Fingerprint attendance in a Gozo secondary school

The claim about personal data is wrong. A fingerprint template is biometric data used for unique identification, so it is a special category of personal data under GDPR Article 9. Encryption is a security measure, not an exemption; encrypted data remains personal data while the key exists and re-identification is possible.

Consent is a weak basis here. Article 9 requires an explicit condition for biometric processing, and consent must be freely given. Attendance at school is compulsory and the scanner is presented as the default, so a parent who opts out may feel pressure or be treated differently; that undermines freeness. Children require additional protection under Article 8, and the relationship between school and parent is unequal. For a school, a statutory public-task basis may exist for attendance, but biometric identification still needs a specific legal condition and a necessity and proportionality test, which a fingerprint gate is unlikely to satisfy when simpler methods work.

Other failures: keeping templates for a school career plus five years breaches storage limitation; a US processor needs a transfer mechanism and a written processor agreement; the DPIA is factually inaccurate and cannot support the decision.

Incident handling: the USB stick is a personal data breach. The school should recover and securely erase it, preserve evidence, record the incident in its breach register, and assess risk. Because biometric templates were exposed in a staff area, notification to the Information and Data Protection Commissioner within 72 hours is likely required, and affected parents should be informed if there is a risk to their children's rights. Disciplinary and retraining action for the teacher follows the school's policies.

Why it matters: although a template is not a fingerprint image, it is derived from one and can enable linkage or spoofing attempts; the loss is not harmless because the data cannot be reissued like a password.

Measures before deployment:

• Prohibit removable media and bulk export; use encrypted, access-controlled on-device matching where the template never leaves the scanner.
• Encrypt at rest and in transit, with keys held by the school, not the vendor.
• Role-based access, audit logs, and a defined retention period such as one year after leaving.
• A processor agreement, transfer assessment for US hosting, and a corrected DPIA.

None of this fixes a fundamentally unnecessary design; the measures reduce harm but do not establish necessity.

Recommendation: do not proceed with fingerprint attendance. The necessity test fails because attendance can be recorded with less intrusive means, and the consent model is not freely given for compulsory schooling. Proceeding would create a special-category processing operation with a documented breach history and a defective DPIA, which is a poor position for the school and for the students.

Alternative: issue each student a contactless smart card or use a staff-supervised barcode/QR scan at the gate, with the register reconciled in the school information system. This achieves the same attendance record without biometrics and without US-hosted templates. If the school wants stronger assurance, a supervised roll call at form level already exists and costs nothing extra.

Using the committed budget: redirect the 12 scanners to card readers if the supplier allows a swap; otherwise treat the spend as a sunk cost and document the decision. Run a small pilot with one year group, publish a retention schedule, and review after a term. The ethical point is that convenience for administrators does not outweigh a permanent biometric identifier for a child, especially where a less intrusive option exists.