we have to issue tickets and keep track of spend per child manually, and it's a nightmare.

Reply

[-]

Interest-Desk@reddit

On the logistics of printing and managing tickets: my old school had to start printing late/absence passes on coloured paper and changing the colours randomly because someone started stealing them from the office.

Reply

[-]

crucible@reddit

The school I work at has to do that with the 5 minute / lunch passes every half term

Reply

[-]

space_absurdity@reddit

Thanks for the detailed answer. Certainly a lot more to it than I thought. And a final question, if I may. I'm sure the data collected (such as types and qtys of meals served) is used by the catering company for stock and reordering etc, which is understandable, but does that data also get sold or passed to suppliers, eg Dear Pepsi, your product sold less this month but coca cola sales were up? Just wondering if there is value in the data collected?

Reply

[-]

Jamericho@reddit

Isn’t that data what a stock take is for? They’d surely know what was sold by looking at what was ordered and what was left?

Reply

[-]

Orange-Murderer@reddit

I may be wrong, but at a guess, it's likely that personal data wouldn't/couldn't be sold due to gdpr but data collected from sales such as trends with different demographics during different times of years, any correlations, and any other data point about how the kids are spending and what not. Could be collated to infer higher prices from suppliers and shit.

Reply

[-]

space_absurdity@reddit

Yeah, that's what I was thinking. Call me cynical but I'm repeatedly told that information is where the money's at so I'm sure the data available would not be wasted.

Reply

[-]

teut509@reddit

They've got that information anyway - they know how many cans of pepsi they sell vs how many of coke just from their stock levels. They don't need to track individual purchases for that. Supermarkets like to track individual purchases through loyalty cards so that they can build pictures of 'shopper types' they can target, but that's only cost effective at that huge scales they are running at, not for school meals.

Reply

[-]

MitchellsTruck@reddit

The cashless catering system and the catering company are two different entities. The catering company use the tills provided, but otherwise do not interact with the system. We rejected a system that the catering company recommended as they would have too much control over it. So they have to do all their own stock taking and ordering. I'm sure at some level the manufacturers will be keeping an eye on what the catering company orders, but it all comes in one big van a couple of times a week from their own warehouse, not from individual suppliers. As a school, we use the data to see how popular school meals are - if there's a massive upsurge or downturn overall or on one particular meal etc. we will report that back to the catering company so they can adjust their menus - but they'll usually work it out by how much food is left at the end of lunchtime.

Reply

[-]

space_absurdity@reddit

Again, thanks for really clear and comprehensive answers 👍

Reply

[-]

tcpukl@reddit

Bullies used to steal those tickets as well. Same as dinner money.

Reply

[-]

Logbotherer99@reddit

Because most kids are paying for their food and drink now. The fingerprint means the kids don't need to bring cash and the school don't need to deal with the cash. Also can't be lost or stolen unlike other systems.

Reply

[-]

Fit_Implement3069@reddit

It can be stolen, plenty of tutorials online... I know 30 years ago at school kids I knew would have done it...

Reply

[-]

Fit_Implement3069@reddit

They would do it for the sake of it

Reply

[-]

Logbotherer99@reddit

Probably a lot of effort for a 2.50 lunch though

Reply

[-]

secretsnow00@reddit

This is a really good question I also want to know the answer to. When I was a kid we had lunch cards, there were little machines around the school, insert your card pop a couple pound coins in, that 2 pound is on your card to spend. I hated school dinners back then so rarely used mine but I saw friends get theirs broken or stolen or give away their money to bullies or for cigarettes or something. So if I was to hazard a guess to your question and assume that when you were at school those tickets were stolen or traded as well Then, to minimise delinquency, theft, blackmail and trading? God, makes it sound like prison.

Reply

[-]

batteryforlife@reddit

Seems like a card that you can load money on to (or free school meals) would be the best option? Especially if parents could top it up online, and track the spending. Why does it have to be a fingerprint??

Reply

[-]

idwthis@reddit

Not that I support the usage of fingerprints, but cards can be lost or stolen, and broken, too.

Reply

[-]

elementarydrw@reddit

Also - as a parent I would be happier knowing that the money I am loading my child with can only be spent on what it is meant to be spent on, and by the person who is meant to be spending it.

Reply

[-]

SpaceMonkeyOnABike@reddit

So a black market for dinner tickets is created....

Reply

[-]

Highway-Organic@reddit

When they introduce a ticket system in my school some of the kids bought rolls of tickets from local stationary shops and used them or sold them to their mates at a big discount.

Reply

[-]

Yeorge@reddit

it's massivley overengineered for it's purpose. But my guess is someone or some company made bank off government(/local) to install a biometric system(s) for school dinners.

Reply

[-]

AndyCalling@reddit

In the old days, we used to hand over this stuff called money in return for food. It worked pretty well. Very simple. Sounds like they are over complicating things at that school. Wouldn't it be more educationally sound to have kids use money they can count and see they are spending, rather than getting them into the idea they just swipe and take what they please? You'd think so.

Reply

[-]

The_Mad_Mellon@reddit

We just had a lunch card with your name on it that brought up your picture at the till. No biometrics, no way to use someone else's and no touching the same greasy surface as the last 400 odd kids right before eating. If you lost it you could just give your name and they could search manually. This fingerprint stuff seems excessive, even if it is technically secure.

Reply

[-]

mikiex@reddit

Same reason I don't unlock my phone with a ticket:)

Reply

[-]

Rookie_42@reddit

I think it’s because it’s not a fixed price deal. The children can select various individual items, each with their own price like you might find in a normal high street cafe, for example. And you ‘pay’ at the till at the end. So… you need an account with money in it to get lunch, the parent tops up this account, and the child pays using their fingerprint so that no other child can steal their funds in the playground.

Reply

[-]

Actual-Butterfly2350@reddit

I'm not an expert, but a parent. The positives of using a card or biometrics system mean that the parents can top up the account weekly, monthly, or even termly. It is easier for the school to not have to handle cash, and it also solves the problem of 'lost' dinner money, whether it is genuinely lost or the kids have wasted cash on shite in the corner shop instead of buying dinner. Lastly, it saves the kids on free school meals being embarrassed or singled out as the daily allowance is added to their account automatically, and they pay like everyone else.

Reply

[-]

space_absurdity@reddit

Great answer, thanks

Reply

[-]

w3woody@reddit

Often what makes a system cheaper is its cost to administrate. Handing out dinner tickets may be cheaper from a ‘cost of equipment’ perspective, but it may not be cheaper from a ‘cost to hire an employee to hand out tickets’ perspective or from a ‘prevent loss due to theft’ perspective, or a ‘cost to sort out if someone has their tickets stolen’ perspective.

Reply

[-]

ACuriousBagel@reddit

No idea what the costs of running the fingerprint system are, but after 15 years of cuts, my primary school can no longer afford to print in colour, so it wouldn't surprise me if it's a cost saving measure

Reply

[-]

runrunrudolf@reddit

When I went to school in the 00s we just have our name to a person in front of the cafeteria and they would mark us off on the list and let us go in. Why were you all getting tickets?

Reply

[-]

Icy_Priority8075@reddit

Because it's hard enough trying to serve 1000+ kids lunch in a cafeteria that was built to seat 150 max in 30 minutes, without having to stop and check them on a list.

Reply

[-]

Objective-Cellist409@reddit

I’m not from the UK but a Nordic country where lunch is free, we’d just go in and get food 🥲 different systems!! This thread is really enlightening to me tbh.

Reply

[-]

dogdogj@reddit

They brought in a fingerprint system at my secondary school whilst I was there, so I experienced both systems. It stopped the "gimme your lunch money" type bullying that was pretty rife at the time, overnight (well over the school holidays actually but yea). It was very rudimentary, there were two boxes around the school like vending machines, scan your finger and add money to your account, or parents could do it via cheque, the scanners were a bit crap but as long as you had credit you couldn't lose, or have taken, your lunch money. Further to that, the kids that got free lunches simply got X amount added to their account every week, which stopped the "your mums too poor to feed you" bullying that also happened, because nobody the tokens ah...school.

Reply

[-]

shadowhunter742@reddit

Alot of schools now run their canteens like a shop. Everything is a different price and you have to preload an account. Means that parents can see how their kids are spending money as opposed to taking cash/card

Reply

[-]

kh250b1@reddit

You cant get beat up by bullies for your fingerprint money

Reply

[-]

Terrible-Group-9602@reddit

It's far quicker and easier to use fingerprints

Reply

[-]

uchman365@reddit

>Why is there now a requirement for databases, fingerprint systems, encryption etc. What changed that having dinner now requires It support? Same reason we're now using contactless and going cashless

Reply

[-]

HST_enjoyer@reddit

kids also got bullied into giving up their tickets

Reply

[-]

Educational-Month182@reddit

Some issues with old style cards schools have had: Kids losing/forgetting them Bullies taking them from other kids Dinner ladies at secondary are unlikely to spot a stolen card being used because of the sheer number of pupils but they would spot someone using someone else's finger,!

Reply

[-]

Muttywango@reddit

I used to buy dinner tokens at half price, the seller got money to buy ciggies. That's one good reason.

Reply

[-]

MOGZLAD@reddit

Well easy to fake, especially these days

Reply

[-]

PurpleRainOnTPlain@reddit

My school used to issue dinner tickets for people on free school meals (a category that I fell into), everyone else paid cash. It meant that at the start of every lunchtime I would have to stand in a big long queue to collect my ticket while my only group of friends, none of whom were on free school meals, went straight to the canteen. I then had to queue at the canteen before finally getting my lunch (normally about 30 minutes into the lunch break) which I would wolf down and then have barely any time to play with my friends. Absolutely fucking miserable thing to go through, I used to dread going into school because of it. Any system that cuts out this kind of administrative red tape is a good idea in my mind.

Reply

[-]

martinbean@reddit

I don’t know what your frame of reference is for “the old days”, but when I were a lad we used something called money. We put something on a plate, went to the till at the end, paid, then sat down and ate. This was the 1990s/2000s.

Reply

[-]

Hungry-Falcon3005@reddit

At my school, kids used to sell their dinner tickets

Reply

[-]

Vorsa@reddit

Another reason is safeguarding. It's important that we know what a student is eating if they are under our care. I've had a lot of parents check in on what their kid is eating through the day, sometimes for medical reasons, sometimes because they're just eating cookies all week!

Reply

[-]

Objective-Resident-7@reddit

There is a stigma to dinner tickets. If they all have electronic payment, whether that is met by benefits or the parents, the kids can't tell who is getting benefits. When I was at school, the POOR KIDS, yeah YOU! POOR!, had to get up to collect their dinner tickets in front of the rest of the class. I'm in Scotland, which means that all kids in primary school get fed by the state regardless of financial state. At high school, you pay if you can but all the kids still use cards (not fingerprints) to get their lunch in school. My eldest now goes for lunch with his friends on Fridays. It's his money. He can do that if he wants! I really can't complain. He's taller and thinner than me.

Reply

[-]

LupercalLupercal@reddit

Harder to bully kids for their dinner money maybe?

Reply

[-]

Home_Assistantt@reddit

Probably so kids can’t steal others tickets or money etc. this means only the specific child can access the funds and only them regardless.

Reply

[-]

rootex@reddit

do you not think pieces of paper are more vulnerab

Reply

[-]

callisstaa@reddit

When I went to school they were just introducing those swipe cards that you top up on a machine in school. Me and my brother got free school meals so our cards automatically had a few quid on for the day so we could get lunch and dinner. When my brother left school the year before me, I got his card and continued to use it as well as my own to get extra dinner every day

Reply

[-]

HarryPopperSC@reddit

If all comes down to preventing bullying.

Reply

[-]

dj_mcguigan@reddit

Absolutely correct, especially about the security. The only wrinkle is the age of the child matters - this is considered digital data and so, once the child is old enough to understand, their consent can override parents. It's the same vein that a parent cannot put in a Subject Access Request about a child that's old enough, it has to be the child. Most schools will accept a parental request though, but then the compiled data definitely should not be handed to the parent, it should go to the child as it's their sara. There is no strict age for this "old enough to understand", but typically people go with the medical "Gillick competence", which is around 13, but it definitely isn't nailed down. Ultimately that would beg the question of why they asked for consent if they were going to ignore it after.

Reply

[-]

Tomato1237@reddit

>When we only had codes, people used to use other people's codes You just reminded me of the time we found a bunch of codes for the teachers and dinnerladies. Fun times, especially since they had no way of tracking who was using the codes. There was a fingerprint system introduced not long after all that happened. (Fyi, I didn't use them personally. Just know quite a few people did before they caught on to it.)

Reply

[-]

GreyMandem@reddit

Per GDPR and various legal Opinions (capital O), even if it’s derived data, even if it’s encrypted and you cannot access the encryption key, it’s still classed as personally identifying. The embeddings still have to be decrypted to be compared which means in absolute terms you’re still dealing with the data in the plain, potentially every time someone authenticates. If you consent to enrol in such a system you’re also consenting that it may be possible to falsely identify you by highly technical means - which in all fairness is less likely than someone stealing a PIN or smartcard - but harder to disprove. So although the risk is lower overall, when mistaken identity happens in biometric systems it’s much harder to get justice. Source: I work in biometrics.

Reply

[-]

whooptheretis@reddit

> and we have a handful of kids whose parents don't understand the system, and have refused permission That's a bit patronising. One can fully understand the system and still object to it.

Reply

[-]

WatermelonCandy5@reddit

Yep. My work tried to do this an I refused out of principle.

Reply

[-]

plantmic@reddit

What was the principle?

Reply

[-]

LiteratureLoud3993@reddit

I was a hairs breadth from quitting my job because of a new policy which would mean I'd have to give fingerprints and a whole shit load of personal data over to the US Govt, despite working for a UK company in the UK Told them to get all the way fucked, and they came back and said they had made a mistake and it shouldn't have applied to me. I'm still angry that it's even a thing for a subset of people that aren't even material risk takers in the US market or interacting US clients

Reply

[-]

MitchellsTruck@reddit

> One can fully understand the system and still object to it. Only if you've subscribed to *Tin Foil Hat Wearers Monthly*. The data stored is absolutely indistinguishable from an encrypted password, typed on a keyboard.

Reply

[-]

whooptheretis@reddit

Then why not use a password which can be changed? > The data stored is absolutely indistinguishable from an encrypted password So it can be broken?

Reply

[-]

MitchellsTruck@reddit

> So it can be broken? Tell me, as you seem to know everything about this system, how you're getting access to this encrypted database?

Reply

[-]

whatagloriousview@reddit

Your name, a chair, a rope and a wrench. Same as it ever was.

Reply

[-]

Pedantichrist@reddit

This is why you work in IT in a school.

Reply

[-]

whooptheretis@reddit

Even if you don't know how to pick a lock, you can still be aware that locks can be picked. Don't be so naive to think that any system is secure.

Reply

[-]

kyridwen@reddit

A password might be "password" and then encrypted and stored as "aLT76Phw". Every time anyone gives the password it can be encrypted to get get the same encrypted string and you check the new one matches the saved one, and that's your check done. The data in a fingerprint could be encrypted the same way, so the scanner could read that there are certain marks and spacing and encrypt that into "aLT76Phw". Encryption means it's hard to get the plaintext password / fingerprint info back out, but easy to do the encryption each time to check. The password "password" is easy to share, a finger print isn't. That's why they don't want to use passwords. You're right that the encryption can be broken, but it would take a lot of processing power to do, and it's a judgement call for parents to make on how likely they think it is that a bad actor would go to the effort of getting access to a school's fingerprint database and decrypting all the kids' fingerprints. I can't imagine why anyone would want to spend that time and effort - what would they gain by it?

Reply

[-]

thegroucho@reddit

Someone working with 3rd party product doesn't grant them knowledge of the inner working of the said product. Reading the marketing blurb doesn't imply knowing the vendor didn't cut corners. Password breaking - depends on how it has been implemented, and one time too many even reputable companies have been found to not do it properly, sometimes outright not even encrypting the said passwords, let alone best practices. You can change password, you can't change biometric data. It's implied not enough data is stored, but we don't know that for real do we? "The Vendor said so" isn't good enough.

Reply

[-]

asdf0897awyeo89fq23f@reddit

There’s nothing to worry about so long as you assume software engineers didn't make make mistakes, corporate didn’t lie about what PII they store and that there’s no inherent value in the information used to identify a fingerprint so long as you can’t recreate it. Silly parents.

Reply

[-]

essjay2009@reddit

And it’s biometric data. I’d argue that teaching kids the importance of protecting their biometric data is incredibly important. It is, by definition, something that’s with you for life and cannot be changed. That genie cannot be put back in the bottle and to let it out when you’re a child for trivial benefit (not even for yourself) seems absolutely mad to me. You’re asking people to trust the current system, administrators, owners, plus everyone in the chain, plus potential future owners ABs operators, and hoping that technology doesn’t advance to the point where the current protections, such as they are, are rendered useless.

Reply

[-]

damnationpt@reddit

New vulnerabilities are uncovered every single day, regardless if software engineers make mistakes or not. To not want to store your childs biometric data on software for school lunches does not make you silly, your assumption of these parents does make you silly.

Reply

[-]

asdf0897awyeo89fq23f@reddit

Being on this sub without grasping sarcasm makes you silly.

Reply

[-]

DenormalHuman@reddit

> so long as you assume software engineers didn't make make mistakes This is an incredibly common occurrence. Am software developer of 30+ years, you would (not) be surprised at the number of silly / stupid / naive / malicious decisions, mistakes etc.. are made . This becomes all the more important when it comes to encryption and anonymisation of data.

Reply

[-]

LucyFerAdvocate@reddit

Almost certain the person you responded to was being sarcastic

Reply

[-]

DenormalHuman@reddit

Now you say it, I agree! :)

Reply

[-]

BlueTrin2020@reddit

You both agree then :)

Reply

[-]

TehPorkPie@reddit

Or, even quite simply, one can be fully on board with the system but wants to teach their children monetary value, and having a tactile currency in hand aids with that.

Reply

[-]

Stevenc15211@reddit

The amount of people that think these databases are secure is a joke. The amount of companies which don’t know how to store data is insane.

Reply

[-]

MountainMuffin1980@reddit

I'm maybe naïve but I also just don't get why people are worried about having fingerprints in a database. I guess for if you commit crimes in the future?

Reply

[-]

Significant-Desk777@reddit

If you use a password for a website, and that website gets compromised by some nefarious hackers, then the information often ends up in various kinds of password lists. Criminals sometimes try to hack into people's accounts by "guessing" the password - if you have a list of a few tens of million passwords that were used on one website, it's often a good bet that some of them will be associated with accounts on other websites too. Lots of people re-use passwords across multiple sites. This is all the more dangerous if those passwords have other account information associated with them, e.g. email addresses. Thankfully, it's relatively easy to change a password once it gets compromised. For example, when you have in the past logged into an account from a new device, you might have received an email or something checking that it was really you trying to log in, and prompting you to change your password if it wasn't. If on the other hand you use biometric information like a fingerprint to get into an account, and that biometric information gets compromised, it's rather more difficult to get yourself issued with a new set of fingers. That information will *always* be associated with you, and it will *always* be out there on various criminal biometric information lists, so it will *always* be insecure.

Reply

[-]

whooptheretis@reddit

The fingerprints themselves are not stored. But that's not the point. We should all be conscious of how much information is stored about us, where, and by whom.

Reply

[-]

MountainMuffin1980@reddit

I understand what you are saying, but my point is still: why? Maybe it's just a bit of defeatism on my part as I had to. Give biometrics when I last updated my passport, and without that I couldn't travel. So at this point it makes no difference who has my fingerprints.

