[Reference: https://www.jdsupra.com/legalnews/let-s-face-it-facial-recognition-1134180/, The use of facial recognition technology to track student attendance involves the processing of biometric data, which is a special category of personal data under the GDPR. Such data can only be processed under certain conditions, one of which is the explicit consent of the data subject1. Therefore, the school may provide a lawful basis for this processing if it obtains the explicit consent of the students (or their legal guardians, if the students are minors). The consent must be freely given, specific, informed and unambiguous, and the students must have the right to withdraw their consent at any time2. The other options do not provide a lawful basis for this processing, as they do not meet the requirements for processing special categories of data. Placing a notice near each camera does not constitute consent, nor does it comply with the transparency principle3. Processing for the legitimate interests of the school may be a valid basis for processing personal data in general, but not for processing biometric data, unless it is authorised by a specific law that provides suitable safeguards4. A state law that requires facial recognition to verify attendance may also be a valid basis for processing personal data in general, but not for processing biometric data, unless it is necessary for reasons of substantial public interest and provides suitable safeguards5. References:, Free CIPP/E Study Guide, page 24, section 3.2, CIPP/E Certification, page 19, section 3.2, Cipp-e Study guides, Class notes & Summaries, page 17, section 3.2, Special categories of personal data - General Data Protection Regulation (GDPR), Article 9, Consent - General Data Protection Regulation (GDPR), Article 7, Principles - General Data Protection Regulation (GDPR), Article 5, Lawfulness of processing - General Data Protection Regulation (GDPR), Article 6, Special categories of personal data - General Data Protection Regulation (GDPR), Article 9, ]
