evidoria

← Back to browse

Good practice Imported

Chelmer Valley High School — ICO Reprimand for Unlawful Facial-Recognition Canteen Payments

United Kingdom · Chelmsford · See the United Kingdom profile

Evidence: Descriptive / self-reported · Ask Evidence Copilot about this practice

Chelmer Valley High School in Essex used CRB Cunninghams facial-recognition tech for cashless canteen payments from March 2023 without a completed DPIA. The UK ICO reprimanded the school in July 2024 for invalid consent and an 8-month compliance gap.

8 months
Months between deployment and completed DPIA (March 2023 - November 2023)
Chelmer Valley High School — ICO Reprimand for Unlawful Facial-Recognition Canteen Payments

Details

Promoter
Chelmer Valley High School (technology supplied by CRB Cunninghams)
Period
March 2023 – July 2024
Keywords
K-12 secondary education, biometric payments, data protection

Context

In March 2023, Chelmer Valley High School in Chelmsford, Essex, began using facial-recognition technology supplied by CRB Cunninghams to process cashless canteen payments for students.

Objectives

Enable faster, cashless canteen payments using facial recognition instead of cards or PINs.

Activities

The school had not completed a Data Protection Impact Assessment (DPIA) before deployment; its DPIA was finalised only in November 2023, eight months after the system went live. Parents were sent an opt-out letter rather than being asked for affirmative opt-in consent, which the UK Information Commissioner's Office (ICO) found invalid under UK GDPR since most affected students were old enough to give their own consent.

Results

On 2 July 2024 the ICO issued a formal reprimand and required the school to complete a new DPIA assessing the necessity and proportionality of cashless catering and to address bias/discrimination risks in the technology before further processing. No financial penalty was imposed.

Conclusions

The case is recorded as a documented governance failure rather than an evidenced-impact success.

Implementation
Indicative cost
Low (< €50k)
Time to results
Short (< 1 year)
Staffing & skills
Chelmer Valley High School administration, CRB Cunninghams (technology vendor), UK Information Commissioner's Office (ICO), as regulator

Conditions for success

  • Completing a DPIA before deployment, not after
  • A genuine opt-in consent process for students old enough to consent themselves
  • Assessing bias/discrimination risk in the facial-recognition technology before rollout

Common failure modes

  • DPIA completed 8 months after go-live rather than before deployment
  • Opt-out (rather than opt-in) consent letters, found invalid under UK GDPR
  • No documented assessment of bias/discrimination risk before the ICO required one

Where it fits

Governance type
single secondary school + private vendor
Scale
single school
Income level
high-income (UK)

Do you run this practice? Claim it — verified implementers get a public contact pathway and can propose corrections.

Data sources

Where this practice's information was retrieved from, and when.

Attachments

Similar practices you may find useful