Reply

[-]

whooptheretis@reddit

The more information that's stored about you, the more you can be exploited. You might not care about Google being able to create a whole virtual profile on you, but who has access to that data? Who has access to it in the event of a data breach? What happens if a political party is elected who decide that you fall into an "undesirable" category. Germans were very efficient at collecting data on the population before WW2. It was all fine and no ill intentions. Then when the Nazis had control of this data, they had a nice convenient database of Jews right to hand.

Reply

[-]

Pitiful_Section_6094@reddit

We don't even have to go anywhere near fascism territory, even just plain innocent capitalism can exploit people more and more depending on how detailed a profile is. Targeted advertising taking advantage of involuntary impulses and mental health conditions, insurance companies buying driving data and hiking rates etc...

Reply

[-]

whooptheretis@reddit

Searching for cancer symptoms...? Your health insurance just went up...

Reply

[-]

SpinningJen@reddit

Electronically stored data says this kid ate pizza and chips every day for 6 years. Health insurance unattainable

Reply

[-]

anotherMrLizard@reddit

Handing over your biometric data to HM Passport Office in order to be able to have a passport is one thing. Handing over your biometric data to whatever random, lowest-bidder IT company your local education department has contracted to take biometrics for school lunches is quite another. Given the uses which criminals can put your stolen biometric data to, the fewer organisations which possess that data, the better.

Reply

[-]

MountainMuffin1980@reddit

What uses?

Reply

[-]

anotherMrLizard@reddit

Fraud, identity theft.

Reply

[-]

MountainMuffin1980@reddit

How though?

Reply

[-]

Emmie_Regula@reddit

Using data from a poorly secured system to gain access to a better secured one. If, for example, I know that you use your fingerprint to get into your banking app, I might not go after the bank directly - I might compromise some cheap catering system that also stores it in a much less secure fashion. Since a fingerprint can't be changed once broken, you now can't use it if I've worked out how to recreate it. Biometrics are much less secure than passwords in that manner - they're harder to get and recreate perfectly but once they are, it's gone for good until your reader checks other things (like pulse, or bloodflow)

Reply

[-]

Pharmakeia_@reddit

... Because it's their body. Like how are you unable to grasp that some people want control over what information is stored about them. Doesn't matter if you yourself don't mind. It's up to those who's information is stored to decide. In this case, the parent said no. So there's no 'buts' or 'ifs' doesn't matter on the why as it's not your business, plain and simple. Also big difference between being issued a passport and buying lunch at school. Do you get it now?

Reply

[-]

whatagloriousview@reddit

* Unlike a password, biometric data cannot be changed. Once lost, it's out there for good. * People use biometric data for phone unlocking and bank transfer authorisation etc. * Identity theft was a known problem long before biometrics came into effect. These are enough for me to raise the threshold of trust regarding who I give such data to.

Reply

[-]

BackOnThrottle@reddit

I opted my kids out as we in the public constantly hear of data breaches. If their fingerprint profile is stolen from a system hack, that's it for them forever, they will never again be able to use their fingerprint securely. In my mind, the security of a school is not terribly high and it might be worthwhile for a hacker to break in and steal all the personal information for all the students including the fingerprints. For me cell phones are a different story, fingerprint is stored on the phone itself, so someone would have to steal and hack the individual phone, which I consider to be extremely unlikely.

Reply

[-]

UncleSnowstorm@reddit

You're operating under the assumption that governments/police are completely ethical and not corrupt, and couldn't possibly frame you. Or that a hacker wouldn't be able to access your fingerprint details and then use that to access other things you use fingerprint log in for (e.g. banking). Or perhaps people just want to retain some level of control over their data and privacy.

Reply

[-]

MountainMuffin1980@reddit

How would a person be framed?

Reply

[-]

UncleSnowstorm@reddit

By placing their fingerprints at the scene of a crime, or by using their fingerprints to log into somewhere and steal their identity. Do I think it's likely? No Do I think it's possible? Yes Do I think the risk is worth the convenience? Yeah, generally; but I'm not going to force or shame others who don't. Otherwise why do we even have these data privacy laws in the first place?

Reply

[-]

Hot_and_Foamy@reddit

No you’re gonna have to actually explain how you think this could be used to place fingerprints at the scene of a crime.

Reply

[-]

UncleSnowstorm@reddit

If a digital copy of a fingerprint exists then that digital copy can be placed into a crime file.

Reply

[-]

Hot_and_Foamy@reddit

Ok, again, how?

Reply

[-]

UncleSnowstorm@reddit

Ctrl + C Ctrl + V

Reply

[-]

BlueTrin2020@reddit

I stand corrected now

Reply

[-]

Iforgetinformation@reddit

Bruh

Reply

[-]

Pedantichrist@reddit

Come on now, that is not a reasonable question. Obviously they can be.

Reply

[-]

Hot_and_Foamy@reddit

Go on then, how?

Reply

[-]

queenieofrandom@reddit

How is it even possible?

Reply

[-]

MountainMuffin1980@reddit

It's not.

Reply

[-]

queenieofrandom@reddit

Exactly

Reply

[-]

daern2@reddit

> Or that a hacker wouldn't be able to access your fingerprint details and then use that to access other things you use fingerprint log in for (e.g. banking). Your actual fingerprints aren't stored. More an algorithmic representation of how they appear to a sensor. You couldn't use this to reverse engineer them back into a fingerprint to use on another reader, for example, and while you could I guess use the record of them to digitally alter some record of what you did, if you're already poking around in there, there's not much difference between whether you used fingerprint, password, face or whatever. TBH, the big problem with fingerprints is that they are literally left all over the place every time you touch things, which is why they are useful as a second factor of authentication, but not really as a primary form unless for something relatively menial (e.g. school dinners). Also, not everyone can use them - my mother in law being a case in point. After years of labouring as a builder, her fingerprints are completely unreadable by any device that we've tried to use them with. In the end, she now owns a modern phone so can use face recognition instead for rapid unlock and loves this after years of frustration not understanding why her fingers don't work!

Reply

[-]

UncleSnowstorm@reddit

>Your actual fingerprints aren't stored. More an algorithmic representation of how they appear to a sensor. You couldn't use this to reverse engineer them back into a fingerprint to use on another reader Companies say this, but companies also said that passwords aren't stored, only hashed. Yet my password has been leaked multiple times (by oracle and other big companies, not just some dodgy website) as have millions of other people. I've also worked in companies where password were stored in a plain text file. I've dealt with enough incompetence to not put 100% fair in best practices

Reply

[-]

Small_Promotion2525@reddit

Complete and utter rubbish you can’t steal someone’s fingerprint.

Reply

[-]

WatermelonCandy5@reddit

You say ‘if you’ve nothing to hide, you’ve got nothing to fear’ a lot don’t you. Fascists can never believe their luck that people like you exist.

Reply

[-]

Hot_and_Foamy@reddit

In the same vein, you think GCHQ is reading all your emails don’t you?

Reply

[-]

Pedantichrist@reddit

No, We think they are storing all they can though, as part of their greater data source. Protecting data is not about someone sitting in a van spying on us, it is about data mining further down the line.

Reply

[-]

Kudosnotkang@reddit

Their AI bots are.

Reply

[-]

Hot_and_Foamy@reddit

What, all 8.3 Billion emails per day in the U.K.?

Reply

[-]

ThereAndFapAgain2@reddit

To be fair, if they were using computers and AI to do it, that wouldn't even be that many in a day to get through. Impossible for humans to do though, unless you have a fuck tonne of people.

Reply

[-]

Kudosnotkang@reddit

Yep, computers can do more processes than humans… Set up the parameters as to what to flag and set initial screening done by ai, the team needed to scrutinise the reports (which is the actual bottleneck here) isn’t too impossible to do nationally. When the laws started coming in people had the vale of anonymity due to volume ‘why would they be interested in me?!’ , but now the tools exist to detect and report on all - the filter is currently the follow up action, capacity and interests of prosecution limiting it. Now the ball is rolling we are trusting that they don’t go draconian minority report style . It’s a bit like speeding you don’t drive crazy so you aren’t worried about prosecution, but every now and then you might accidentally slip over the speed limit due to a mistake or concentration lapse - well imagine the technology suddenly exists to capture every infraction (in fact it does via black box ) and is covering all roadways at all times and will automatically sanction every offender. I don’t think many people no matter how perfect they think they are would like the idea of that . I don’t give it too much thought or worry about it, but I do think the people that do worry about it that are dismissed by others as nutters is a bit naive and unfair .

Reply

[-]

GCHQ_Admin@reddit

We do. Yours aren't very interesting though...

Reply

[-]

MountainMuffin1980@reddit

No silly, I'm saying I get that as a reason for why people might be concerned which is fair enough. But there are people in this thread talking about governments taking your prints and planting them in crime scenes, which is nonsense.

Reply

[-]

WatermelonCandy5@reddit

You have absolutely no idea when the next totalitarian regime will come along. I’m trans and my healthcare was taken away. I have to rely on the black market now because our government has decided they know me better than my doctors and put pressure on gp’s to kick trans patients and stop trans healthcare. I have to be a criminal now in order to exist. None of us know what will be a crime tomorrow, or if it’s something we can abide, why make it easier for them?

Reply

[-]

Walking_0n_eggshells@reddit

Well then you wouldn't have a problem with uploading a high resolution close up of each or your fingertips, right?

Reply

[-]

DangerousMort@reddit

lol are you 100% sure you’re never going to want to commit any ‘crimes’, as designated by ANY AND ALL future governments or law enforcement agencies? lol ok

Reply

[-]

getroastes@reddit

>I guess for if you commit crimes in the future? You shouldn't worry if you actually commit crimes. If someone has your fingerprint, then they can frame you using your fingerprint Also, while fingerprints are generally unique, it's not unheard of for people's fingerprints to be similar enough for misindetification.

Reply

[-]

SpinningJen@reddit

Or, you may have a handful of parents who understand the system as well as everyone else yet objects on perfectly reasonable grounds. Assuming someone "doesn't understand" just because they have a different approach to you isn't a good look

Reply

[-]

Muttywango@reddit

Some of those parents do understand the system but are concerned about the future effects of biometrics on their children, being born into a society where giving fingerprints, face and iris scans is the norm is a new thing.

Reply

[-]

OldGuto@reddit

What are the odds that the same parents are on facebook, have loyalty cards and use biometrics to unlock their smartphone?

Reply

[-]

SpinningJen@reddit

I do indeed. However, I don't know how severe the consequences of this will be down the line so while I am old enough to knowingly make a stupid choice I'm not about to knowingly make the same choices for my kid. Until they're old enough to learn and understand why this may be an issue and choose for themselves, I'm gonna preserve their data wherever possible

Reply

[-]

Muttywango@reddit

Yes, there's sure to be an overlap there. Nothing wrong with wanting better for your kids though.

Reply

[-]

Hefty_Bags@reddit

No, we understand the system, we're just vehemently opposed to it

Reply

[-]

MrGrizzle84@reddit

Would you be able to provide information to (e.g.) the police or the government if they requested it? Such that they could get information about someone's fingerprints.

Reply

[-]

HorselessWayne@reddit

I mean if the Police have a valid warrant for the information, they're going to get it, there's no way around that. The point is that there's very little reason for the Government to do that, since the school does not store enough information to uniquely identify a person from the fingerprint. It isn't forensic-quality.   The more information you store, the more sensitive the scanner is to small differences in very-similar fingerprints. Since there's only 1,000 or so people in the school, the school only needs enough data to distinguish 1,000 people. But as you increase the number of people you're comparing it to, the ability to pick a specific person degrades *very* quickly. Most people have very similar fingerprints to another person — very few attend the same school at the same time as that person. If you took a test fingerprint from the school database and tried to match it against the entire country, you're going to find multiple thousands of people who appear to "match". You just don't have the detailed information to distinguish them, making it effectively useless.

Reply

[-]

LiteratureLoud3993@reddit

"and we have a handful of kids whose parents don't understand the system, and have refused permission" Or just don't want their kids desensitised to giving away their biometric data to every organisation that asks.. This would be a massive instant no from me, and taking my child's fingerprint without my permission (if I had any..) would result in a colossal shitstorm they couldn't cope with Protect your damned data... and teach your kids that they have FULL bodily autonomy, not just the bathing suit bits.

Reply

[-]

TravisInLondon@reddit

>we have a handful of kids whose parents don't understand the system, and have refused permission. Oh, yes, they are just too stupid, aren't they! This is exactly the kind of arrogance my wife and I dealt with when we opted our children out of a similar scheme. The school constantly insisted we didn’t understand the system, implying over and over that we were too stupid to get it. Well, we understood it perfectly. We knew it was secure. They even assumed we thought someone could steal our children's fingerprints and impersonate them (lol wtf?) something we never suggested or even considered. The point is, we simply didn’t want to participate, and they couldn’t wrap their heads around that. By the end of it, I was left wondering who the real idiots were.

Reply

[-]

MitchellsTruck@reddit

Quite.

Reply

[-]

Major_Toe_6041@reddit

I had codes in high school. However you couldn’t just use someone else’s as the dinner ladies had a screen and the face of the person whose code was put in popped up. Why don’t they just do this?

Reply

[-]

furrycroissant@reddit

You're assuming everything child will remember their code.

Reply

[-]

Major_Toe_6041@reddit

Not at all, it still has its issues, however it’s easier to remedy as it’s a memory issue not a tech issue, and it’ll help in teaching the students that it’s important to remember stuff like that. And as the codes are all saved on systems, a teacher can just find the info for the student and make sure they put it somewhere safe that they can remember it, like their planner. Plus, it means the school isn’t losing money having to give out free lunches when tech breaks.

Reply

[-]

furrycroissant@reddit

Oh fab, another job for teachers to do - IT support. Anything else?

Reply

[-]

Major_Toe_6041@reddit

It isn’t IT support. It’s going onto a computer, finding a spreadsheet that has all the codes and searching a student’s name. And if the school uses Sims, the codes can be saved to that, meaning they are just using software they are already accustomed to, making it even quicker and easier. Being a teacher isn’t just ‘teaching’, you have a duty of care over the students, that includes getting them fed. No matter what route is taken there will be a problem somewhere and a teacher will have to go out of there way to resolve it. It’s only going to ever apply to the teachers who are on lunch duty, meaning it’s just a part of that task that they only need to do occasionally. And let’s face it, it’s the new year 7’s that have this problem, and it lasts for a month, after that you’ll have maybe 1 or two kids a week which really is not much, and if they keep having that issue then a letter or email can be sent to carers asking for them to either find a better way to remember or to bring a packed lunch instead, which again - takes no effort at all. IT support would be necessary if the tech broke, which is much more frequent with fingerprint tech, but that would be left to technicians anyway, a teacher on lunch duty is not going to be left to deal with that.

Reply

[-]

furrycroissant@reddit

I am a teacher, I have enough to do as it is

Reply

[-]

MitchellsTruck@reddit

They do. However, what if the parent hasn't consented for the school to photograph the kid? Then you also get "my brother said it was fine for me to use his code", "my picture is from two years ago, I look different now" and stuff like that. It takes ages to ID a kid 100% from a photo.

Reply

[-]

BlueTrin2020@reddit

Wow that’s a nice reply

Reply

[-]

l0singmyedg3@reddit

a good way my school got around people using other people's pins was to just have it come up on the screen with our school portraits so they could see if that person was stood in front of them or not. fingerprints just seem so impractical & just creates opportunity for paranoid parents to cause issues over it?? i'm only 22 so this really wasn't that long ago either!

Reply

[-]

steverdempster@reddit

I concur while they shouldn't have asked for it there would've been no malice in it. They simply wouldn't know how to work the system any other way. Any biometric data is securely stored and that is a fact. It's all about efficiency, managing budgets and minimising fraud and nothing more.

Reply

[-]

BlucifersVeinyAnus@reddit

Yeah, can’t be giving the school kids free food. If them fuckers want to eat they need to be down at the mine.

Reply

[-]

Papfox@reddit

> 100% not legal. I work in IT at a school, running a cashless catering system, and we have a handful of kids whose parents don't understand the system, and have refused permission. I agree this is not legal. I would report it to the ICO as a DPA/GDPR violation. > The dinnerladies always want them to have a fingerprint as it's quicker, and can't be used by anyone else. When we only had codes, people used to use other people's codes, or just guess a random one, and get free food. I agree but this doesn't give them the right to break the law. > So, the answer to your question is no, it is not legal, and you're well within your rights to request deletion of your child's biometric data. > However, of the big three cashless catering systems I've worked with, all have encrypted databases for biometrics, so no-one can get the fingerprints "out" of the system, if that makes sense. What it actually stores is a number of data points from the fingerprint, and the distance they are apart. Even if someone managed to unencrypt the database, they couldn't recreate a fingerprint from that data. I'm sure the tools provided by the system maker don't allow you, as an administrator, to access this data. It doesn't necessarily mean that they can't using the tools they have. The data doesn't have to be removed from the system for it to be abused. If an incident was being investigated and the investigator was in possession of a fingerprint of the person who they thought had committed it, showing the print to the system would reveal the child's name. > Have a word with the school's Business Manager on how they managed to ignore your request, and ask their IT how the fingerprint is stored - most likely it's fine for you to give permission. I agree this should be brought to the Business Manager's attention urgently. I'm not so sure about how useful any statement from the Business Manager on how the information is stored will be. They're likely to just repeat whatever the brochure for the system or the maker's Powerpoint says. They are unlikely to have a deep understanding of how it works. I don't like systems like this. They "soften kids up" to think it's OK to hand over biometric data to anyone who asks. Biometrics are precious things. They are unique and cannot be changed. If my fingerprints get leaked, any system I use them for is potentially fatally compromised as I can't just log in and get a new set of fingerprints. I'd be in the front of the queue to object to my children's fingerprints being taken out of expediency, like this. Source: I am an IT professional that deals with IT security on a daily basis

Reply

[-]

RJK-@reddit

Instead of going to the ICO and ensuring you have a terrible relationship with your child’s school, perhaps try resolving it locally first. Sometimes common sense should come before the legal hammer. One fine from the ICO and you can kiss goodbye to a decent education for most of that school.

Reply

[-]

ButtercupGrrl@reddit

>I don't like systems like this. They "soften kids up" to think it's OK to hand over biometric data to anyone who asks. Biometrics are precious things. They are unique and cannot be changed. Handing them over to someone should always be a conscious decision that takes into account the risks and benefits. If my fingerprints get leaked, any system I use them for is potentially fatally compromised as I can't just log in and get a new set of fingerprints. I'd be in the front of the queue to object to my children's fingerprints being taken out of expediency, like this. Yep, totally with you on this, especially the bit about softening kids up to think it's ok. I'm old enough that when I first went online all social media was 100% anonymous, nobody even used their first name anywhere. The only exception was Friends Reunited 🤣 I remember being horrified when Facebook came along and insisted everyone use their full real name online. Far too easy for people to be stalked, both virtually and in person, eg "oh look, Jo Bloggs goes to yoga class at the leisure centre at 2pm every Saturday, I can go hassle her when she comes out, or alternatively I know she ain't gonna be home so I can go break in". Probably makes me sound paranoid, but as a survivor of an abusive relationship I can assure you it 100% is not. Even now, I don't use my real surname on FB and use a different common surname instead, and most of my social circle are none the wiser - who introduces themselves at yoga class with their surname anyway?! First it was sharing real names, now loads of services demand your date of birth and/or postcode, and nobody bats an eyelid. And now we're raising kids to think it's perfectly normal to give their biometric data too. It horrifies me, quite honestly.

Reply

[-]

Pedantichrist@reddit

I fully understand the system, and that is why I object to it. And I really do, I have worked in data software my whole career and I do not wear a tin foil hat, I just know how incredibly poorly PPI is stored.

