Face-Recognition Attendance and the 4.1% Failure Rate
A private school in Guwahati is offered a face-recognition gate system: 98.2% vendor-reported accuracy, automatic attendance for 1,100 students, three cameras, and a monthly fee. Face embeddings are stored on the vendor's cloud server in Mumbai; the school keeps no copy and the vendor contract has no retention or deletion clause. Parents signed a general 'photography and field trip' consent at admission.
A two-week pilot shows a 4.1% failure rate for students wearing a hijab or dupatta against 0.9% for other students. Those who fail must queue at the office and sign a register that is visible to visitors. The principal says, 'Just upload more photos of those students and the problem is solved.' A parents' group has written asking how the data is used and whether refusal is possible. Manual roll call takes teachers about six minutes per class.
1. Enumerate the harms in this deployment and explain why 'upload more photos' does not address them.
Read the worked answer
The harms stack in layers. There is an accuracy harm: a 4.1% versus 0.9% failure rate means one group is late to class, questioned at a gate and recorded as non-compliant far more often. There is a dignity harm: the workaround is a public register that discloses, to any visitor, which students wear a hijab or dupatta and which were not recognised. There is a consent harm: a photography-and-field-trip consent does not inform a parent that a biometric template will be extracted and stored. There is a security harm: face templates are irreversible, and a breach cannot be fixed by changing a password. And there is a control harm: the school cannot delete what it does not hold.
'More photos' is a data-quantity answer to what is probably a data-coverage and modelling problem: occlusion by head covering, pose, lighting, and a training set that under-represents these students. Adding images may help only if the vendor retrains and reports per-group error before and after. Even then, it leaves consent, storage, retention and the public register untouched, and it places the burden of fixing the system on the students it fails.
2. Draft the conditions you would require before any further deployment, covering both data protection and the school's duty of care.
Read the worked answer
Start with a documented impact assessment: what data, why, who sees it, how long it is kept, what happens on breach. Without that, nothing proceeds.
Consent must be specific, informed and separable. A notice in Assamese, Bengali and English explaining biometric processing, the vendor, the storage location and the right to refuse, with verifiable parental consent because these are children. If India's Digital Personal Data Protection Act, 2023 applies to the school as a data fiduciary, children's data carries extra obligations and behavioural monitoring is restricted; the school should confirm the current position with its legal adviser rather than rely on the vendor's summary.
Minimise and localise. Match on-device and keep no cloud copy, or store only an encrypted template under school control. Set a retention period and a deletion trigger when a student leaves. Rewrite the vendor contract with audit rights, a ban on re-use for model training, breach notification and deletion on termination.
Provide a non-biometric default: RFID card or random spot checks, so refusal carries no cost and no queue. Remove the public register entirely; absences go to the class teacher privately.
Finally, require per-group error reporting, a human override at the gate, and a named grievance contact. Proceed only if the group gap closes to near zero after retraining, and only with consent in place.
3. The principal argues the system saves six minutes per class per day and asks you to recommend a course of action. What do you advise, and how do you frame the trade-off?
Read the worked answer
Quantify what is actually being bought. Six minutes per class per day across, say, 30 classes is three teacher-hours daily, real but not decisive. Set against it: a measurable inequality in who gets stopped, a biometric database the school cannot audit or delete, unconsented processing of children's data, and an irreversible harm if the templates leak. The trade-off is not 'six minutes versus nothing'; it is 'six minutes versus a remediable fairness and data-protection problem'.
My recommendation is to pause the face-only gate and run a parallel, non-biometric phase. Continue the pilot in shadow mode for four weeks: cameras do not gate anyone, attendance is still taken by card or roll call, and the vendor reports per-group accuracy weekly. Ask for on-device matching or school-held encrypted templates, a revised contract with retention and deletion, and per-group error under 1%.
If those conditions are met and consent is genuinely obtained, deploy with a card fallback that nobody has to justify. If they are not met, keep the card system. Attendance speed is worth solving; it is not worth solving with an unequal biometric gate.