Fingerprint attendance at the sixth form
A sixth form college in Malta wants to replace paper attendance with fingerprint scanners at the entrance. There are 240 students, 3 scanners costing €6,000, and the college reports that 2% of lessons are missed through 'buddy punching' - students signing in for absent friends. The principal proposes storing fingerprint templates and attendance records indefinitely, sharing weekly absence lists with parents by email, and using attendance data to decide which students get a €300 travel bursary. The Students' Council objects; some parents say they will refuse. The college already issues RFID student cards, but students share them. Under GDPR, biometric data used for unique identification is special category data. The college is a public educational institution and is the data controller.
1. Advise the principal on whether the fingerprint scheme should proceed as proposed. Your answer should weigh necessity, proportionality, legal basis and the availability of less intrusive alternatives.
Read the worked answer
It should not proceed as proposed. Fingerprint templates used to identify students are biometric special category data, so the college needs a lawful basis plus an Article 9 condition, and it should carry out a data protection impact assessment because the processing is systematic and involves a vulnerable group. A DPIA is not a one-off form: it must genuinely test necessity and proportionality.
The problem is a 2% buddy-punching rate. Less intrusive measures exist: staff checking cards against a photo, random spot checks, lesson-by-lesson sign-in, or an RFID card with a photograph and a rule that a card cannot be used by anyone else. These may be sufficient, and they avoid storing biometrics. The college should pilot a less intrusive option first and measure whether it reduces buddy punching.
Indefinite retention fails the storage limitation principle. Sharing weekly lists with parents by email needs a lawful basis and security controls, including checking the recipient and avoiding unnecessary detail. Using attendance data to award a €300 bursary is a new purpose; the college must check that it is compatible with the original purpose and tell students and parents in advance. If biometrics are still considered after the DPIA, the college needs specific legal advice on the Article 9 condition and must offer a genuine alternative for anyone who refuses.
2. Explain why relying on student consent for fingerprint scanning is problematic here, and describe safeguards that would be needed if the college nevertheless introduced biometric attendance.
Read the worked answer
Consent must be freely given, specific, informed and withdrawable. In a college, students may feel that refusing will mark them out, affect their attendance record or their bursary, and staff may pressure them to enrol. That power imbalance makes consent weak, especially for a scheme presented as the normal way to register attendance. Consent also has to be a real choice, so there must be an equivalent alternative that does not disadvantage the student.
If the college proceeds, safeguards should include: storing irreversible templates rather than fingerprint images; encrypting them and restricting access to named staff; deleting templates when a student leaves; publishing a clear retention period for attendance records rather than keeping them indefinitely; a DPIA and a record of processing; a contract with the scanner supplier covering security and deletion; a breach procedure; and a simple way to correct errors. Students and parents need a plain-language notice explaining what is collected, why, who sees it, how long it is kept and how to complain. The bursary decision should be separated from biometric attendance unless the legal basis and notice clearly cover that use.
3. Design an evaluation plan for the attendance pilot. State the baseline, the metrics and the success criteria you would use to decide whether to continue.
Read the worked answer
Start with a baseline: the current buddy-punching rate, measured by unannounced spot checks over several weeks rather than by staff impression. Record the number of students late or absent, the time taken to enter, and the number of card-sharing incidents.
During the pilot, measure the same buddy-punching rate, false accept and false reject rates, average entry time, queue length at the scanners, the number of students opting for the alternative, complaints, and any data-protection incidents. Compare attendance accuracy against a manual register for a sample of lessons. Cost per student should include the €6,000, installation, support and staff time.
Success criteria should be agreed in advance, for example: buddy punching falls by at least half without increasing lateness or exclusions; false rejects stay below an agreed level; no unresolved privacy complaints; and the alternative is used without penalty. If the less intrusive RFID-with-photo option achieves similar results at lower cost and lower privacy risk, that is the option to continue with.