Reply

[-]

Metholis@reddit

This man has worked with Civica before....

Reply

[-]

connoza@reddit

lol don’t understand. They don’t trust the school or third parties to securely store a unique identifier of their child. I work with schools and have seen data being passed around with no process or GDPR assessments in place. Data being transferred out of the country and all sorts. I honestly wouldn’t trust anything with eye scans or finger prints, you truly don’t know where it’ll end up or who owns it.

Reply

[-]

Ivashkin@reddit

> However, of the big three cashless catering systems I've worked with, all have encrypted databases for biometrics, so no-one can get the fingerprints "out" of the system, if that makes sense. What it actually stores is a number of data points from the fingerprint, and the distance they are apart. Even if someone managed to unencrypt the database, they couldn't recreate a fingerprint from that data. Devs cut corners all the time. It's why cybersecurity people make so much money.

Reply

[-]

RFLC1996@reddit

Same, IT for a high school, we started using RFID in their cards with Biostore, don't need to get permission then. Fingerprints look cool but theyre a massive hassle

Reply

[-]

crucible@reddit

Card loss is a factor though, we charge after the first replacement.

Reply

[-]

RFLC1996@reddit

Yeah we're the same, it's not cheap either, think we charge £5 per card mostly so they take care of them. It does also link to Net2 for doors though.

Reply

[-]

crucible@reddit

Yes, we’re similar

Reply

[-]

MitchellsTruck@reddit

RFID cards get lost, stolen, borrowed and broken. Fingerprints are just as quick, and non-transferrable.

Reply

[-]

Fit_Implement3069@reddit

They might understand and still refuse... personally, I think it's a terrible system, and I understand it.. I don't get why they can't also take contactless payments at the till... Fingerprints are fakable, dirty (every student touching it then eating)... it isn't as if they clean it every time....

Reply

[-]

NorthernScrub@reddit

> Even if someone managed to unencrypt the database, they couldn't recreate a fingerprint from that data. Would that this were true, and in theory it is. However, I guarantee that there's a *shitload* of biometrics applications using the same libraries for fingerprint recognition, and depending on how that library is implemented, one applications stored data may very well be valid for another. Never use data that cannot be changed for security.

Reply

[-]

JibberJim@reddit

> > However, of the big three cashless catering systems I've worked with, all have encrypted databases for biometrics, so no-one can get the fingerprints "out" of the system, if that makes sense. Remember this isn't actually the risk though, the risk is using that database to identify the individual, you don't need "to get the fingerprint out", you just need to have the scanner and the salt and it will compare if there's a match, that's much easier data to obtain. The phone fingerprint systems don't work this way, you need the actual device the fingerprint was registered to, if that's the appropriate risk model for phones, why are schools different? Is it a genuine risk? Probably not, especially for most, but if you were a nation state concerned about "spies", this would be a useful match up of identities, because it's from before the time you need it. There's also the "computer says no" aspect, or rather the opposite, people believe technology to be infallible, but errors occur (NIST said 98.6% accuracy at best in 2004, although things have improved I'm sure, but are cheap school systems that state of the art?) So when there's an error and you're charged for someone else's food, the fingerprint is there. But yes, basically no risk, feel free, but equally feel free to insist on the school not, and a school certainly cannot insist as you've noted.

Reply

[-]

princeofthehouse@reddit

As someone with the same background. This is correct. The school should have followed your instruction however this sounds like an uneducated individual staff error rather. Dinner lady should get a talking to and the data should be removed. However as he says the data is both going to be secure and useless mostly if somehow accessed. These systems are safe and fit for your kids use and makes it very easy for all parties. But just contact the school and have them fix it.

Reply

[-]

dandeel@reddit

Just let him use the fingerprint, it's so much easier for everyone... They probably also don't store the actual fingerprint, instead a "hash" to compare it against. This is like storing the corresponding keyhole that only one key (your fingerprint) fits, where it's mathematically impossible to reverse engineer the key from the keyhole even if it is leaked.

Reply

[-]

zonaa20991@reddit

When did this whole cashless thing happen? When I was at school we had these magical mystical pieces of paper and metal, with pictures of the Queen on, and small numbers denoting their value in pounds sterling. Once you got to sixth form you even had the option to use your card if you so wished. It worked brilliantly.

Reply

[-]

notouttolunch@reddit

I volunteer with schools but am a significant volunteer with a large youth charity. We collect as little money as possible as frankly, there is nowhere to take it! It’s actually a total PITA when people go down cash based routes and it puts people off bothering. I think schools are a step above that, by which i mean they do have paid personnel rather than only volunteers, but I think back to when Victoria Coren Mitchell was on… Room 101 I think. She complained that the problem with cashless was that everyone knew where you were, what you were doing and so forth. However from our perspective, as a volunteer organisation, that wonderful traceability is absolutely fantastic and much better than an indiscriminate pile of metal that could have come from anywhere, anyone and for anything. When it goes wrong with cash, you’re screwed.

Reply

[-]

zonaa20991@reddit

In a school, why do you need to know where money has come from? If you’ve served 350 portions of sausage and mash for £1.80 and 200 portions of chicken jalfrezi for £2.30, all you need to know is that you have £1,090 in your tills at the end of the break

Reply

[-]

notouttolunch@reddit

I’m pleased you understood in the end.

Reply

[-]

zonaa20991@reddit

It’s not a case of understanding or not. I’m just not that interested in the goings on of your charity. You’re the one who decided it’d be a nice idea to come back and try to gloat.

Reply

[-]

notouttolunch@reddit

Oh dear. You’re one of those people. “I’m wrong, so now I’ll just pretend I’m right and not learn.” You’re probably one of the people who just say “no” on principle even when someone has clarified the situation perfectly. If you took on board things that other people say to you then you may learn something.

Reply

[-]

zonaa20991@reddit

Condescension is never an attractive quality in an individual

Reply

[-]

notouttolunch@reddit

You’re right. You shouldn’t do it.

Reply

[-]

zonaa20991@reddit

I said nothing about your experience, simply your conduct. What do you call coming back to a thread over a day after the fact and making barbed comments like ‘I’m pleased you finally understood’?

Reply

[-]

notouttolunch@reddit

But you’re getting there.

Reply

[-]

notouttolunch@reddit

No you don’t. You need to be able to show that those eligible for free meals got their free meals (the same sort of public accountability that slows the government down), that you have an audit trail that can show bullying isn’t causing people to buy more meals than they’re eating. Schools have to cover their backs on a lot of things including having a good audit trail to support their safeguarding and to show that they are being responsible with their funds. Unlike a shop which can sell anything to anyone and it’s their responsibility to prove they bought something, a school is judged on how well it monitors a child and its development and to make sure it’s safe. Two different worlds.

Reply

[-]

crucible@reddit

The money has to be counted, stored securely and banked at the end of the day. Human error happens - the zoo trip money should have been locked in the teacher’s desk, but she forgot. Then it was stolen. The catering manager forgot to put all the money in the safe. Someone broke in overnight, took the money, and some meat from the freezers. Which they left open so everything else defrosted and had to be thrown out. Both scenarios have happened at schools I’ve worked at. Hence the push for “cashless” catering.

Reply

[-]

zonaa20991@reddit

On the first example, why is a teacher dealing with money? Where was the bursar? On the second, again, why is this the caterer's responsibility? The bursar should be collecting the money at the end of the day to bank or store safely.

Reply

[-]

crucible@reddit

Money should have been locked away, but an obvious flaw there is the teachers would usually hand it in when next free, eg morning break. Just the way our place worked - catering manager ran the day end process, took all the cash from the tills and cash loaders, bagged it, and then handed it in. Some was left in a cash box in their office for some reason.

Reply

[-]

zonaa20991@reddit

> Human error happens - the zoo trip money should have been locked in the teacher’s desk, but she forgot. Then it was stolen. Why was a teacher dealing with money? Where was the bursar? > The catering manager forgot to put all the money in the safe. Someone broke in overnight, took the money, and some meat from the freezers. Which they left open so everything else defrosted and had to be thrown out. For which the school was presumably insured, either way, again, where was the bursar to take the money at the end of lunchtime?

Reply

[-]

Aware-Bumblebee-8324@reddit

Teacher here. They shouldn’t have done it. However the fingerprint is not actually stored the computer just generates a code using the reflected light from the finger as everyone is different the code is always different. That code is then encrypted and only used for that by the system. There is no way your child’s fingerprint can be copied. If you would like revenge ask for a DSAR for your child stating the reason for the request being the unauthorised gathering of their biometric data. There will be some very annoyed admin staff who will definitely take it the head from their side as well.

Reply

[-]

JadraxDarkfire@reddit

Pretty much if you ask for a DSAR its pretty likely that they will never let a member of staff make this mistake again.

Reply

[-]

User-mine@reddit

The question is why would you be so paranoid as to think the convenience of a cashless fingerprint paging system at a school is going to misuse his fingerprint. I get the box is there and you ticked it and that should have been respected, but its such a non-issue I would just ask why make your kid be the different one who isn’t allowed to use a fingerprint to buy a sandwich?

Reply

[-]

Dans77b@reddit

Thank god somebody said it. I feel sorry for this kid, everyone's gonna think his mum is insane.

Reply

[-]

whooptheretis@reddit

The insane ones are the people who just blindly allow personal data to be harvested. I'd say this parent is one of the few sane ones left.

Reply

[-]

Interest-Desk@reddit

You do know the fingerprint itself isn’t actually scanned right? And systems *should* use a process called hashing to make sure you can’t take an entry from their database and get the raw data from it (which is what sites *should* do with your password). I say should since ofc in reality there are lots of bad systems which don’t do this. But even in a worst case scenario, the data retrieved isn’t actually usable. … and even if they did have full fingerprints? What are they gonna do with them? (FYI: a lot of countries will require fingerprints to get a visa)

Reply

[-]

AlliRmbrIsDrtSkyDrt@reddit

>You do know the fingerprint itself isn’t actually scanned right? So it guesses what the fingerprint looks like?

Reply

[-]

Interest-Desk@reddit

No, it looks at a few specific points and ignores the rest.

Reply

[-]

AlliRmbrIsDrtSkyDrt@reddit

It looks at a few specific points by doing what?

Reply

[-]

Interest-Desk@reddit

The reader measures arbitrary points on the finger. That data makes up a tiny fraction of a fingerprint, but is enough to be unique. This is why putting your finger on the wrong orientation will cause it to not scan. Some systems will use a full fingerprint. This is usually because they want to be able to scan irrespective of the orientation. Apple’s TouchID do exactly this, as do the police. This is rare because it is difficult to justify under data protection law and more expensive (you need more data and usually specialist readers).

Reply

[-]

AlliRmbrIsDrtSkyDrt@reddit

So it does scan the fingerprint.

Reply

[-]

Interest-Desk@reddit

No. There is no way to take the data from the reader and reconstruct a fingerprint.

Reply

[-]

AlliRmbrIsDrtSkyDrt@reddit

To take the measurements of arbitrary points, the fingerprint is scanned to get these points. It can't collect the information without taking data from the fingerprint, whether it's partial or complete and regardless of how the information is stored. This >There is no way to take the data from the reader and reconstruct a fingerprint. Is a completely different point to this, >You do know the fingerprint itself isn’t actually scanned right?

Reply

[-]

whooptheretis@reddit

You can still use a hash to validate an input. It's just another uniquely identifiable bit of data in a world that normalises data collection which is then used to exploit people, or can be used for harm. Schools should be teaching kids about data control and the right to privacy. Why do schools need fingerprints? There's not a problem here that needs to be solved with tech.

Reply

[-]

Spicymargx@reddit

The school doesn’t need fingerprints. They use a system which allows you to use your fingerprints to do certain things. This is clearly not a technology unique to the school, it is bought in. I don’t get what you think the school wants to do with children’s fingerprints?

Reply

[-]

Houseofsun5@reddit

It's not really a fingerprint that's taken, it's just a few measurements and reference points across the pattern, it's not anywhere close to an admissible in court police taken style fingerprint.

Reply

[-]

i-hate-oatmeal@reddit

whenever i used my fingerprint in school it always came up with somebody else's account. Ended up having to put a note (or something) on to double check it was infact the right person

Reply

[-]

Houseofsun5@reddit

Yeah, it's not totally secure, it's not like payroll fraud dropped to zero once it was implemented at work, it's still going on 1 caught getting 4 wages not that long ago.

Reply

[-]

Training-Treacle3790@reddit

You're completely correct. Unfortunately people can't get their heads around this or refuse to understand it as they prefer to be outraged.

Reply

[-]

tomelwoody@reddit

Maybe the school did not make that clear and the way they worded it made it seem they had ink fingerprints on paper in a filing cabinet somewhere.

Reply

[-]

butchbadger@reddit

Not being a sheep a giving away masses of personal data here there and everywhere and your insane now. Damn...

Reply

[-]

Dans77b@reddit

You have to balance the risk of the kid being an outcast weirdo against the dinner lady nefariously using their finger print.

Reply

[-]

butchbadger@reddit

A valid point on singling out your child, its hard as a parent these days with social media and data greedy companies. I think youre down playing the concerns. Its obviously not the dinner lady. Its the aggregation, sharing and profiling of data for use down the road once little kayden-romeo has left school.

Reply

[-]

Chickennoodlesleuth@reddit

School fingerprints really aren't the same as police fingerprints, school fingerprints aren't a full print and can even mistake kids for each other

Reply

[-]

wildOldcheesecake@reddit

It’s parents like this that unduly hold their child back.

Reply

[-]

Toffeemanstan@reddit

Only on reddit can someone extrapolate that much from a single decision someone made.

Reply

[-]

wildOldcheesecake@reddit

That’s the point of a platform like this. We make comments based on the post and use our own experiences and inferences to bolster the comment.

Reply

[-]

Toffeemanstan@reddit

Its the point of reddit to make wild accusations based on 1 decision someone made, sure it is mate. I dont think you know what banter is either.

Reply

[-]

Dans77b@reddit

There is enough information in OP's post to conclude that the kid will be seen as an oddball. (Reminds me of the kids that weren't allowed to read Harry Potter in school)

Reply

[-]

Toffeemanstan@reddit

Seen as an oddball because he doesn't use fingerprint recognition. Yeah sure mate 👍

Reply

[-]

Dans77b@reddit

Blame schoolkids, not me.

Reply

[-]

wildOldcheesecake@reddit

Accusations? Oh dear me, seems like you need to learn what that means too

Reply

[-]

Icy_Priority8075@reddit

Has she considered burning his fingertips?

Reply

[-]

AtJackBaldwin@reddit

What terrible advice. They can grow back if burned. Good parents sand fingerprints off.

Reply

[-]

Makaveli2020@reddit

What about those who aren't paranoid but don't agree with their young children having to use their fingerprints to get bloody food.

Reply

[-]

BristolBomber@reddit

Why wouldn't you agree if you aren't paranoid? There is no rational argument that doesn't stem from paranoia about something irrational happening. The biometric data (which is not even a full fingerprint) accesses a payment database which is either loaded with credit or credited for free school meals. It is fast and cost effective with very few administrative overheads. Which means less issues for kids and staff with quicker service times.

Reply

[-]

Makaveli2020@reddit

While I agree with all of the above, it doesn't stem from paranoia, it's about being in control of my and my children's personal data which is everyone's right. I have no issues with using my bio data for various purposes while being consciously aware of how my data is being used as an adult. A child will not understand the full scope of how their personal data is being used and what it actually entails. Are the schools also educating children about their personal information and how that is used in society and safe practices around that? And all that to pay for their school lunches?

Reply

[-]

BristolBomber@reddit

Yes they are.. it's quite literally part of the PSHE curriculum...at the vast majority of schools nowadays. And as for being aware of pretty much anything that is also your responsibility as a parent. Furthermore whilst they are a child it is also your responsibility to understand these things and make the legal decisions for them... Whilst educating them on them. And yes.. to pay for school lunches... Because it solves a significant amount of issues within the school for admin, and running of lunch sessions. So.. what exactly arent you in control of that is significantly different from providing your address etc to the school and how exactly do you think that the biometric measurements (that are not full fingerprints) could be misused? Having control of your data is an excellent premise.. but this isnt arbitrarily giving it away.. its not chucking it to a promo company.. its an account identifier for the systems at the school. Its a key for a lock. In this particular situation and usecase there are zero good and logical reasons to not consent to the use. The obly reasons *do* stem from paranoia about what could happen... Or it is just an arbitrary 'just because i dont want to'.. which sure.. is a reason.. but lets nit pretend that is anything other than being obstenant for obstenants sake.

Reply

[-]

Makaveli2020@reddit

Holy you're unhinged, it's almost as if you don't believe that people should have their own belief and if it contradicts your own, you're willing to strip and belittle people of their basic rights. Biometric data is classed as sensitive information, it doesn't matter that it's only taking data points, it's still sensitive data, you make it sound less than it really is. Schools have to follow strict rules as a data processor, part of the rules is using the data in a way that is adequate, relevant and limited to only what is necessary. I'm sorry but making a lunch que go by faster isn't necessary and none of my concern.

Reply

[-]

BristolBomber@reddit

I never said anything about stripping people of rights.... The point being that there is no good or logical reasons to not consent to this.. those who chose do do so absolutely have the right but its is being obstenant for the sake of it... Or a paranoia about how the data could be misused. The fact is.. if you apply the 'necessary' to literally any situation to the extent you are, then biometrics strictly speaking are never necessary. Having rapid systems in school is necessary to get volumes of students through in time. They are necessary to cut costs on already stretched budgets for best value (as its government money). They are necessary in cashless environments such as a school and the type of environment it is. The data is stored securely and is only usable with the systems that are used in the school (the raw data is functionally useless). You can do whatever the fuck you like... It doesnt mean that your reason is justifiable past 'i dont wanna'.. and unfortunately people like that have a real terms negative inpact on the delivery of services, adding layers of challenge and resourcing that just are not needed based on nothing else.

Reply

[-]

NorthernSoul1977@reddit

Totally. But there will be a few of 'em. Entitled 'main characters' who make it harder for everyone else.

Reply

[-]

Orange-Murderer@reddit

While the likelihood of a nefarious gang entering the school system under the guise of school technicians and catering staff is pretty low. The technology to just install a proper fingerprint scanner and then use the school systems ID program to match users and fingerprints and place inside another database would be pretty easy to do. It could even be automated with machine learning. I won't go in-depth with what they could then do with all that data but it's a lot. The biggest issue will be identity theft. While I do understand using a fingerprint scanner would make shit go easier for the school, the school needs to prove what it does and doesn't do with all that data the onus is on them not the parents trying to reasonably protect their kids.

Reply

[-]

Spicymargx@reddit

The school has a statutory duty to publish its policies and there are policies in place which allow the school to prove they can handle this data.

Reply

[-]

SpinningJen@reddit

Regardless of what is written, they've literally proven that they cannot handle this data. They haven't trained staff appropriately and as a result have illegally collected and stored private data from a minor.

Reply

[-]

plumbus_hun@reddit

Yes, I can remember when finger prints came in at my school, this isn’t a new thing, as I’m 30 now and I was in year 8, almost 20 years ago! Nobody’s parents objected to it then, it was how you paid for dinner and took out books from the library! It doesn’t even record actual finger prints, just points of data on the finger, ie however many mm between this point of the loop. If they are this paranoid, their kid should be taking in home made sandwiches!

Reply

[-]

DrHydeous@reddit

No. It's a reasonable concern. Steal someone's biometric information and you've got an access key that can never be revoked. I wouldn't trust a school to secure *anything*, let alone to encrypt data both in transit and at rest, securely delete data when they no longer need it, make sure it is purged from backups, including offsite backups, and won't be able to be retrieved in 20 years time when access to your (now famous) offspring's personal data is actually worth a sleazy tabloid journalist's while.

