Face-recognition attendance gate in a school with no biometric policy
A government-aided higher secondary school with 96 staff (teachers and non-teaching) installs a vendor-supplied face-recognition gate to mark staff attendance. The headmaster signs a one-year contract after the vendor shows a benchmark sheet claiming 99.2% accuracy. During a ten-day trial the gate logs 94% correct identifications overall, but teachers who wear a headscarf are recognised correctly only 88% of the time against 97% for other staff. There is no written consent form; staff are told that refusal will be treated as absence. Photos and 128-dimensional embeddings are uploaded nightly to the vendor's cloud server, and the contract does not state a retention period or a deletion process. Attendance already feeds monthly salary processing, and three teachers have lost a day's pay after the gate failed to open. The school has no separate budget for an alternative, and the state education department has not issued any biometric policy.
1. Classify the ethical problems in this deployment. For each, name the principle at stake and point to the specific fact that triggers it.
Read the worked answer
Consent and voluntariness. Treated as absence if refused means any 'consent' is coerced, so it is not consent. Biometric data is sensitive personal data; it needs a free, informed, specific, written choice, plus a genuinely equivalent alternative.
Fairness and non-discrimination. 88% versus 97% is a nine-point error gap attached to a characteristic (wearing a headscarf) that is protected in many jurisdictions and, regardless of law, is not something the teacher can or should have to change. The harm is not the average; it is that members of one group are systematically more likely to be marked absent by a machine.
Distributive impact on livelihood. The error cost lands on salary. Three teachers have already lost a day's pay for a system failure they did not cause, which converts a technical error rate into lost income.
Data minimisation and storage limitation. Raw photographs plus embeddings sent nightly to a third-party cloud, with no stated retention and no deletion process, exceeds what attendance marking needs. Verification on-device, storing a template locally, would achieve the purpose with far less exposure.
Accountability and transparency. The contract is one year with no performance guarantee, no audit right, no breach-notification clause. There is no grievance route, no named person responsible, and no written policy from the department. If the model errs, no one owns the decision.
Proportionality. The purpose is attendance, which an ID card or a signed register achieves with no biometric risk at all.
2. Recommend an immediate decision with concrete mitigations, and state what evidence would justify expanding the system later.
Read the worked answer
Immediate decision: suspend the gate as the sole record of attendance, not the whole project. Keep the hardware, but until conditions are met, every staff member has an equal-outcome alternative (card tap or signed register) that carries no penalty, and no pay deduction is made while an attendance dispute is open.
Mitigations, in order of urgency.
- Restore the three deducted days and set a standing rule that a failed identification is recorded as 'system error, attendance assumed present pending review'.
- Replace implied consent with a written, plain-language notice: what is captured, where it goes, how long it is kept, who can see it, how to withdraw, and what happens to the stored template on withdrawal.
- Stop uploading raw photographs. Store only encrypted templates, on a school-controlled machine, with 90-day retention for audit and automatic deletion on withdrawal, plus a deletion certificate from the vendor.
- Enrolment quality first: multiple enrolment images per person, including with head covering, glasses and typical lighting, and a re-enrolment session for anyone the gate fails twice.
- Independent re-test on the school's own staff with per-group results and confidence intervals; publish the numbers to staff.
- Contract amendments: audit right, accuracy floor with service credits, breach notification within 72 hours, data return and destruction at exit, and named responsibility for errors.
- Escalate to the district education office asking for a written biometric policy, since the school cannot settle the legal basis alone.
Evidence that would justify expansion: a re-test on at least 90 staff over at least 20 working days, showing an error gap between groups of no more than 2 percentage points, a false-reject rate under 2% overall, no pay deductions caused by the system, executed consent from all enrolled staff, and a signed contract that answers the retention and deletion questions.
3. The vendor repeats the 99.2% claim. List the questions you would put in writing before the school accepts that figure.
Read the worked answer
What exactly was measured? Accuracy of 1:1 verification against a claimed identity is a different and much easier task than 1:N identification at a gate. Ask which one, and at what decision threshold.
On whom? Ask for the benchmark population: number of subjects, age range, gender split, skin-tone range, whether people wearing headscarves, turbans, spectacles or hearing aids were included, and the lighting and distance conditions. A benchmark that excludes the group with the 88% score cannot support a claim about this school.
How many people and how many attempts? 99.2% from 10,000 attempts is not the same as 99.2% from 30 people. Ask for the number of subjects and the per-subject spread, and for false accept and false reject rates separately, not a single blended accuracy.
Which failure is included? Ask whether the figure counts failures to enrol, failures caused by poor lighting, and liveness/spoof rejections, or only successful captures.
Was it independently run? Ask whether the test was internal. Request the protocol and, ideally, an independent audit.
Then set the local standard: 'We will run a 20-working-day test on our own 96 staff, with results reported separately for staff who wear a headscarf and those who do not, with confidence intervals, and we will judge the contract on that test, not on your sheet.' With roughly a dozen staff in the smaller group, ten days of data yields very wide intervals, so the school should not accept a two-point-looking difference without those intervals being shown.