Facial Recognition at Greenhill Secondary School

Purpose limitation. One system would serve three purposes: attendance, payment and parent notification. Each needs its own justification. Feeding canteen purchase records into attendance reporting, or using data for marketing, would be a secondary use beyond what was notified.

Minimality. Is a face necessary for lunch payment when a card and PIN would stop card-sharing? Is continuous gate scanning necessary for attendance when roll call exists? Collect only what each purpose truly requires.

Retention. Templates would sit in the system for the three-year contract and possibly after students leave. They should be deleted when a student leaves or when the purpose ends.

Security and cross-border transfer. Overseas storage means the data leaves the school's control. The school remains accountable and needs contractual safeguards, encryption and access control.

Openness and consent. Parents and students must be told what is collected, why, who can see it, how long it is kept and how to opt out. Consent from minors raises questions about whether it is genuinely free, especially when the alternative is being marked absent or unable to buy lunch.

A facial template is derived from an identifiable person and can be matched to that person, so it is personal data even though it is not a photograph. Unlike a password it cannot be reset if leaked.

Alternative 1: student card plus PIN. Accuracy depends on the PIN, which stops simple card-sharing; cost is low because cards already exist; privacy impact is small; lost cards and forgotten PINs cause friction at the lunch queue. It does not automate gate attendance.

Alternative 2: QR code on a phone or printed badge. Cheap, easy to revoke, and works with existing devices, but codes can be screenshotted and shared, and some students may not carry phones.

Facial recognition. Fast and hands-free, with nothing to lose or forget, and it does automate attendance. But it is the most intrusive, it cannot be revoked, it costs HK$380,000, and accuracy varies with lighting, skin tone, age and face coverings.

False accept: an unauthorised person is admitted or charged to the wrong student's account. False reject: a genuine student is refused entry or lunch, or marked absent. Lowering the matching threshold reduces false rejects but increases false accepts. In a school, a false reject has an immediate welfare cost for a child, so the threshold and a card/PIN fallback must be designed before deployment, not after complaints.

Do not approve the contract as written. The three purposes are bundled, the vendor claims a broad secondary use, and there is no fallback for students who are misread or who opt out.

A defensible route:

1. Narrow the scope. Run a voluntary pilot for canteen payment only, with card and PIN available to everyone, and keep roll call for attendance.
2. Complete a privacy impact assessment before signing, covering purposes, data flows, overseas storage and retention.
3. Remove the model-training clause and require the vendor to act only on the school's instructions, with breach notification, audit rights and deletion at contract end.
4. Limit retention to the enrolment period; delete templates on leaving.
5. Give real notice and a genuine opt-out that does not disadvantage any student.
6. Tune and test accuracy on the actual population, publish the fallback procedure, and monitor for bias.

Accountability: the school is the data user even though the vendor holds the data. It must be able to show compliance with the data protection principles and remains responsible for the vendor's handling. If the pilot cannot meet these conditions, keep the card system and add a PIN - that solves card-sharing at a fraction of the cost and risk.