Reply

[-]

Spicymargx@reddit

Can I ask why you wouldn’t trust a school to do what they are legally mandated to both do, and be able to evidence they do?

Reply

[-]

B8eman@reddit

It’s hilarious that people are asking this, when the answer is literally in the OP

Reply

[-]

DrHydeous@reddit

Decades of experience in IT.

Reply

[-]

whooptheretis@reddit

> Nobody’s parents objected to it then Because people were ignorant. In the 60s people used leaded petrol and smoked like chimneys.

Reply

[-]

UncleSnowstorm@reddit

20 years ago we were a lot more clueless about data breaches, data privacy, what our data could be used for, how much data we'd be asked to give up etc.

Reply

[-]

BinJuiceCocktail@reddit

Why is it paranoia to just not want something done? I'm in the middle of arguing over a GDPR form I need to sign at work saying I accept the use of Thermal Imaging, Heat Mapping, Age Verification and Gender Identification in my workplace (but not in the toilets) ? No-one can tell me why I need to accept this may be used and I'm just supposed to sign it. I don't think someone is going to be harvesting my genes by doing this but I don't particularly want to sign up to say it's OK. Same with kids having their fingerprint taken. Is the school going to fall apart if it's not done? I'd rather my kid had a card or something thanks because there's really no reason why it needs done I use a fingerprint on my phone btw, biometric security has its place but for school dinners? Nah.

Reply

[-]

spik0rwill@reddit

Seems a bit unnecessary to fight something like this. What are they going to do with your kid's fingerprints? Frame them for murder?

Reply

[-]

BinJuiceCocktail@reddit

Seems a bit unnecessary to take their fingerprints. Just give them a card. The main point is OP said no, the school went ahead and did it. Whatever OPs reasons for it they're kind of irrelevant if the school are just going to ignore permission slips.

Reply

[-]

BristolBomber@reddit

Cards cost money and extra reading equipment when things are biometrics... Cards can be lost then the kid needs a new one.. Cards can be used by other students.. Theres quite a list of very good reasons. Whereas the list of reasons is literally: I dont want it. It's paranoid because there is no good reason not to. The fact the school took it is separate issue and likely an admin error (due to the fact 99.9% of parents consent because its nuts not to)

Reply

[-]

BinJuiceCocktail@reddit

Ah, the biometric equipment was free. Gotcha

Reply

[-]

BristolBomber@reddit

Well... No... But it doesnt magically make the equipment for cards, the cards themselves, the time required from staff to solve lost card issues, dealing with lost or stolen cash or the logistics for cash magically fucking appear just because it wasnt does it... Yea.. that was a real 'gotcha' moment...

Reply

[-]

spik0rwill@reddit

Cant lose biometrics.

Reply

[-]

MrLore@reddit

They can be stolen though, and can't be changed if they are.

Reply

[-]

BristolBomber@reddit

And used for what? School biometrics aren't full fingerprints. No criminal masterminds are targeting schools for fingerprint databases to plant at murder scenes... They arent waiting outside schools hoping to target kids and steal their phones to utilise the biometric data.

Reply

[-]

spik0rwill@reddit

Stolen and used for what? It's not even a whole fingerprint that the schools take. It's a few points of reference. The whole thing reeks of paranoia.

Reply

[-]

Eve_LuTse@reddit

I wish I lived in the perfect world you seem to inhabit, where date breaches never happen. That said, I do give up small slices of my privacy on a regular basis, for the convenience of using modern systems, and as others have commented, alternate systems are far more prone to bullies intimidating other kids.

Reply

[-]

BppnfvbanyOnxre@reddit

It is more like the hash of a fingerprint than the fingerprint itself in the same way that passwords are (should not) be stored but a hash is. It is not possible to go from the hash to the print, i.e it is not [IDENT1 ](https://en.wikipedia.org/wiki/IDENT1)

Reply

[-]

whooptheretis@reddit

Hashes are still a biometric. The hash can still be used to validate an input.

Reply

[-]

Ch0col4a73_0r4ng3@reddit

> The hash can still be used to validate a biometric input. And?

Reply

[-]

whooptheretis@reddit

Arbitrary collection of personal data shouldn't be normalised.

Reply

[-]

Ch0col4a73_0r4ng3@reddit

A hash isn't personal data.

Reply

[-]

whooptheretis@reddit

But can be used to verify it.

Reply

[-]

Ch0col4a73_0r4ng3@reddit

Hopefully, the school won't be designing the system. I acknowledge that ignoring security around biometrics isn't sensible, but neither is blatantly being against it. I'm not saying you are, but like many things in life, it is never as straight forward as the internet likes to believe it is.

Reply

[-]

whooptheretis@reddit

There's no need for fingerprints to get lunch, therefore I question the legitimacy of the system.

Reply

[-]

Ch0col4a73_0r4ng3@reddit

How do you suggest pre-paid meals at schools are validated that will prevent bullying?

Reply

[-]

whooptheretis@reddit

Same way as when I went to school.

Reply

[-]

localzuk@reddit

Can you elaborate?

Reply

[-]

jaseruk@reddit

PS - did not mean to imply you are old enough to remember hand spinning cotton!

Reply

[-]

jaseruk@reddit

I suspect the world has changed a lot since you were at school. Do we still spin cotton by hand in households? Or did we move to factories and automation to increase efficiency and output? Fact is, as the population grows, manual processing simply will not suffice. We need to automate - that is how a country develops wealth.

Reply

[-]

therezin@reddit

Correct, but it cannot be used to reconstruct a biometric input.

Reply

[-]

whooptheretis@reddit

Correct.

Reply

[-]

annedroiid@reddit

Do you expect most lay people to know that?

Reply

[-]

brothererrr@reddit

No, but if you’re so concerned with privacy wouldn’t you try and figure out exactly what is being stored before declining?

Reply

[-]

Fit_Implement3069@reddit

It isn't about paranoia, it is about what is right and respect. I let me kids choose whether or not to register on the system, fingerprinting at school is a slippery slope, getting kids used to institutions using their biometrics, as someone in the tech space, I do not consider fingerprint secure and understand that if I let someone take it, then I am giving away something in return for something else (such as entry to a country)

Reply

[-]

BristolBomber@reddit

Getting something in return... Like Access to a payment system? It's not a slippery slope.. its convenience and speed. You *are* paranoid.

Reply

[-]

minihastur@reddit

It's a question of consent. There was a question asked "do you want to do X". The answer was "no". They went ahead and did it anyway. That's not OK regardless of the situation

Reply

[-]

BristolBomber@reddit

I didn't say it was OK. I was pointing out the whole ridiculousness of not consenting in this *particular* situation and the fact that the biometrics arent arbitrary.. they are for specific access to a system. In this case it is likely an administration error because most parents aren't nutjobs who don't consent to this (and they were likely wholesale registering tutor groups). I also dont understand why the OP needed to post the question on reddit rather than do the obvious thing and contact the school saying that they did not consent but thats by the by.

Reply

[-]

whooptheretis@reddit

> The question is why would you be so paranoid as to think the convenience of a cashless fingerprint paying system at a school is going to misuse his fingerprint No, that's not the question. Each person has the right to their own data. Regardless of the reasons for opting out, you need to respect the wish to opt out. As for the reasons, it's just another normalisation of data collection and storage of biometrics in an insecure system.

Reply

[-]

BristolBomber@reddit

What makes the system insecure? I assume you have done a full security rundown of how that data is encrypted, where the data is stored and who has access to the *actual* biometric data rather than the system that uses it... Right?

Reply

[-]

paulmclaughlin@reddit

> No, that's not the question. Each person has the right to their own data. Regardless of the reasons for opting out, you need to respect the wish to opt out. Then they can bring a packed lunch, problem sorted.

Reply

[-]

whooptheretis@reddit

That'd probably be significantly healthier for them too. There isn't a problem here that needs solving with tech.

Reply

[-]

PixelBrother@reddit

Let me turn this around and ask you something. Why does the convenience of a cashless payment system have priority over the right to privacy? Systems get hacked, data gets lost or stolen. It’s up to everyone to decide what their ‘line’ is when it comes to privacy and that choice should be respected.

Reply

[-]

Throbbie-Williams@reddit

>Systems get hacked, data gets lost or stolen. Ok but what is anyone going to do with some pictures of kids fingerprints?

Reply

[-]

Educational-Month182@reddit

I'm one of those annoying parents that won't let me child have their name or photos on the schools social media or internal photo sharing app but... Finger print use us actually to protect the kid So many lose or forget their card- they will be hungry Children get their cards stolen/taken by bullies. You can easily get away with stealing a card and using it because the sheer number of pupils- staff just won't know their names. But they'd certainly notice a stolen finger!

Reply

[-]

MattyLePew@reddit

I’m glad somebody else said it. Why make your kid the ‘different one’? So unnecessary but at the same time, I’m very curious about your concerns. 🤔

Reply

[-]

B8eman@reddit

Yeah, the kid will look so insane making purchases with a card. This comment section is unhinged.

Reply

[-]

Slovaak5070@reddit

No, the kid won't. Its easy, swipe a card like you swipe a bank card. I had a card for 5 years, people thought it was cool and wanted one instead of having a fingerprint - not to mention the fingerprint didn't work half the time, and was DISGUSTING from hundreds of children who wipe their asses and don't wash their hands properly (or at all) using the same scanner. Speak for yourself and keep being a sheep if you want to follow the pack, but don't put other parents down for wanting to parent their children their own way. Their child, their choice. These comments from people wanting to follow the "pack" and not make decisions for themselves and their family are the reason this country is a fucking mess. Get a grip, shameful.

Reply

[-]

Elliejc21@reddit

I can’t tell if this comment is satire or not, especially with the tinfoil hat keywords like ‘sheep’ and ‘CHINA’.

Reply

[-]

B8eman@reddit

Dude, I was being sarcastic.

Reply

[-]

Montinator89@reddit

>The question is why would you be so paranoid as to think the convenience of a cashless fingerprint paying system at a school is going to misuse his fingerprint I don't think the post implies any kind of paranoia. OP literally said: >Is this legal? And if it is, what is the point in sending out permission forms in the first place? They're asking is it legal to take those fingerprints when consent has been actively denied - and no, it isn't. They're asking what is the point in asking permission if permission is denied and that request is ignored anyway - a reasonable question. If you are given an option to make a choice on any matter only for your choice to be promptly ignored at the first opportunity, then what was the point in being given the choice? I can relate in the sense that I prefer to live my life on the basis of having the liberty to make my own decisions and I expect those decisions to be respected. It's a matter of principle - it shouldn't matter whether my decision goes against the grain, is inconvenient for a third party or irrelevant in the grand scheme of things - it is still my decision to make.

Reply

[-]

MelodicAssignment917@reddit

Some people just like to be annoying

Reply

[-]

Khaleesi1536@reddit

This was my first thought too. Hope they’re not antivax as well

Reply

[-]

UncleSnowstorm@reddit

Hell of a leap.

Reply

[-]

Toffeemanstan@reddit

It is but reddit loves to take it, tell someone one thing about a person and reddit will tell you how bad that person is in everything else.

Reply

[-]

No-Structure-8125@reddit

Some people just think they're the most important person in the world. We use a fingerprint system at work for clocking in and out, and I've had several new starters refuse because they're worried about what we'll do with their fingerprint.

Reply

[-]

hihrise@reddit

I highly doubt it's legal. I remember having a similar sort of arrangement where we had to have our parents sign a consent form to use our fingerprints. If you didn't sign it you used a code, if you did then you used your fingerprint. Eventually they just transitioned to everyone using pins instead so not sure why they bothered with the biometrics in the first place. But I imagine it isn't legal since you explicitly stated you didn't want them to

Reply

[-]

Zestyclose-You4831@reddit

Freee school meal gang are prone to criminal activity so police getting a head start

Reply

[-]

Houseofsun5@reddit

It's not actually a "fingerprint" we use a similar system at work for hourly employees to clock in and out. It takes a measurement of the fingerprint,.a number of points of reference not the actual fingerprint. They just use the term "fingerprint" as it's easier to just say that than explain it, no actual copy of your child's fingerprint is stored to the equivalent of something like a police fingerprint record, nobody could reconstruct your child's fingerprint from the data held.

Reply

[-]

Wolifr@reddit

I don't think people are worried about their fingerprint being recreated but more about the fact that if that data does get out they can match a fingerprint to a name.

Reply

[-]

Houseofsun5@reddit

Where do they get the fingerprint from to match to the name ?

Reply

[-]

Wolifr@reddit

Off literally anything you touch ever?

Reply

[-]

Houseofsun5@reddit

They can't match that to anything in the data collected by a dinner hall fingerprint scanner, it does not store a fingerprint. The code it generated from scanning the fingerprint can't be CSI Miami style back into a fingerprint, it would at best give you 20 or so individual dots on a sheet of paper if you printed it. If you scanned the same finger again, with the same scanner, it would result in a different code, which if back engineered CSI style would result in another 20 or so dots in totally different places on the sheet of paper. It's not a fingerprint it's taking its minutiae marks of unique in comparison to what it already holds to generate an individual code on that occasion, do it again and it's different every single time.

Reply

[-]

Wolifr@reddit

Explain this one to me, in the dinner hall they can put a fingerprint in and match it to a student, but you're saying it wouldn't be possible to take a fingerprint and match it to a student outside of that setting?

Reply

[-]

Houseofsun5@reddit

That's possible for anyone who has enrolled or not, the police do that. Take fingerprints and then try and match them to a suspect in a database of proper official actual fingerprints. I don't really understand the question your asking , the data the dinner hall has isn't any use for doing that with though, it's got a binary code thats equivalent to a few full stop sized dots on a sheet of A4 paper, nowhere near to being an image.

Reply

[-]

Wolifr@reddit

The point is this; you cannot change your fingerprints, if as a child your fingerprint is taken, turned into 20 dots, those dots are linked to your name, then that database containing the dots and your name get leaked onto the Internet, then for your entire life anywhere you go someone would be able to take your fingerprints and match them to your name. All because you got school dinners. It's not about "recreating the fingerprint" that's meaningless. It's the concern that the data doesn't get stored correctly and once it's leaked it's public forever and anyone in perpetuity could take a fingerprint from any door handle in the world and then match it to your 20 dots and say "Houseofsun5 was here"

Reply

[-]

Houseofsun5@reddit

How in the most imaginative CSI Miami way possible would you match 20 dots to an individuals fingerprint??? Because even with the most elaborate Tony Stark iron man levels of ridiculous I can't imagine how it would be possible!! Bearing in mind first you have to work out how that binary code relates to positioning, that if you did it again with the same finger it would be totally randomly different?

Reply

[-]

Wolifr@reddit

I don't understand how to explain this any differently? You're saying that in the dinner hall they first register a students fingerprint and then turn it into 20 dots and store it. Then each time the child goes to the dinner hall they take their fingerprints and turn it into 20 dots and compare it to all the other 20 dots to match it. What's to stop someone doing that outside of the dinner hall?

Reply

[-]

Houseofsun5@reddit

No they store a binary code, that's a code for a lock to a lunch that was generated by a scan of 20 points of unique microscopic minutiae from a fingerprint. But they don't match in a way that would make matching it outside that system possible. You could get all the binary code, let's say you do somehow manage to back engineer it to 20 dots, you print all those dots of all those fingers onto stack and stacks of A4 paper, you then got a copy of every single child's fingerprint. So there you are with a pile of paper with little dots on each sheet , and all the kids finger prints Infront of you, you have the absolute best advantage here, you know those kids used that system, you know each one of those sheets of dots has a corresponding kids print in the pile of print photos. Let's make it even better, the dots, the size of a full stop. [ . ] are on clear plastic and bright fluorescent red , the prints are on paper in black so they stand out to the red dots , you overlay each clear sheet of dots over a child's finger photos and try and find a match...the only ones at the end that are correct you only got by blind fluke and luck because what you would think is a unique feature,.the scanner ignored that and picked up the gap between a line on this side of the finger, and another line on the other side of the finger...but it's also a perfect match for 200 of the other kids lines ...just different lines ...but you don't know that only the scanner knows that, and you can't ask it to do it again, because if you scanned all those kids fingers again, the binary codes would all be different and the dots would all be different too as it decides it likes a different unique minutiae instead this time.

Reply

[-]

Wolifr@reddit

I feel like either you or I are missing some crucial piece of information here. What you are saying is that the "system" can match a fingerprint to a child. (It's definitely matching to a child in some way even if it's by a foreign key in the rdbms) What I am saying is that if the system can do it, so could a malicious actor with access to all the information from within that system. The method of capturing, storing or matching the biometric data is irrelevant. The system can take a fingerprint and say "this fingerprint belongs to this child". Sure, for now let's say it's all encrypted and secure and no one has access. Except schools are not famed for their information security. They hire CISOs and don't spend millions of pounds making sure that they're up to date in their protection of all their data. All it takes is a member of staff to fall for a Phishing scam or reuse a password and before you know it that data is out in the wild. That includes all the encryption keys associated with with the system. Or, chances are, they're probably using some commercial off the shelf hardware and software to do this that literally anyone can buy online and reverse engineer.

Reply

[-]

Houseofsun5@reddit

Yeah, but it's still worthless for identifying anyones fingerprint, as there is no fingerprint there, or it's so incomplete it's no use to anything outside the closed system, it's like trying to identify a single pine tree from a single pine needle in a forest of pine trees and a massive pile of needles.

Reply

[-]

Wolifr@reddit

But you can identify which tree it comes from! That's what the system is doing! You feed in a fingerprint and it spits out a child's name and then looks up whether they get lunch or not.

Reply

[-]

Houseofsun5@reddit

Your not feeding in a fingerprint, your feeding in a miniscule minutiea of a fingerprint, a partial fingerprint 0.1% of a fingerprint that generated a binary code, and you don't know which 0.1% of that fingerprint it used.

Reply

[-]

Wolifr@reddit

When the child places their finger on the scanner they are feeding it an entire fingerprint. I understand that the whole fingerprint is not stored, but it takes the picture of the fingerprint from the scanner and compares it to the 20 dots. That means if the 20 dots got out, you could take a picture of the fingerprint and compare it to the collection of 20 dots and get a name. Imagind it like this, instead of a fingerprint it's a facial recognition system. The system does not store an image of the face, it just stores the ratio of distances between the eyes, nose, mouth, chin etc. It's just storing numbers right? No big deal? You can't recreate a face from just numbers. But what you can do, is show that system a face, a picture you found online of someone you don't know who it is and say "calculate The ratios distances between the facial features of this face and compare it to your database of known ratios. If you go to haveibeenpwned.com and type in your email address, how many times has it been leaked? How many of your passwords are now public information? Do you really want the 20 dots that are unique to you and something you cannot change to end up in the public domain because your school wanted to save 30 seconds per child at lunch time?

Reply

[-]

Houseofsun5@reddit

Yeah, but they only scanner that will recognise it is in a school in Surrey and it was thrown out 20 years ago. Unless you go to the ridiculously lengthy and expensive process I said in another reply ...and for what end? The expenses a time would make anyone but something the child of Bill Gates worthless, and I suspect they don't get their lunch using a fingerprint scanner. Honestly if someone is going to go to that length of Tony Stark ridiculous...they can just steal my Costa cup after I throw it in a bin and skip that entire thing!

Reply

[-]

Wolifr@reddit

Why do you think it requires that specific scanner? It doesn't, you can use any available scanner, even a picture. It's a software algorithm that matches the image from the scanner to the dots in the database, not the hardware itself. If that scanner breaks they don't have to re-register everyone's fingerprints, they just buy a new scanner.

