In late September, the NY State Education Department issued a two-page order providing that NY public schools may not purchase or utilize facial recognition technology. The Department relied on a report issued by the NY Office of Information Technology Services in August that was critical of the privacy implications of facial recognition technology, but left open the door for the use of other types of biometric technology in schools.
The Department's actions followed on litigation that began in 2020 after an upstate school district began implementing a facial recognition system intended to identify potentially threatening non-students on school premises. After the litigation began, the state legislature enacted a moratorium on facial recognition technology while the State Education Department and Office of Information Technology Services conducted further research and issued a final decision.
In its report, the Office of Information Technology Services focused heavily on potential impacts to student privacy as well as equity concerns, noting that research on facial recognition technology has noted the possibility of higher rates of incorrect identification on people of color, non-binary and transgender individuals, women, the elderly, and, importantly, children. The report likewise expressed significant concerns over the possibility of breaches to biometric databases that would be needed to make the facial recognition technology work, noting that because biometric information generally cannot be changed, the disclosure of biometric data could potentially put users at permanent risk.
Ultimately, the report was less critical of non-facial recognition biometric technology, such as the use of digital fingerprinting. The Department's order potentially allows for the use of such technology, as it authorizes school districts to "determine whether to use biometric identifying technology other than facial recognition technology at the local level."
Similar debates are taking place at the local level in other states, too. Montana, for example, has recently begun to utilize facial recognition technology for security purposes in several small school districts. Though there is no over-arching federal policy on the use of facial recognition technology in schools, the Federal Educational Rights and Privacy Act ("FERPA") does require certain protections for "biometric records" of students, which can include, among other things, "retina and iris patterns" and "facial characteristics." That said, FERPA does not have highly built-out requirements in relation to privacy and data security (in the way that, for example, HIPAA does in the health context), and the potential for data breaches to occur figured heavily in the Department's analysis as well as other state-level debates about facial recognition.
We expect these debates will continue as schools continue to search for technologies that enhance security on campus, while attempting to balance the need for security with the various other issues presented by facial recognition technology.
To view Foley Hoag's Security, Privacy and The Law Blog please click here
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