Reply

[-]

Houseofsun5@reddit

There are various different types of scanner that scan in different ways, but yes okay you could have the database, but what are you matching it to, what's the point in sitting for years obtaining any leaked fingerprint data hoping one day that fingerprint you lifted from a door handle shows up? What it the fuck is the point of wasting what could be an entire lifetime trying to find out someones name, names are as public information as it gets ?

Reply

[-]

Wolifr@reddit

What lifetime? A malicious actor just download a copy of the biometric data as and when it gets leaked to the Internet and add it to your ever expanding database of biometric data. Next, the fingerprints everyone leaves on everything that touch go from being a completely anonymous fingerprint to "Oh this fingerprint I took off a door handle belongs to 'Houseofsun5' which I know because of that match against the leak of all the school biometric data". Now they have your fingerprint and know it's yours. I'm not suggesting that this is 100% definitely going to lead to a bad outcome. All I am saying is that the defense of "it doesn't store a picture of the fingerprint" does not eliminate all risk associated with it.

Reply

[-]

Houseofsun5@reddit

Yeah, but who is going to go around gathering random fingerprints from doors, gathering the I suppose billions of them you would need and you only have a slim chance of even getting the actual used logged finger, and an even slimmer chance they went to a school with fingerprint scan lunch permits. The odds of getting a match are lottery numbers and would require enormous resources, just gathering and logging billions of fingerprints for a start!! Working alone it's lifetimes of work

Reply

[-]

Wolifr@reddit

It's lottery numbers unless every school in the UK adopts the system. Then every gym. Then supermarkets. Then your workplace. And then the market for fingerprint readers is captured by 2-3 vendors who store the information on a central server then one of the vendors database gets breached. Then depending on how many years the system was in place you potentially have a sizeable chunk of the UK. The convenience, risk and cost of the system is disproportionate to just RFID cards or wristbands and spot checks for fraudulent use.

Reply

[-]

Houseofsun5@reddit

You still have to manually retrieve a fingerprint though, and then have a mission impossible style montage of making that fingerprint into a medium the scanner can read. It's just completely impractical in comparison to any other way of getting a fingerprint and a name. Be a taxi driver, have a card machine that conveniently always requires a pin number and has a skimmer, so you have name and card details and then take the finger print from the scanner you handed to the passenger, you have removed all the problems of making millions of fake fingers , didn't have to be involved with a massive online data breech, or sit there day after day pressing fake fingers against a scanner hoping you made them well enough you get the correct results back... the scanners they use right now, I wouldn't fancy your chances much, even when presented with the original human it can take them a few tries to recognise it.

Reply

[-]

Wolifr@reddit

No, you don't need to convert it to a medium the scanner understands. You don't need the scanner at all. You just compare a picture of the fingerprint to the dots. All the scanner is doing is taking a picture.

Reply

[-]

Houseofsun5@reddit

So someone is going to sit there and manually shuffle through? How do you know what scale to make the photos? Actual size? What do the dots corresponding with, distance between two points or individual features, which feature is the scanner using and which did it ignore, which way up are the dots?..... there for the rest of your life with loop in one eye with one photo going through billions of dots looking for a single match ?? Lol nobody is ever going to be doing this lol

Reply

[-]

Wolifr@reddit

Dude, you get the software to do it. You think fingerprint readers don't do this already?

Reply

[-]

Houseofsun5@reddit

Yeah I think your imagination of Tony Stark type stuff is taking over again, this is some super computer stuff, it's going to need to know what each individual scanner ignored and what it used, the orientation,.the scale, which scanning style it uses , whether it features, measurements or combination of both, even the AI currently sometimes can't even get the right amount of limbs on a human and there is only 4 of those,.there are millions of different possibilities in a single fingerprint and millions of ways the dots line up if you can even get the binary to back engineer to the dots....it's just not gonna work dude lol

Reply

[-]

Wolifr@reddit

You clearly don't know how fingerprint recognition works. S'OK though you go ahead and put it your biometric data anywhere you like.

Reply

[-]

Houseofsun5@reddit

I suppose you could if you really really wanted to and money was no object. Get a fingerprint from a door handle, make a false finger up, buy all the different types of scanner available or have custom engineered one that accepts all the data and scans in all the different methods , wait on data breeches over the years, upload the data to the scanner and touch the fake finger on the scanner and maybe with euromilliions sized odds one day you might strike lucky and find out the name of who touched that door handle, what that would gain you I am not sure, but I suppose it's possible.

Reply

[-]

Houseofsun5@reddit

You gotta be trolling here lol Your gonna get my finger print from a door handle, and then go online, find leaked finger scanner binary code, figure out how to reverse engineer that particular scanners binary code generator, generate every minutiae points scan it took into images of 20 full stops spread across let's say an A4 sheet of paper....and get that to somehow match a physical copy of a fingerprint....fuck of you trolling cunt lol.

Reply

[-]

FEMXIII@reddit

It doesn’t matter for GDPR if it is an actual fingerprint or a signature to recognise a finger print, both amount to the same thing, which is data to identify a person (PII)

Reply

[-]

exposuure@reddit

It’s still biometric data and is PII. It doesn’t matter if it’s the actual fingerprint or not, the problem here is around a parent not consenting to this PII data being processed by the school. Your argument applies to a password as well. A system will not actually store the “password”, but it will probably store a hashed and salted version of the password.

Reply

[-]

Houseofsun5@reddit

I wasn't really phrasing it as an argument, just information that the term "fingerprint" is misleading, the legal ins and outs I don't know about, I am not a lawyer, I have zero legal qualifications so I was making no arguments on its legality, just the terminology being a bit misleading.

Reply

[-]

FluffiestF0x@reddit

The fact they specifically refused this though and the school ignored it

Reply

[-]

terryjuicelawson@reddit

Good, why should a parent override the school's perfectly workable system based on what probably boils down to a conspiracy theory. It doesn't even "take a fingerprint" as such, the image isn't stored anywhere in an identifiable way, they aren't going to use it to work out who graffitid the toilet or anything. It is just a code that can find their info so they can get a school dinner.

Reply

[-]

FluffiestF0x@reddit

Because they have the option of using a pin instead, they had these when I was at school a decade ago. There’s absolutely no reason not to cater to the wishes of the parent

Reply

[-]

HarryPopperSC@reddit

The school doesn't want anyone to have this because the fingerprint saves time, stops bullying and is all around an improvement with 0 downsides. Every school has parents who are stupid or awkward just for the sake of it. Which is why the dinnerlady has done it. The kid is probably happy he has the same setup as all his friends and his crazy mum is doing his head in. Lol

Reply

[-]

CareerMilk@reddit

> It makes her life easier I’m fairly sure you don’t just get to ignore laws because it makes your life easier.

Reply

[-]

HarryPopperSC@reddit

Not saying you do.. But it's such a non issue. Everybody will feel sorry for the child to have to deal with such a parent. Let me guess they also post public photos of everything their kid is doing at any time allover Facebook? But are so worried about privacy... Then spend their day discussing how 5g is brainwashing the kids in their facebook group. All In between games of bejeweled ofcourse. Fuck. Me. So glad I don't work in a school fuck that.

Reply

[-]

_Red_Knight_@reddit

Why do you believe that anyone who doesn't want to use biometric authorisation to pay for things is some kind of conspiracy theorist? It's just a preference, like preferring to use cash over cards, or chip and pin over contactless.

Reply

[-]

CareerMilk@reddit

Just because most people are hypocrites doesn’t mean everyone is.

Reply

[-]

Fit_Implement3069@reddit

There is so much wrong with using biometrics for payment, especially fingerprints... more than the taking the "hash" of the fingerprint.

Reply

[-]

The-Father-Time@reddit

Why are you making stuff up to get mad at?

Reply

[-]

PixelBrother@reddit

You just made this all up in your head the. Got real mad about it. You ok there?

Reply

[-]

spik0rwill@reddit

You cant forgrt a

Reply

[-]

terryjuicelawson@reddit

They get too involved these days, what other whim are they going to cater to next.

Reply

[-]

FluffiestF0x@reddit

It’s not a whim. Why do you care if a child uses a fingerprint or a code?

Reply

[-]

terryjuicelawson@reddit

Why does the parent? Breaking down what likely happened is that the kid needed lunch, this is the system they had, dinner lady took their fingerprint like they did everyone else, and don't check at every stage in the day if a parent kicks up a fuss. If they care that much have a word and see if they can make it a PIN instead, no need to get all "is it legal" on the internet about it.

Reply

[-]

FluffiestF0x@reddit

Im not getting all ‘is it legal’ im getting all ‘its fucking disrespectful’

Reply

[-]

Old_Photograph_976@reddit

Yes not trusting an institution to properly handle our data is very crazy because data breaches never happen. Every institution has perfect security and will always maintain this perfect security. Data breaches are not a thing that happens constantly. There aren't websites to show how many data breaches they are due to how often they happen

Reply

[-]

terryjuicelawson@reddit

What data? Having a PIN or a balance or the name on a register is "data" too, what is so special about a fingerprint (as I said, it isn't even stored as an image) being used as a login.

Reply

[-]

crucible@reddit

No, one employee ignored it. If OP complains I expect the dinner lady will be spoken to and reminded about the importance of GDPR, and their child’s “fingerprint” will be deleted. Choosing to issue a card over taking a print is a higher level decision from, say, the Business Manager. Not the till staff’s decision to make on the spot.

Reply

[-]

FluffiestF0x@reddit

These systems only work if you already have money in the account. There’s no reason a dinner lady would have registered their fingerprint on the spot

Reply

[-]

crucible@reddit

Yes, and that’s on her. That said ours get arsey when they have to look peoples names up at times. I can see both sides of it here.

Reply

[-]

Houseofsun5@reddit

Yeah, I am not a lawyer so I will stay clear of commenting on that as I don't know enough to make qualified informed advice.

Reply

[-]

BuildingArmor@reddit

Is that not a description of how almost all fingerprint biometric identity systems work? That seems exactly what people would have in mind when you said it uses their fingerprint.

Reply

[-]

callisstaa@reddit

A lot of people assume that it means their fingerprints will be stored in a permanently accessible record

Reply

[-]

BuildingArmor@reddit

Nothing about this suggests they aren't. Can their admin staff just view the records? I dunno, maybe, maybe not. Are their systems sufficiently protected against cyber attack? Maybe, maybe not.

Reply

[-]

callisstaa@reddit

They don't store actual fingerprints anywhere that uses biometrics. The just use your fingerprint to create a signature that is saved to a database and when you scan your finger it corresponds to that signature. There are no actual fingerprints stored at all.

Reply

[-]

BuildingArmor@reddit

Yeah, as I said in my previous comment, that's how almost all of them work, that's what people think is happening.

Reply

[-]

Houseofsun5@reddit

They already have the child's address,.parents names, maybe grandparents or other responsible emergency contacts, maybe some rudimental medical information if required in particular cases. They will likely have at least one parents place of work address and phone number too. There will be banking information anywhere that uses online debits for dinners or paying for school trips etc. I would be far more worried about that being stolen, than the rudimentary code extract from a finger used to unlock a school dinner, which is useless for anything else.

Reply

[-]

BuildingArmor@reddit

The school might, but this random third party doesn't until they're given it.

Reply

[-]

The_Blip@reddit

And even if they are now, that can change. Maybe a new member of school management staff decides to come along and make everyone that knows about ensuring the system is secure redundant. Maybe the system gets quietly replaced with a cheap chinese knockoff that stores the data in some discount cloud service. I'm sure the vast majority of these systems are secure and working properly. I don't they cannot be set up incorrectly. I also don't trust school administrators to know what they're doing with such systems.

Reply

[-]

-kAShMiRi-@reddit

Yes and no. Governments collect full fingerprint images. Note how different are the fingerprint readers at airports or passport offices from the readers on phones and entry systems.

Reply

[-]

Houseofsun5@reddit

No, they assume it's like in James Bond or some crime program.

Reply

[-]

MrStu56@reddit

But presumably that uniquely identifies your employees? And if it does that I'd say it's a biometric.

Reply

[-]

Interest-Desk@reddit

It’s considered a biometric under data protection law. But you couldn’t take the data and make someone’s exact fingerprint out of it. These systems also usually have the bare minimum security control of hashing, meaning you can only see the data if you have the data (but not see the data arbitrarily).

Reply

[-]

whooptheretis@reddit

But the hash can be used to verify the identity of an input fingerprint, right? Not wanting identifiable data to be stored is everyone's right.

Reply

[-]

Houseofsun5@reddit

Yes but as far as I am aware only in that particular system, say you left the job, and rejoined, now say they didn't delete your "fingerprint" and you used the same finger as last time to set up your new payroll, it wouldn't be the same as the last time, the "fingerprint" would be different although from the same finger, so is level of "identifiable" is very very limited.

Reply

[-]

mansAwasteman@reddit

“We use a similar system at work for hourly employees to clock in and clock out”. Herein lies the true concern for a lot of people. These systems aren’t all set up in complete isolation, and there are a finite number of manufacturers of this technology. You supply your biometrics for your lunch as a child but that information may be used years later on a different system. We’ve had decades of instances of data breaches, data collation and data misuse, all stemming from innocent and convenient supply of our information. True, it’s not always ‘identifying’ details, but people out there can and do pay for all sorts of metadata. Things like the Cambridge Analytica scandal have shown us just how valuable our data is to these businesses in ways that most people probably wouldn’t think of or understand

Reply

[-]

Glass-Ad8277@reddit

Fingerprinting is the wrong move for schools! My system would be to bring back the cards, with a removable barcode/QR code (removed and kept at home or in school office when first obtained for backup.) Money would be put on by parents though a payment system online. Making it cashless for the school and in the event the card is lost or damaged a replacement could be ordered online (By parents.) through the same website and in the meantime the barcode/QR is used whilst waiting for a new one to arrive. Fingerprints should be used by law enforcement for dumbass criminals and themselves and for security in areas that need it such as government offices.

Reply

[-]

okkwolfendale@reddit

Think about this logically, the dinner lady set up a finger print account? Probably lying to not get told off by a sceptical mum because he wants to have it.

Reply

[-]

AnxiousAppointment70@reddit

The school I work in has a swipe photo ID card that opens doors and is used on a reader on the way into the dining hall. It may be slightly outdated now but we don't have problems. There's no incentive to steal lunches because they're compulsory, everyone has them included in the school fees. Ah, the joys of independent schools.

Reply

[-]

IansGotNothingLeft@reddit

Finger prints come under biometrics within GDPR and permission must be given. They need a legal reason to take it without permission. I'm not a lawyer, so I don't know what the legal reasons are, but I imagine it's not school dinners.

Reply

[-]

Spicymargx@reddit

Not strictly true, children under 13 can give consent to lots of things. What they can’t consent to is sexual activity. Beyond that it comes down to competence.

Reply

[-]

IansGotNothingLeft@reddit

We are talking specifically about personal data here.

Reply

[-]

Spicymargx@reddit

I am not aware of a legislation that specifies at what age a child can give consent re personal data. Happy to be corrected.

Reply

[-]

IansGotNothingLeft@reddit

No you're right, I was corrected in another comment. It's just what we do at work and I assumed that it was legislation. But I just didn't want you thinking I was making a blanket statement about kid's consent for _anything_.

Reply

[-]

newfor2023@reddit

I'm now going to be checking with my kid as they tried this at another school with the older ones then the school seemed appaled that I said no. Seems they assumed everyone would just say yes.

Reply

[-]

Moleynator@reddit

May I ask why you said no? I don't see a downside to this, other than making it more difficult for your own child.

Reply

[-]

The_Blip@reddit

Distrust in school administration to be able to correctly select a secure system, to securely maintain a database, and to act appropriately in the event of an error.

Reply

[-]

Ok-Albatross-1508@reddit

But you do trust them to adequately maintain food hygiene, deal with a range of potentially deadly allergies and also appropriately vet and hire staff who will be talking to your child without you present?

Reply

[-]

The_Blip@reddit

The things you listed are regulated, enforced, and require training. Food hygiene standards and training is regulated and examined. Failure to adhere to allergen standards can lead to a lawsuit. Staff vetting and hiring requires a DBS check and is legislated by the Education and Training (Welfare of Children) Act. Database security is legislated through GDPR and is enforced by the ICO who are, quite frankly, a joke. They don't have the resources to properly enforce the vast majority of cases, let alone do any sort of investigation. The legislation doesn't provide any sort of assurance of competency or vetting.

Reply

[-]

Possiblyreef@reddit

You do realise they don't store actual finger prints though right? Like it's not like they have a jpg of a finger and it's laid over the top like acetate to match it up. They just store arbitrary data points on random distances of certain things. You can't recreate a finger print from the data stored about one

Reply

[-]

whooptheretis@reddit

A pin isn't stored either, but when you generate the correct pin, the check matches you get authorised. It's still a biometric that's stored in an insecure system. We should all be concerned about this.

Reply

[-]

crucible@reddit

Please define “insecure”. We have the catering system on a separate VLAN and its own servers. Outside of the tills maybe 3 PCs can remote in to it. We have to trust the vendors like Biostore, sure, but often as IT staff it’s the school’s management who buy into these systems in the first place. So we do our best to secure them. And as has been said the “fingerprint” is a hash of ~5 points on a finger anyway. I can’t restore that for you - it’s stored in Biostore in a method *only they know*.

Reply

[-]

whooptheretis@reddit

> Please define “insecure”. Is it connected to the internet?

Reply

[-]

paulstheory@reddit

Is everything connected to the Internet insecure?

Reply

[-]

Saulrubinek@reddit

Yes it is

Reply

[-]

crucible@reddit

No

Reply

[-]

The_Blip@reddit

I think you're awfully sure about the technological capabilities of a system you haven't seen and also don't even know the name of. I understand that what you're describing is how major companies will do it, and it is likely that OP's school is using a secure method, but to say it as a matter of fact is simply speaking about things you cannot know about without all the information. Are you saying that hardware that id capable of capturing enough points to map a finger print don't exist? Or that the particular model that OP's school use is unlikely to have that hardware capability? Or are you saying that the software is unlikely to be designed to be able to do that? A system wouldn't need to have an entire fingerprint mapped out for it to potentially cause issues. They'd just need enough datapoints to be able to replicate what other biometric data requires. If ALL biometric fingerprinting uses ONLY a certain subset of datapoints, then a leak of said datapoints could compromise ALL applications that require those datapoints. My point isn't that the system is flawed. It's that the belief that the technology is incapable of being abused or misused is wrong. And that school administrators aren't necessarily the people to entrust to correctly ensure that such a system is set up correctly and maintained correctly, so as not to cause security issues.

Reply

[-]

Possiblyreef@reddit

I have a degree in digital forensics and information assurance and my day job is military satcom with high grade cryptography. So whilst you're correct that I don't know this specific system, I'm probably more qualified than 99% of people to answer the question on what data can be used from systems designed to encrypt data and what that unencrypted data can be used for Also all of your "gotcha" points are equally applicable to reddit or pretty much any website or database

Reply

[-]

The_Blip@reddit

Well that's great for you, but OP's local school is unlikely to have military grade satcom systems or employ those with degrees in digital forensics and information assurance. It's run by people who can't even correctly administer a permission slip. Being able to answer questions on what data can be used from systems designed to encrypt data is pretty meaningless is the system either isn't designed to encrypt data or is designed poorly to do so. While I'm sure you are highly qualified to discern the difference between such systems, I'm quite certain you don't work in OP's school. I'm quite confident that you don't work in any school at all, nor is anyone with your qualifications. My issue isn't with the systems that are designed correctly and implemented by qualified individuals. My issue is with systems that aren't designed correctly, or even designed maliciously, and implemented by unqualified individuals. You didn't even answer my questions, which is swell. They're not even 'gotcha' points, they're simply questions. Can a biometric fingerprint scanner collect data that may be harmful, and is it possible that people who do not understand the technology could incorrectly select and implement such a flawed system? The reddit point is irrelevant. They don't have my biometric data. They have a username and a password. Neither of those can be used to access my bank.

Reply

[-]

uchman365@reddit

>They have a username and a password. Neither of those can be used to access my bank. Neither can the biometrics they capture on the schools system be used to access your bank account because every system (your phone, passport system etc) captures different random data points of your fingerprint NOT the full print

Reply

[-]

The_Blip@reddit

So that's what I'm asking; is the hardware INCAPABLE of capturing data across an entire finger print?

Reply

[-]

The_Blip@reddit

So that's what I'm asking; is the hardware INCAPABLE of capturing data across an entire finger print?

Reply

[-]

OdinForce22@reddit

Tin foil hat, innit.

Reply

[-]

TheReverend403@reddit

"Only crazy people care about privacy!" This attitude is what leads to things like Cambridge Analytica using people's data to influence their votes.

Reply

[-]

NYX_T_RYX@reddit

Went to IKEA at the weekend, the staff on the checkout didn't understand why I wouldn't register an account for a £10 discount 🙄 If you want my data, you're gonna have to give me something of equal value - you're gonna use it to try and sell me shit, so I'm gonna get my money's worth. Short version - I agree, people need to take more thought before just giving out data.

Reply

[-]

Moleynator@reddit

Everyone cares about privacy to some extent. I think they were just saying that in this instance it seems insignificant. I still haven’t seen anyone clarify how this data could be used nefariously, but happy to be told otherwise!

Reply

[-]

ACatGod@reddit

I think the fact school staff are behaving this way is proof enough you should be concerned about what data you share with them and the processes they have in place for securing it. And yes, I know multiple people have commented that the software solutions used by schools are extremely secure, but technical solutions to privacy are useless when idiots run the system.

Reply

[-]

MslTr3kz@reddit

I think it is unfair to assume the dinner lady is doing it out of malice. She might have thought it would be easier for the child to get their dinner in future and thought she was doing a good thing. They probably aren't aware of all the rules around gdpr and won't have known that op refused it initially. I think if op requests the deletion of the information and the staff are informed that it is not to be offered to their child in future it solves all issues

Reply

[-]

ACatGod@reddit

>I think it is unfair to assume the dinner lady is doing it out of malice. I never said she did it out of malice. I said she did it out of idiocy. That's the problem. All the technical solutions in the world can't protect a system against users who don't know the rules and processes. There is a reason why GDPR talks about technological AND organisational measures. Because anyone who knows about this stuff, knows that technological measures are useless when organisations do not train staff and put policies in place to ensure appropriate data handling. The dinner lady breached GDPR because she didn't know what she was going and that means the system is not secure.

Reply

[-]

MslTr3kz@reddit

I wasn't suggesting you personally believed it was. But what I was saying was that the dinner lady is not trained and is not privy to the wishes of every individual parentso she didn't do what she did as an act of defiance against the parent or system She thought she was helping the child and didn't know about the parents wishes. GDPR also doesn't prevent info being collected it just protects it to make sure it is not used incorrectly. She didn't breach GDPR because she wasn't handing this information out to anyone and everyone. If it comes to light that the dinner lady was using this information to pay for other people's dinners then that is a different story but at the moment all it takes is for op to request the data be deleted

Reply

[-]

ACatGod@reddit

Huh? You literally said it's unfair of me to assume it was malicious, so yeah you did say that. >But what I was saying was that the dinner lady is not trained and is not privy to the wishes of every individual parentso she didn't do what she did as an act of defiance Again. That is not what I was saying. Why are you just saying random things in response to what I wrote? >GDPR also doesn't prevent info being collected Again, I did not say this either. >it just protects it to make sure it is not used incorrectly Yes which is why the dinner lady and all school staff need to be trained >She didn't breach GDPR because she wasn't handing this information out to anyone and everyone. This is a fundamental misunderstanding of GDPR. She did breach GDPR because she processed personal data without a lawful basis - collection is processing. >f it comes to light that the dinner lady was using this information to pay for other people's dinners then that is a different story Well that does potentially take it into additional criminal territories, but the school has still breached GDPR regardless. > but at the moment all it takes is for op to request the data be deleted And the school to appropriately train their staff on data protection. In the event of a data protection breach the organisation is required to show what measures they have taken to prevent a further breach.

Reply

[-]

Spicymargx@reddit

What makes you assume idiots run the system? Schools either buy in an external, independent IT service or recruit a qualified technician. There is specific legislation regarding the level of security, filtering and monitoring required. School staff don’t care about having access to your child’s fingerprint, it’s just convenient for them. That said, you can absolutely refuse consent and if your child is not at the age or stage of development to consent themselves they should not pursue this further.

Reply

[-]

ACatGod@reddit

Read the post. The dinner ladies made the child sign up in violation of the process. Every user of the system has to be au fait. This is classic technocracy. Have a few technical people who understand the system and believe that having technical safeguards and a few technical experts will make your system infallible. Meanwhile the lowest educated users break the system and cause data breaches.

Reply

[-]

Spicymargx@reddit

The dinner ladies do not run the IT systems in the school.

Reply

[-]

ACatGod@reddit

But they are a user who just breached GDPR. Your attitude is how so many companies end up with GDPR breaches. You cannot do proper data security and data protection if you simply rely on software and someone competent in the IT department. Every single person with operational access to the system - regardless of their technical competence needs to be properly educated on data protection. That's the organisational part of the technical *and* organisational measures GDPR requires, because legislators understood, as so many don't, that technological solutions aren't the solution to data protection. You want to know who breaches health data the most? GP receptionists. The NHS has extremely complex and tested technical solutions for storing our data safely. It's receptionists and ancillary staff that cause the most breaches. Human beings are the cause of data breaches.

Reply

[-]

Such_Geologist_6312@reddit

Let’s say something goes missing in the school. There’s nothing to stop a science tech from taking fingerprints from the ‘crime scene’ and using them on the fingerprint scanner to try and ascertain who had taken the items. The system probably wouldn’t be advanced enough to do it, but it wouldn’t stop them trying to use whatever identity it spit out and target them. There’s not one teacher in any school I’ve attended that I would trust to have access to this data. Furthermore police could use the same. Suspect a child in the school of a crime, and use the scanner to confirm it. We had the police come to our school as kids and take all our fingerprints when we where like 11. Seem to have a bit of an obsession with it when there isn’t even IT necessity.

Reply

[-]

jon81uk@reddit

The “finger print” data that links to a dinner payment record will not be sufficient information for forensics

Reply

[-]

RexWolf18@reddit

God forbid police…. use forensic science to solve crimes?

Reply

[-]

jim_cap@reddit

It always seems insignificant in isolation. Truth is, no one bit of data is generally enough to do anything useful with, but they can add up to something if a bad actor collects enough of them.

Reply

[-]

Small_Promotion2525@reddit

Algorithms convince people to do everything

Reply

[-]

TheReverend403@reddit

Using the data people so willingly and easily give up, yes.

Reply

[-]

Small_Promotion2525@reddit

Why is that some massive problem? It’s very easy to understand what and how algorithms work. They help more than they hinder.

Reply

[-]

TheReverend403@reddit

Yeah I'm sure youtube and tiktok algorithms gradually pushing people down the far-right rabbit hole are a huge benefit to society.

Reply

[-]

Small_Promotion2525@reddit

As can be seen for the left as well. Are you opposed to people having different political options?

Reply

[-]

TheReverend403@reddit

Youtube doesn't recommend me left wing videos after watching a Slayer live show mate. It recommends me "WOKE COMMIE DESTROYED BY BEN SHAPIRO". If you have evidence that youtube leads people to far-left echo chambers on the same scale as far-right content, I'd love to see it.

Reply

[-]

Small_Promotion2525@reddit

The proof is algorithms.

Reply

[-]

TheReverend403@reddit

So in other words, you have none. Cool.

Reply

[-]

Small_Promotion2525@reddit

That’s how algorithms work, are you now denying algorithms on YouTube and that they just show you what they want you to see?

Reply

[-]

TheReverend403@reddit

Still no proof, just "trust me bro it's The Algorithm™"

Reply

[-]

Small_Promotion2525@reddit

So now you say I need proof but you’re trying to say that YouTube is purposely pushing right wing propaganda ?

Reply

[-]

TheReverend403@reddit

Please quote where I said it was on purpose.

Reply

[-]

Small_Promotion2525@reddit

Have I read it wrong? I thought you said YouTube kept showing you far right videos, by how algorithms work, unless you have searched about them or the counter to them, you wouldn’t be shown them unless it’s on purpose by YouTube.

Reply

[-]

ACatGod@reddit

That was because Facebook not only allowed companies to download huge amounts of user data, Facebook took a very bizarre stance to consent and took the view that users' connections had also consented just by dint of being a connection. It meant that even those who were quite cautious, were still caught up in the whole thing. That all said, you are correct. There is absolutely nothing stupid about being cautious about what data you put out there. The fact the school staff are taking such a lax approach to consent, lawful basis and privacy is proof enough that caution is warranted. I work in a sector founded on big data, safe and trustworthy data collection and sharing is essential, but it also makes me much more cautious about systems that promise technical solutions to privacy but are operated by idiots - like we apparently have here.

Reply

[-]

ToastedCrumpet@reddit

If schools just put on an assembly explaining what was happening and why, and bit of an overview of GDPR and data encryption, promised it was deleted once they leave etc and didn’t same for parents there’d be a lot less complaints. Most of these parents complaining no doubt use biometrics on their phone daily

Reply

[-]

IansGotNothingLeft@reddit

Eh, I don't agree. I mean, my daughter has her biometrics stored and we're fine with it. But I can see why others aren't so up for it. It's an early age to have your finger print stored on a database which could be subject to an attack. What could they do with it? No idea, possibly not much? But I can still see why it might make people uneasy.

Reply

[-]

AwhMan@reddit

With all the data breaches constantly happening is it really a tin foil hat moment?

Reply

[-]

gundog48@reddit

Honestly, because they didn't ask, and they should have, that's enough to not want to participate in a system that only benefits them. On a practical level, by not asking, they've already shown that they do not handle data correctly, do not understand their responsibilities, and therefore shouldn't be trusted with such sensitive data. Biometrics are more sensitive than even bank/card details, they are used for a lot, and changing them is much more challenging!

Reply

[-]

Moleynator@reddit

I took from their comment that they were asked and said no?

Reply

[-]

gundog48@reddit

You're right, my response is more relevant to the question 'why would you continue to say no?' instead!

Reply

[-]

What15Happening@reddit

Everything is private and protected until whoever is in power decides it’s not…

Reply

[-]

EliteCakeMan@reddit

My gym uses fingerprints and I refused. The data collection isn't always encrypted as I'm a computer specialist with over a decade in the security industry. If the bit between the fingerprint scanner and the computer or devices gets compromised then it's useless as the data is stolen before it's encrypted. Also I don't trust a gym, or dinner ladies with access keys which could gain access to my biometric data. They gave me a pin number instead and were very happy to understand. Most fingerprint systems are inherently very insecure but most don't actually take accurate biometric data so there is that too.

Reply

[-]

Moleynator@reddit

Glad to have an expert reply! I can understand someone in your position taking things like this more seriously than most. As you say, the fingerprint scanner isn’t likely to be taking accurate biometrics. I understand that it is more likely to just be referencing a couple of points rather than the whole fingerprint? What I don’t understand is the downside, even if someone gets hold of this data? Like what is a dinner lady going to do with a couple of data points from an 11 year old’s fingerprint?

Reply

[-]

Such_Geologist_6312@reddit

The dinner lady can’t, but a school rep or police could very well use the machine for fingerprints of kids that they suspect of a crime. If they’re unlucky enough the data points line up, then they end up getting disciplined by the school for something they didn’t do. There isn’t one legitimate institution who I would trust to have the intelligence not to try something like that.

Reply

[-]

bobble173@reddit

It's illegal to do this. They can only use the fingerprint for the purpose for which it was originally obtained due to data protection law. This is from the gov website biometrics guidance. So the police would not do this and the school would be in a lot of trouble if they tried it.

Reply

[-]

Ch0col4a73_0r4ng3@reddit

The system should only be storing a hash of the biometric reading, the same way your computer password isn't stored as a password. The biometric reader is no different to a keyboard. The fact you press 10 keys for your password isn't remembered by the keyboard. Neither are the data points for the fingerprint. In both cases the input is hashed and compared to the stored hash. A hash is a one-way function and there is no algorithm that can reconstituite the original entry from the hash. This is why passwords have to be brute forced, guessing them one at a time, hashing them and then seeing if the hash matches the one on the system.

Reply

[-]

Moleynator@reddit

I’d hazard a guess that the school system is only using hashed data anyway, but the previous comment was talking about the scanner being compromised for some reason. I’m only really asking what the purpose of taking this data would even be. I can’t see any use for it?

Reply

[-]

Ch0col4a73_0r4ng3@reddit

Apologies, my reply was to > Like what is a dinner lady going to do with a couple of data points from an 11 year old’s fingerprint? As they won't actually have this information.

Reply

[-]

Ch0col4a73_0r4ng3@reddit

> I'm a computer specialist with over a decade in the security industry. Did they store the hash or the raw data? If the former, it doesn't need to be encrypted and it isn't an issue if it's compromised. If the latter, they're incompetent.

Reply

[-]

EliteCakeMan@reddit

Depends at which part of the software/hardware is insecure, I don't have the specific system to hand. It's not like android/iPhone devices which have requirements that keep them secured and can be used for banking or other uses. Hashes are still useful to hackers.

Reply

[-]

Ch0col4a73_0r4ng3@reddit

> Hashes are still useful to hackers. Criminals take the easy path. If you're trying to get a free lunch at school, hacking the system is probably not the criminal's first choice.

Reply

[-]

EliteCakeMan@reddit

I am convicted criminal, they are useful.

Reply

[-]

Wise-Application-144@reddit

Yeah I mean I'm not a conspiratorial person, and I know that my actual fingerprint isn't being stored. But I've lost my details in half a dozen data breaches (British Airways, TalkTalk plus a number of small businesses) and my wife's had her identity stolen. A significant minority of these companies will breach data law, store all your info in plain text files and then lose it. I have to assume that any data I hand over will eventually be made public.

Reply

[-]

whooptheretis@reddit

The normalisation of collecting and storing personal data.

Reply

[-]

liebeg@reddit

Things like that should be opt in not opt out

Reply

[-]

newfor2023@reddit

They are but apparently opting out is somehow odd.

Reply

[-]

JibberJim@reddit

> Just to add to this, if your child is under the age of 13, they can't give consent. A bit more nuanced than this, there's no lower age in which they can refuse consent in the act, however for school biometric data it does have to have parental consent: https://www.legislation.gov.uk/ukpga/2012/9/part/1/chapter/2/enacted So even if it's an area they can otherwise consent, it does not apply here.

Reply

[-]

IansGotNothingLeft@reddit

Interesting, thanks! We go by 13yo at work, I had assumed that was the legal lower age.

Reply

[-]

visforvienetta@reddit

But conversely if they're over 13 they can because at 13 they are responsible for their own data

Reply

[-]

KtMrgn@reddit

Nope. I’m assuming the child could identify which dinner lady it was? Because she’s about to be in a world of trouble.

Reply

[-]

timothy_scuba@reddit

As well as speaking with the school it's probably worth contacting the ICO as they took the PII without consent

Reply

[-]

vulrik1999@reddit

What in the orwellian fuck is this!? Biometric fingerprint scanning just to get some damn food to these kids? Hell no.

Reply

[-]

Mighty_joosh@reddit

Ooh lovely, this is a GDPR and Data Protection Act breach and entirely illegal 🙃 you have the right to have deleted all data you didn't consent to being registered - and I'd also send a letter complaining so ofsted get a flavour of this unauthorised misuse of a minor's data

Reply

[-]

kelvinside@reddit

It is obviously against your rights under gdpr, and if it makes you uncomfortable to share this data then that is your choice, any excuses or rationale about how it’s “fine because of xyz” don’t matter. It seems like an inert request with little risk, but tbh there is no way anyone on Reddit, the school, or the random company the school is using for its catering contract have a clue about the potential implications of a breach, or of the unintended consequences of the mismanagement or leakage of the data through human error. It is very unlikely to cause any problem, but unless you are a cybersecurity expert who knows the database and system inside out, you have no idea how useful the biometric and other associated data could be to bad actors now or in the future. People are slack af with this stuff because nobody understands it and they think it’s all fine. If there is no benefit to you or your child, don’t bother. If it makes your child’s life at school significantly easier, it’s probably fine just to let them do it, but that choice is yours alone. And you are absolutely right to question it, even just on principle.

Reply

[-]

SufficientRead1@reddit

I am a dinner lady, and this is absolutely not allowed. Saying it makes things quicker is rubbish, we get to recognise the few kids who don’t have permission and have searched them by name by the time they get to the till.

Reply

[-]

Trickypedia@reddit

My kids’ school do this and before they started in Year 7 I contacted the school asking about where the data is stored. My main concern is how securely it is stored and if they delete it once a child leaves school. I asked if the data is stored on-site or off-site, held by a third party, kept only within the UK etc and received no reply. Schools willingly sign up to third-party providers and as parents we are told nothing about data security, data handling or transparency.

Reply

[-]

adm010@reddit

Whats the issue? What exactly could someone do with a copy of your kids fingerprints?

Reply

[-]

Impossible_Plan_7958@reddit

This is like owing me 20 quid and then saying “it’s only 20 quid why does it matter”, it’s the principal.

Reply

[-]

DrHydeous@reddit

Right now - not much that mattes. In twenty years time when a dirt-digging tabloid journalist pays for access to the backups that should have been deleted? Break into a stolen phone full of personal information.

Reply

[-]

jim_cap@reddit

I agree entirely with the "something in the future" principle, but specifically this data, won't be usable as a fingerprint elsewhere.

Reply

[-]

NiceShy80@reddit

People are too paranoid about this stuff. Why would it be an issue? Nobody is going to use a lunchtime database of kids partial fingerprint data points

Reply

[-]

Billleegod_1@reddit

Not really sure about that hmmm🤔🤔🤔

Reply

[-]

_Red_Knight_@reddit

The number of people in this thread assuming that the OP is some kind of paranoid conspiracy theorist for having concerns over this, or a preference for their child to not use biometric authorisation for payments, is really shameful.

Reply

[-]

IntrepidSheepherder8@reddit

Yeah some of the replies here are quite something - calling the parent insane or saying they’re holding their kid back. Wtf. Absolutely nothing wrong with being concerned about handing over biometric data.

Reply

[-]

Whole-Lie-254@reddit

Legal? - probably not, but this also isn’t exactly the kind of issue that law would likely be designed to prohibit. Malicious? - no, honest mistake/miscommunication in all likelihood. Damaging? - really honestly no. I won’t go too much into it, but at a technical level, identifiable, or that could reconstructed or abused has been taken or indeed could be accessed at all. Do not waste your schools money and time with this and just move on. They’ve got enough on their plate.

Reply

[-]

rg1511@reddit

One important thing to note is that a real/full fingerprint isn’t actually used in these digital scenarios. A scanner will scan the finger and then create a digital, encoded representation of the fingerprint. At no point does a full photo of the fingerprint get taken, and only the encoded representations are saved. They can’t be decoded back into the original fingerprint. When the same finger is scanned in the future a digital representation of the fingerprint is created once again which is then used to find a match with the saved representation from the first scan.

Reply

[-]

SildurScamp@reddit

Definitely not legal, that’s biometric data under GDPR. You could kick up a massive storm over this, and I think you honestly should.

Reply

[-]

Cheezel62@reddit

TIL kids no longer get paper tickets for school lunches.

Reply

[-]

lotus49@reddit

Absolutely not.

Reply

[-]

WeDoingThisAgainRWe@reddit

Yes and really common practice for years now at high schools.

Reply

[-]

localzuk@reddit

It is extremely difficult to justify biometrics in a school, there's even a specific law about it. I have worked in school IT for 18 years and wrote my own cashless system in the past, so have a very good knowledge of the rules. The question a school has to ask itself is whether biometrics are a necessity or is another mechanism, such as RFID cards, can be used just as effectively? From my experience, biometrics can't be justified in schools.

Reply

[-]

TheReverend403@reddit

> It’s meant to be stored with specific school only access, deleted etc and is GDPR controlled And as everyone knows, all school IT systems are implemented correctly and securely and definitely not by a third-party contractor with 0 personal stake in giving a shit.

Reply

[-]

ASheerDrop@reddit

Completely illegal - report the school to the ICO

Reply

[-]

Beersink@reddit

Retinal scans would be more hygienic than a touch pad for finger prints where food is concerned. In fact a surgically implanted contactless NFC chip would probably be best. And to think I used to take my dinner money to school every Monday in an old tobacco tin; absolutely prehistoric. And why bother with food breaks anyway, just hook 'em up to IV nutrient drips and get some extra learning in. And no more daydreaming looking out of the window because the school playing field has been flogged off to housing developers. It's win win.

Reply

[-]

Marasesh@reddit

A surgically implanted nfc chip? Or you mean a card given to them lol

Reply

[-]

purple_sun_@reddit

Do you want your son to be singled out as the one with a mum who is a young boomer/ conspiracy theorist?

Reply

[-]

happybaby00@reddit

sigh... Do data breaches not exist anymore?

Reply

[-]

Marasesh@reddit

The thing is your data is already online your fingerprint isn’t actually important data. It can’t be printed off to be used to access your phone. It’s pretty much a meaningless biometric piece of data. They likely aren’t actually taking the fingerprint. There isn’t actually an issue to having it on there. There are very very few good reasons to reject it however there are some. And working in IT I know how shit everywhere is with security but there’s really no problem. The data breaches that have my passwords and pins in are the scary ones not a low res scan of your finger

Reply

[-]

saxbophone@reddit

It's bang out of order. When I was in secondary school aeons ago and it went cashless, there was similar fingerprint based system. I refused permission at the time, as I didn't understand at the time that the system only stores a hash code (one-way transformation) of my biometric data, which is infeasible to be reverse-engineered. They gave me a numeric pin instead, job's a good'un!

Reply

[-]

The_Deadly_Tikka@reddit

The first issue is you just assumed something. When I was at school you either used your finger print or didn't use the cafe, end of story. You need to find out if that's the case for you

Reply

[-]

Artistic_Data9398@reddit

This is to stop kids robbing each other. My nephews school as it. Before they used a token system. That failed. Then the pin. People find it out and steal your lunch. As kids are unreliable with anything. I’d cards and such are just a waste of money. Finger print complete removes the accidently giving the code. Being bullied for the code and whatever else. The dinner lady isn’t the gatekeeper for permission she’s made a mistake but I think you’re putting your child at risk if you refuse to allow fingerprint.

Reply

[-]

Knitcalm@reddit

It doesn’t stop the bullying though my son was just ‘persuaded’ to buy things for his so called friends .

Reply

[-]

BristolBomber@reddit

Well duh.. but it makes the act and likelyhood of it happening for the majority much harder. Bullies bully. The behaviour will never ever be stopped unfortunately some humans are just fucking assholes. Kids are no exception to the rule.. just fortunately more likely to grow out of it

Reply

[-]

Artistic_Data9398@reddit

Is that bullying or is that friends just being greedy? Think your nitpicking here

Reply

[-]

thejadedfalcon@reddit

I understand you're feeling defensive about people complaining about bullies, but I think the parent probably knows more about the situation than you do, mate.

Reply

[-]

Artistic_Data9398@reddit

correct. Looking back I don’t know why I even entertained this dumb conversation lol. Weak moment.

Reply

[-]

Orange-Murderer@reddit

Spoken like a true unsympathetic teacher just trying to clock out and not deal with the kids shit. The bullies love your classes because of all the shit they can get away with.

Reply

[-]

Artistic_Data9398@reddit

Where did you get the idea I’m a teacher you melt?

Reply

[-]

Orange-Murderer@reddit

Wow, even as brain-dead as said teacher, the parallels are truly unmatched.

Reply

[-]

Artistic_Data9398@reddit

Go to bed kiddo

Reply

[-]

Orange-Murderer@reddit

Ok boomer

Reply

[-]

Knitcalm@reddit

He was being bullied ( he has a learning disability and it wasn’t the only issue) not nitpicking at all. I didn’t object to him having the thumb print taken and school did address it when I contacted the school.

Reply

[-]

TonyBlairsDildo@reddit

> This is to stop kids robbing each other. Schools are honestly a safeguarding nightmare. For most people, they're the only place in your entire life you're at any noticeable risk of experience violence. It's tragic that the administrative solution to kids robbing one another is to remove currency from the canteens. Yeah that'll fix it.

Reply

[-]

TowJamnEarl@reddit

Putting your child at risk is a bit hyperbole. And if that truly is the case then there's some bigger issues at play in that school.

Reply

[-]

Artistic_Data9398@reddit

That’s a fair comment. I got robbed of my token all the time in school. Maybe this triggered some PTSD

Reply

[-]

ohthedarside@reddit

Just give permission its easier for your kid

Reply

[-]

Pitsmithy_89@reddit

When I went to school, I just stood in line. That was litterally it. What the fuck is going on 😂

Reply

[-]

54ms3p10l@reddit

What is it with people having conspiracies for everything? It’s for a lunch system not the police database, and no one gives a shit about a random secondary school pupils prints.

Reply

[-]

BlucifersVeinyAnus@reddit

So, I know this can be confusing but they haven’t actually been “taken” Taken is just a misleading term here. What they mean is that they’ve made a copy for future reference in case your kid gets chucked in a well or whatever Your kids fingers are still perfectly as intact as they were before

Reply

[-]

TEFAlpha9@reddit

Just let them do it ya nob noone gives a shit about little Xylers fingerprints the CIA aren't storing them and we're certainly not breeding clones

Reply

[-]

Chonky-Marsupial@reddit

No, you can refuse and a suitable non biometric needs to be available. It is all stated in a government briefing here: [biometrics in schools gov.uk](https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/1092507/Biometrics_Guidance_July_2022.pdf) Also even if you accept your child can refuse and that overrides your acceptance. I get that there are a number of discussions around this including the ones on whether the systems are secure and present a threat or if the data is truly anonymous however my take on it was that the data has a very long lifespan and I do not know all the ways people will think to use it in the future. Is the data point mapping of the finger print a widely used 3rd party software and can a replay of my child's data points be used on another non connected system based on the same tools in the future was a thought of mine. I also didn't receive an acceptable answer from my child's school as to the supply chain management for software or hardware platforms, and there was zero on data storage and deletion. The school could not confirm how a request to delete the data would be performed and verified as complete from all repositories. Now none of that means there is a risk, it just means that when I started asking the kind of questions I ask to do threat risk analysis on any system I come across nothing came back and so I refused permission. There may have been lots of effort put in to this but the school knew nothing that they could tell me. They retained a key fob. It didn't inconvenience any dinner ladies.

Reply

[-]

crucible@reddit

The school would likely have had to refer you to Biostore / CRB Cunningham or similar for some of that info, tbh.

Reply

[-]

Chonky-Marsupial@reddit

If I'd been doing this in my day job at some point we would have got down to risk transfer to client and moved on unless they wouldn't accept it. Not something I can do with my kids. Well I could, that's what every single person who gave permission did without understanding it but I wasn't going to.

Reply

[-]

crucible@reddit

That’s fair enough - I see your point of view there

Reply

[-]

Unusual-Art2288@reddit

You should also ask how they will store the fingerprint, who will have access, will it be retained after she leaves school... Will they pass it on to other organistions?

Reply

[-]

Snoot_Booper_101@reddit

Not legal, and you can ask them to delete the fingerprint info that they've stored. However, it might be difficult or impossible for your child to use the canteen afterwards. Also note that they don't store the fingerprint itself, just enough information to confirm it's the same fingerprint when it's scanned again. Your child's fingerprint can't be recreated or used elsewhere from the information they have recorded, if that's what your worry was.

Reply

[-]

Spiritual_Dogging@reddit

This falls under data protection. You have a legal case. They aren’t allowed to capture personal data without consent without approval. Fingerprints are personal data

Reply

[-]

Flashy_Star4268@reddit

I remember the fingerprint system at my school ten years ago. You had to put coins in the machine after you scanned Ur finger. Every break/dinner there would be a huge line to queue up to top up your fingerprint account. If you went at the 15 mins break it would eat up your entire break queuing up, meaning the child does not get a proper break from education. I remember feeling at the time it was an annoying/pointless system. I imagine a fair amount of money is spent setting the fingerprint system up. Will never understand why they don't just have a till at the dinner hall run by the dinner ladies. Would make it so much easier for the kids.

Reply

[-]

darybrain@reddit

In a separate fingerprint vein, I found out the police already had my and my classmates fingerprints for decades and that the school were aware when we had gone to the local bobby station on a walking school day out around town where they took pictures, fingerprints, locked us in a cell for a short time to scare us into never becoming a crim, and other stuff. Parents were never told and us kids were to young and dumb to know.

Reply

[-]

Ok_Calligrapher3139@reddit

What’s the issue of them having fingerprints anyway ffs

Reply

[-]

RevolutionAny9181@reddit

The same thing happened to me 8 years ago when I first went to a British school, I thought it was odd because I never heard of such a thing in Belarus, so I did some research and it is indeed illegal if you refused it initially.

Reply

[-]

Maximum-Still6530@reddit

It’s a finger print, who cares. Get a grip!

Reply

[-]

Snazzles@reddit

I would have a chat with the head teacher before going in all guns blazing. Firstly, does your son know you opted out and why? Or have you ticked the box and not told them. As someone who has worked with teens in and out of school environments there could be a whole list of factors that have contributed to this happening. 1. The dinner ladies were not aware who has opted out. The list should have been shared but secondary schools are big and have lots of pupils on roll, it can be difficult to know who has opted out so dinner lady has just asked do you have fingerprint set up? Then when son said no, asked if he wanted it set up. 2. Son has decided to set it up as he is the only one of his mates that isn't set up. Using pins/ names often takes longer. His mates might be ribbing him about not having fingerprint. You have asked him about it and he has blamed dinner lady staff rather than admit he set it up. 3. The fingerprint is faster than using pin/ surname and son has set it up for speed. 4. Dinner lady was out of line. You are right to raise it, but go in with a cool head and be prepared to hear that this is possibly something your son has set up. Usually in cases like this, teens cave to peer pressure from their mates, get fed up of been ribbed for something, feel singled out as they are the only one and look for solutions. When asked directly about it, they panic and lie or give a plausible not quite the whole truth explanation in the hope of getting an adult off their back. If not already I would explain why you didn't give consent for the fingerprint.

Reply

[-]

Cute_Ad_9730@reddit

I can only imagine the state of that scanner 🤮

Reply

[-]

uk451@reddit

And everyone is using them directly before eating, yuck

Reply

[-]

Cute_Ad_9730@reddit

Exactly. Wouldn’t a name badge barcode type scan be more realistic? Is there a huge issue in theft of shit pizza that demands biometric security?

Reply

[-]

uk451@reddit

Tbf I lost my school id on a monthly basis so I’m for fingerprints lol

Reply

[-]

Cute_Ad_9730@reddit

Tbf I guessed that was the reason for biometric scanning. How about you don’t offer food choices for the children for two days and then their parents get fined £10 for replacing your child’s ID once they’re fucking hungry they will probably stop taking the piss. At some point some common sense backed up with understanding and consequence needs to prevail.

Reply

[-]

LoveBeBrave@reddit

You’ve never heard of kids stealing lunch money?

Reply

[-]

mariah_a@reddit

They actually clean them regularly with a wipe because if you don’t, the oils make it harder to read the next fingerprints after a bit.

Reply

[-]

JimbosChafingShirt@reddit

They introduced them when I was at school, around 12 years ago. Half the time they never bloody worked for me, I guess because of the state of kids hands smudging the scanner. That, or they would reject the cash when kids tried to add money to their account. As another commentator said, we weren't allowed to pay cash so no alternative.

Reply

[-]

TheFlyingHornet1881@reddit

At my school they didn't work at all for some students, they had to use a code.

Reply

[-]

TowJamnEarl@reddit

We had them at work and they were dropped after 6 months due to their ureliability. Warehouse workers ofc have dirty fingers.

Reply

[-]

Sea_Falcon8123@reddit

Pretty sure this system enabled an outbreak of impetigo when a relative was at school

Reply

[-]

SecretHipp0@reddit

Your kids hate you

Reply

[-]

EliteCakeMan@reddit

I posted this elsewhere but thought it may help. My gym uses fingerprints and I refused. The data collection isn't always encrypted as I'm a computer specialist with over a decade in the security industry. If the bit between the fingerprint scanner and the computer or devices gets compromised then it's useless as the data is stolen before it's encrypted. Also I don't trust a gym, or dinner ladies with access keys which could gain access to my biometric data or any data points the scanner may record. The information isn't benign you can't create your finger print from it but you can easily be identified with it. They gave me a pin number instead and were very happy to understand. Most fingerprint systems are inherently very insecure but most don't actually take accurate biometric data so there is that too but the information can still be used. Just because the data is hashed afterwards doesn't make it unusable. Also most people don't realise how often their data is sold or stored by breaches or companies. If you use a service to check your breaches, you'll probably find 10+ companies that have leaked your data, passwords, emails, identity etc. By not using this service it's just the simplest way for your data to just not exist to be used badly.

Reply

[-]

mp583@reddit

Yes this exactly. To add to this, think how often websites are hacked and your usernames and passwords are accessed, those are also likely stored in an 'encrypted' fashion. The thing with biometric data is that you can't (easily) change your fingerprints. Once the data is out there, there's no going back. As the system will need to store enough data points about a fingerprint to make it unique, it's entirely likely that this could be reverse engineered to create an image of the person's fingerprint.

Reply

[-]

badger906@reddit

I don’t get why you’d refuse? your kid would just have been known as the weird kid with a secret. The biometrics they take aren’t an actual image of a finger print. It’s just a few measurements and key points. I guess your kids aren’t allowed Face ID on their phone or finger prints unlocks either? Life isn’t csi.. someone isn’t going to commit crimes with finger print gloves on. Plus finger prints as evidence is not enough. Again tv shows taught us that.

Reply

[-]

femalepop_fan@reddit

Finger printing children for food. What in the ACTUAL fuk

Reply

[-]

Spider-Nutz@reddit

Not legal. My school tried to do this same thing and literally the day after we all scanned our fingerprints they were forced to revert back to just using student ID

Reply

[-]

DameKumquat@reddit

Good question. If you denied permission, then it shouldn't have happened, but equally, they haven't kept the fingerprints. The system works by saving some numbers derived from the print, not the print itself. The lunch systems generally don't have an alternative in the lunch hall - kids get their food, then tap to pay. There's no option to pay by cash or other means, and the staff won't know how to enter the system. One issue you'll encounter in secondary is kids increasingly able/expected to make their own decisions. The school will likely say your kid consented. Obviously consent under pressure isn't legit, and you might want to mention it, but equally I really wouldn't pick this hill to die on. Do you really want your kid to stand out as the only one in school not allowed school lunch?

Reply

[-]

Ill-Breadfruit5356@reddit

Essentially your advice is don’t stick to your principles, give in to peer pressure instead? If the school didn’t communicate the system effectively that’s on them

Reply

[-]

HotCheetoEnema@reddit

>Essentially your advice is don’t stick to your principles, give in to peer pressure instead? I worry for our future. I feel like everyone has just been advocating for taking the path of least resistance, even if it isnt right.

Reply

[-]

newfor2023@reddit

Doesn't matter if the school say he consented. If a parent objected that's all that's required.

Reply

[-]

KangFedora@reddit

Only the cops can have your prints

Reply

[-]

Awkward_Chain_7839@reddit

That can’t be legal, we had the same firm and it stated in big, bold letters that if there was no permission a card (scans just as quickly) would be issued and that the student was responsible for not losing it.

Reply

[-]

AdThat328@reddit

My school had dinner cards when I started and they changed to thumb prints to stop people stealing cards, or losing them and not being able to get any food. I don't remember ever having to get parental permission, but I'm 30 and it was a while back. The technology was so bad and barely worked so eventually they decided to just start taking cash. However, the dinner ladies probably aren't the ones who took in permission slips and likely won't know who signed what.

Reply

[-]

Dave8917@reddit

My kids school has the same system we was notified long before she had her prints taken , so that being said did your child just forgot to mention to you

Reply

[-]

Iforgetinformation@reddit

Did he care? Maybe he just wanted to eat and that was the best way how

Reply

[-]

lipperinlupin@reddit

Why do you have a problem with it? Is your child a criminal?

Reply

[-]

___Steve@reddit

Please download a remote desktop service of your choice and share your access details here. You've got nothing to hide so shouldn't be a problem right? There are plenty of reasons not to want this and they don't even need to be privacy related. We are barely out of a global pandemic, the latest strain of which is certainly no fun. Sounds like a fingerprint reader just before eating is a surefire way to kick off a superspreader event.

Reply

[-]

TheReverend403@reddit

"Only criminals care about data privacy!" God our country is so fucked.

Reply

[-]

AngryTudor1@reddit

I actually don't think schools do need you to give permission, because most do not seek it. Gallick competence means that your child actually can consent themselves, even in year 7 if they are deemed mentally able, and I'm sure your child is. Taking fingerprints for cashless lunchtime is pretty standard across schools now. I'm pretty sure my previous school did not seek parental consent and doesn't need to- they will have done this as a courtesy. The dinner lady didn't "make" him do anything. She told him to do it because everyone else was and she wasn't aware of any issues with him doing it, and he did. There would have been no reprimand had he refused and no one grabbed his finger and forced it down. It's a bit worrying that you go into year 7 already with so little trust in the school that you refuse something as standard as this. What do you imagine the school are going to do with your child's fingerprints, other than give them dinner?

Reply

[-]

Hazz3r@reddit

Gillick Competence is a concept that is solely applied to Medical Treatment. It can't just be applied to all other situations involving children and consent.

Reply

[-]

furrycroissant@reddit

No, that case law has been applied in other situations such as residency orders and family law cases. It isn't just applied to medical treatment

Reply

[-]

The_Mayfair_Man@reddit

It's illegal to take an adult's fingerprints or DNA without consent unless you're suspected of a crime. I'd be amazed if the same didn't apply to children. I also find people's naivety on this topic absolutely bizarre - "So what if government authorities are trying to take your child's biometric data when you asked them not to stop being so paranoid!!" It's illegal to do it to adults and people seem so casual about it happening to their own child

Reply

[-]

AngryTudor1@reddit

Ok. So flip that around. What exactly do you think a school is going to do with it? Data is digital. I assure you that no teacher nor senior leader ever sees it or has the opportunity to do anything with it, and there is zero we could do with it anyway. The whole point is speed and convenience

Reply

[-]

The_Mayfair_Man@reddit

I don't see how "It's fine you can trust them" answers my points. It's illegal for them to collect my biometrics. If they asked to do the same to my child, and after I refused, they did it anyway, I'd rightly be extremely pissed. If the argument is "Don't worry you can trust the government not to abuse the power and data they have" why bother with any protections from government departments? Why ask the police to get warrants before executing a search, we've all got nothing to hide right?

Reply

[-]

lazyplayboy@reddit

No trust is necessary. There's no way this data can be used for anything else.

Reply

[-]

crucible@reddit

Going cashless prevents human error like the money being miscounted, not locked away, banked a day later… we have had a break-in in an older building and money, a laptop and food were all stolen.

Reply

[-]

TheReverend403@reddit

It's adorable that you think that.

Reply

[-]

AngryTudor1@reddit

It doesn't change the fact that OP seems to be inferring nefarious motives in this, that their child was "forced" to give their fingerprints. When that is not the case- it's a dinner lady, being paid for an hour a day to serve food, who is taking everyone's fingerprints. Either she has lost the consent list, isn't checking it or it hasn't been communicated to her. This is human error, not a school deliberately and nefariously stealing the child's fingerprints

Reply

[-]

Two-Tailed-Fox@reddit

I get it's about principle, but schools don't keep records of hundreds of children's fingerprints. People are casual about this because it won't ever lead to anything nefarious. There's arguments to be made here, of course. There are many other systems we could use over fingerprints. My school used a login at a kiosk that you only had to do once, and gave you a little plastic card to scan at lunchtime. Now, the school disregarding OP's wishes about her child? Yeah, that's a problem, and they should bring it up with the school. But no consequences are ever going to come from this. School needs to improve their communication with lunch staff, that's about it.

Reply

[-]

Flagship_Panda_FH81@reddit

Exactly - police can take biometric data in certain circumstances for policing purposes, set out in law and governed by legally-binding codes of practice. I'm astonished at how cavalier this system sounds.

Reply

[-]

Orange-Murderer@reddit

>It's a bit worrying that you go into year 7 already with so little trust in the school that you refuse something as standard as this. People have become more worryingly dangerous over the years it's generally safer these days to not implicitly trust others. Being complacent with "well, it's not going to happen to me" is what makes you a target and since you're complacent with it it's very easy to do the thing against you.

Reply

[-]

horseradish_smoothie@reddit

It's Gillick, and it's used for consenting to medical treatment if under 16 in medical law. Someone learned a new buzzword during covid. > In order to comply with the requirements of the Protection of Freedoms Act 2012, schools and colleges must notify each parent, carer/legal guardian of the child of their intention to process the child’s biometric information, and that the parent may object at any time to the processing of the information. It is important to understand that a child’s biometric information must not be processed unless at least one parent of the child consents, and no parent of the child has withdrawn his or her consent, or otherwise objected, to the information being processed. In addition, a pupil’s or student’s objection or refusal, overrides any parental consent to the processing, therefore any biometric data must not be processed. https://www.gov.uk/government/publications/protection-of-biometric-information-of-children-in-schools

Reply

[-]

AngryTudor1@reddit

Ok Not my area of management and no need to be so arrogant about it

Reply

[-]

carlolewis78@reddit

"Not my are" but here I'm going to write a massive paragraph of incorrect information and get shirty when someone corrects it.

Reply

[-]

cgknight1@reddit

It's not arrogant to correct dangerous misinformation.

Reply

[-]

Random_Reddit_bloke@reddit

They know when your child was born, where he lives, his weight and height, next of kin…but yeah, better worry about his finger prints lol

Reply

[-]

Matttthhhhhhhhhhh@reddit

To all those saying that OP is cruel for singling out their kid because they just don't understand the system: if OP didn't understand it, I'm tempted to think that it's the school's fault for not explaining it correctly. Not everyone is a nerd spending countless hours perusing through GDPR docs.

Reply

[-]

crucible@reddit

If OP’s child is just starting Year 7, they will have received forms asking for parental permission to store a fingerprint (often referred to as “biometric “ data even though the systems capture limited data points). Usually this is for catering, and library book check out. If they tick no a swipe card or RGID card should be issued - and that’s always done in the first week of term so we’re nearly a month in now… Now, if their child loses the card it’s the child’s responsibility to tell a tutor and arrange for a new one. It can usually be done same day when the realise. Dinner lady could just have typed “Bloggs, Fred” into the till to find them and would have avoided all this from happening, too.

Reply

[-]

Fit_Implement3069@reddit

Not legal, I have had to remind my local school of this before... I let my kids decide

Reply

[-]

IntermediateFolder@reddit

Depends how old your kid is, I believe if they’re over 13 they can give consent themselves.

Reply

[-]

JibberJim@reddit

Nope, especially not over parental objection https://www.legislation.gov.uk/ukpga/2012/9/part/1/chapter/2

Reply

[-]

dinglebop69@reddit

Lol 14 years ago they took me into a room after I denied giving my fingerprint and they refused to let me go until I complied. I'm still angry about it. 100% not legal but I was a child and no one was gonna fight for me. Be who I wish I had and fight tooth and nail for the truth on why their still going around schools getting children's fingerprints.

Reply

[-]

BicycleOk8305@reddit

At my old school, everyone had a fingerprint to buy their food in the canteen but they also had an individual 4 digit code. For some reason my fingerprint never worked so I always used my code. When I entered my code in, my name and account would come up so they knew it was me and that I hadn’t just put some random code in to get food. Does his school have something like this instead?

Reply

[-]

SupremeFlamer@reddit

I'm sure it was different way way in the past but I had a card we swiped on a machine and inserted coins to top it up. My sister had finger printing and it feels overly unnecessary to me.

Reply

[-]

Evening-Ad9149@reddit

No, kick up a fuss, you are well within your rights to demand the biometric data is removed.

Reply

[-]

MJLDat@reddit

My understanding of the data captured is it is not the fingerprint itself. It’s a code (hash) generated from the blood vessels, which cannot be reverse engineered to reproduce the fingerprint, or the blood vessels. There’s more identifiable data stored in his school files, like name, date of birth etc.

Reply

[-]

captainslow84@reddit

Usually this sort of system converts the fingerprint into an alpha-numeric string that can't be converted back into an actual fingerprint. But absolutely get this clarified. I have some experience with secure storage lockers that use fingerprints to reduce the admin overhead associated with IDs and PINs.

Reply

[-]

JackieDaytona115@reddit

It's not actual biometrics.

Reply

[-]

TheNoodlePoodle@reddit

Biometrics = using body measurements to identify people. It absolutely is biometrics.

Reply

[-]

JackieDaytona115@reddit

It really isn't. I'm an IT Systems Admistrator who had the unfortunate task of being the liason for the Cashless Catering system. Please don't comment on things you have no exposure to.

Reply

[-]

BeginningImaginary53@reddit

Cashless🤬 good to see your childs school is fully inclusive.

Reply

[-]

illarionds@reddit

It's not legal, no, and you have every right to complain. I would suggest though that I (with some professional knowledge of biometrics) can't think of a good reason not to want him using them.

Reply

[-]

lewiswulski1@reddit

No, I would call them and ask what's going on.

Reply

[-]

cyberspacedweller@reddit

Kids had metal tokens to exchange for their dinner when I was at school. I never heard of them being stolen but I guess it would have been easy to

Reply

[-]

Nero_Darkstar@reddit

What are you worried about in not giving consent? I bet you agree to cookies / consent on every site you visit. Unless you're worried about him buying too much junk food, I don't understand.

Reply

[-]

OldFartWelshman@reddit

DPO for a number of schools here. It's legal if you (or your child if old enough) consent to it, but they must ALWAYS offer an alternative route for those who don't want to provide biometrics. Schools have been fined and otherwise sanctioned for not allowed an alternative route in the past. It's a good system in many ways, especially for younger children with allergies, as the staff are clear on any issues. As a former free school meals kid myself, it also reduces embarrassment - when I was in a school FSM kids had different coloured tokens to everyone else, advertising the fact we were poor.

Reply

[-]

Sir_Of_Meep@reddit

First thing, stop asking reddit for questions regarding your kids safety and data protection. A quick Google gets you to the government website that outlines the law around permissions. He could be an IT guy or he could be an eleven year old. Everyone else having a go at the parent, do you trust every company that blunders on in? If facebook asked for your fingerprint would you give it for ease of access and pretty blindly assume it'll be stored in the form they say? One major security provider CRB Cunningham states that data breaches are possible, that's beside the fact that I don't trust them or the school to hold and transfer data properly. I'd also prefer not to teach my kid to happily sign away any biometrics in future if it makes life easier. I've been wrongly arrested before and had a password leak, maybe I'm just paranoid.

Reply

[-]

BeagleMadness@reddit

No, it's not legal. I had to sign similar forms for my sons as their school used their fingerprint to pay for lunches If we chose to opt out, they were supposed to be given a swipe card instead. At the start of term everyone got lined up to scan their finger and set up the system and often staff weren't advised who hadn't agreed. I wouldn't assume maliciousness on this occasion - I imagine the staff member just hadn't been told who hadn't given permission and thus told all the students what to do. It is pretty rare for parents to deny permission at my sons' school, so the staff member probably assumed the kid was confused rather than "Oh no, I should go and check what permission has been given here." But if you complain and they refuse to do anything other than apologise, issue a swipe card/whatever their alt solution is and confirm your child's fingerprint has been removed from the system? Then I'd raise hell.

Reply

[-]

the404@reddit

Fingerprints to receive a school meal is one the most insane, terrifying and over engineered thing that I have ever read.

Reply

[-]

Ayanhart@reddit

It's been a thing for many years, I had it at secondary and I'm almost 30. It's a quick way of linking you to an account without having to remember a password or pin (which many children would frequently forget). It's no different to unlocking your phone screen with a fingerprint.

Reply

[-]

the404@reddit

I would imagine your phone is developed by a hardware/software company and take steps to ensure it's protected. I think on your phone your prints are encrypted and stored locally. However I would imagine this is a thirdparty service that is being used in school and it's probably on a public bucket somewhere.

Reply

[-]

Bug_Parking@reddit

>I would imagine >It's probably If you don't know, there's no need to just make stuff up

Reply

[-]

the404@reddit

This happens all the time and it's a well known security issue https://www.ncsc.gov.uk/blog-post/theres-hole-my-bucket It's very common for contracts to be awarded by cost and one way to cut cost is to offshore the development of everything and to cut corners. Security is sometimes an afterthought especially with offshore development. I personally would never trust my own or childs fingerprint to a random tech company. If my childs school wanted to implement this I would probably want to now where and how that data is stored

Reply

[-]

MitchellsTruck@reddit

> it's probably on a public bucket somewhere. You couldn't be more wrong.

Reply

[-]

turkishhousefan@reddit

I guess ignorance is *not* bliss.

Reply

[-]

terryjuicelawson@reddit

It is just like how a fingerprint unlocks your phone. It works well in practice without each kid needing a card or pin number.

Reply

[-]

Echo61089@reddit

Nope. Biometric data is the same as photographs. I had to sign a load of consent forms for my kiddo and her new school and read them all to make sure it would just be for stuff like the library and paying for School meals and other GDPR stuff.

Reply

[-]

aidanrussell@reddit

This is not legal and you're well within your rights to request deletion of your child's biometric data. However, once taken, the data is never deleted, but that's a different story. Arrange a meeting with the school's Business Manager (and some local jurnalists) to see how they store the fingerprints and with whom is the data shared, now, and in the future (read the small prints).

Reply

[-]

Codego_Bray@reddit

That's insane. Everyone knows that GDPR and law is a requirement for a dinner lady in 2024.

Reply

[-]

Oskar-USERNAME@reddit

It’s really not that serious mate

Reply

[-]

BigRedTone@reddit

Worth noting that 50% of what people write about GDPR on the internet is class A bollocks, and 49% is based on misunderstanding or a lack of nuance. There are a couple of ways to estimate is you should listen to someone on the GDPR. Firstly do they give a balanced answer. The GDPR has various principals and six lawful basis that you balance against the impact to the individual. If someone says “it’s against GDPR” they’re almost certainly talking bollocks. If they talk with a bit of nuance then they’re probably talking to the balancing test that you would do to determine if something was complaint. Secondly, anyone who has done any GDPR training at all would have picked up that we call it “_the_ GDPR”. Using the definite article “the” is an indication they aren’t full of shit.

Reply

[-]

UncleSnowstorm@reddit

>Secondly, anyone who has done any GDPR training at all would have picked up that we call it “the GDPR”. Using the definite article “the” is an indication they aren’t full of shit. I'm a data analyst and previously a DPO, absolute rubbish to say that somebody has to use "the GDPR" in order to be qualified. Most people I've encountered just use "GDPR", but that level of nuanced language isn't indicative of data protection knowledge either way.

Reply

[-]

Slavir_Nabru@reddit

Kind of grim. Either you buy your food then leave it unattended while going to wash your hands, or you just have to deal with touching the screen that 200 little shitbags have just handled. If they actually need to use biometrics then face/eyes at least doesn't fuck with hygiene in a food environment.

Reply

[-]

Hazz3r@reddit

They aren't taking his fingerprint. His fingerprint is being used to secure his wallet at the school for his dinners. Think of it like your Reddit password. Reddit doesn't store your password, they store a lock that can only be unlocked by your password.

Reply

[-]

UncleSnowstorm@reddit

Except passwords have been leaked/breached numerous times. So if you use the same password in multiple places then you're fucked (same with fingerprint). You're putting a lot of trust in the security of these companies, when history has shown us that that trust is often misplaced.

Reply

[-]

newfor2023@reddit

They already said no. That's all that's required. You don't have to use reddit. The school is a legal requirement. Cashless schools must provide an alternative to biometrics where one or more parents have objected or the child has refused, with no lower age limit on the refusal.

Reply

[-]

spik0rwill@reddit

Why care?

Reply

[-]

tobych@reddit

In my kid's school in the US all the kids have an ID card they use for this sort of thing. With their photo on it, and a barcode. Seems sufficient.

Reply

[-]

Ochib@reddit

If you want some light bedtime reading, the Government has published guidance on this [Protection of biometric data of children in schools and colleges (publishing.service.gov.uk)](https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/1092507/Biometrics_Guidance_July_2022.pdf)

Reply

[-]

Chevalitron@reddit

When the hell did all you people go to school, the 25th century? We just used coins...

Reply

[-]

plumbus_hun@reddit

It’s been a thing for ages, my school got it when I was in year 8, I’m 30 now so that was 17 odd years ago!!

Reply

[-]

Sad-Individual6784@reddit

All the kids in my school during 4th grade, 2000, had their fingerprints taken. I don't remember giving permission.

Reply

[-]

blake-a-mania@reddit

Biometrics are personal data protected in GDPR. That dinner lady needs reporting for illegally collecting your child’s data. The schools / academies data controller will need to be involved.

Reply

[-]

THE-HOARE@reddit

It’s a finger print for food. The Chinese’s government isn’t going to steal that one finger print and use it as leverage against you. Why so paranoid about it ?

Reply

[-]

StationFar6396@reddit

Fucking finger printing kids to get school slop, what a world.

Reply

[-]

hitiv@reddit

Yes the school have not respected your wishes which is wrong but come one, why tick the box in the first place? Don't make your kid stand out or be the odd one out. Kids will get bullied for anything and everything, parents have not much control over this but there are few things you can do to try and at least prevent it such us not giving your child a weird name or making their peers think their parents are freaks because they are scared of 5G waves....

Reply

[-]

conrat4567@reddit

No, we used to use vericool to do this and it was an absolute pain to set this up and organise. We dropped them and went to another system that uses cards and pins

Reply

[-]

JacobSax88@reddit

Why the hell do they need fingerprints for school dinners? 🤔😂

Reply

[-]

lazyplayboy@reddit

They don't. No fingerprints are stored. They use a fingerprint scanner to pay for school food, but any paranoia about the data this uses is entirely misplaced.

Reply

[-]

nice_mushroom1@reddit

Back in the 90s, I remember being around 10 years old and the police came to our school and took everyone's finger prints.. My parents weren't too happy about it.

Reply

[-]

DJToffeebud@reddit

Noooooope

Reply

[-]

lazyplayboy@reddit

It's a weird thing to be concerned about. The fingerprint has not been stored and can not be exported anywhere

Reply

[-]

JocastaH-B@reddit

These systems don't keep the fingerprint. They scan, make a code from the pattern and keep that. No one can access the actual fingerprint

Reply

[-]

jlb8@reddit

What do you think biometric data is?

Reply

[-]

JocastaH-B@reddit

I do know what biometric data is but I think OP is worried someone can access their child's actual fingerprint (when I worked in schools that were introducing these systems for library and/or canteen this was a common fear.

Reply

[-]

Ginge04@reddit

They don’t actually store anyone’s fingerprints.

Reply

[-]

Scottish_squirrel@reddit

We don't use this system where I work. But there's very little contact between the school and the lunch hall unless there's clarity needed over an allergy vs menu item. So if office have dealt with the permission slips, information might have fallen through the cracks getting to the lunch hall. Or a changeover of staff have failed to consider the permissions. At the same time though, often parents don't understand what They're granting permission for. We've had parents refuse photographic permissions then cry when the professionals arrive and their child is excluded.

Reply

[-]

_1489555458biguy@reddit

The fucking hoops we jump through to avoid to just giving free school meals to all kids.

Reply

[-]

Obvious-Water569@reddit

It's not legal. They've ignored your legal request and dones something against your wishes. My guess is that school dinner ladies aren't experts in biometric data records and/or GDPR so they probably didn't understand the implications of what they were doing. That being said, what's the problem? What do you think will happen with your kid's fingerprints? This post is giving "vaccines contain microchips to control us".

Reply

[-]

bishibashi@reddit

it’s a mistake, contact the school, they’ll apologise and sort it, end of story

Reply

[-]

Reader-H@reddit

It sounds like the diner lady made a mistake or error in judgement. Just contact the school and ask for it to to be deleted.

Reply

[-]

ChangingMonkfish@reddit

Given the strict rules on processing biometrics under the GDPR, it’s almost certainly not legal for them to do it at all. This is ultimately just laziness by the school, they could use a number of other ways to manage this that don’t involve fingerprints (a swipe card for example).

Reply

[-]

MRRichAllen1976@reddit

This wasn't even a thing in my day (because back in the 80's, the Internet as we know it hadn't been invented yet)

Reply

[-]

horseradish_smoothie@reddit

https://www.gov.uk/government/publications/protection-of-biometric-information-of-children-in-schools Pdf, page 10.

Reply

[-]

Alarmed_Crazy_6620@reddit

How old is he?

Reply

[-]

Little-Berry-539@reddit (OP)

11

Reply

[-]

Inkblot7001@reddit

If they did not ask your permission, then you have a point to make with the school. I am not a lawyer to comment if this is illegal or not. On a technicality, they have (probably) not taken your son's fingerprints - they will (probably) just be storing a token that allows authentication against his fingerprint. This is different from storing the actual fingerprint. It is the same as using a common fingerprint reader on your laptop or phone.

Reply

[-]

Drewski811@reddit

They explicitly ignored your wishes, regardless of whether it's a specific legal issue, it's an abuse of trust and something that definitely needs to be brought to their attention.

Reply

[-]

CoffeeIgnoramus@reddit

I'm not a lawyer, but if they asked you permission to then just ignore it, I assume there is a legal issue. Ask on r/legaladviceuk

Reply

[-]

AutoModerator@reddit

**Please help keep AskUK welcoming!** - Top-level comments to the OP must contain **genuine efforts to answer the question**. No jokes, judgements, etc. - **Don't be a dick** to each other. If getting heated, just block and move on. - This is a strictly **no-politics** subreddit! Please help us by reporting comments that break these rules. *I am a bot, and this action was performed automatically. Please [contact the moderators of this subreddit](/message/compose/?to=/r/AskUK) if you have any questions or concerns.*

Reply