A school used facial recognition tech for cafeteria payments. An internet law expert says it's rarely worth the risk.

• A school in England broke the law for using facial recognition technology for lunch payments.
• The UK's data protection regulator reprimanded the school for not assessing the risks to the students' information.

A school in England broke the law when it introduced facial recognition technology to take student lunch payments.

The UK's data protection regulator issued a formal reprimand to a 1,200-pupil high school in Essex, a county in southeast England, for not conducting a data protection impact assessment before installing the FRT.

The assessment looks at the risks associated with processing sensitive data and establishes how to manage them.

The Information Commissioner's Office said the school for kids aged 11 to 18 did not have explicit permission to process their data.

"Handling people's information correctly in a school canteen environment is as important as the handling of the food itself," Lynne Currie, the head of privacy innovation at the ICO, said.

"We've taken action against this school to show introducing measures such as FRT should not be taken lightly, particularly when it involves children," she added.

Does a school need facial recognition technology in its cafeteria?

"I think there is a question lurking around in the background about to what extent the use of automated facial recognition for something like making it easier to run your school canteen is really proportionate," Professor Lorna Woods, a professor of internet law at the University of Essex, said.

Professor Woods said no matter how reputable the company providing the technology may be, there is always a risk when using this technology — especially regarding the possibility of hackers, the onward use of data collected, and biased profiling.

There are practical questions about where the data is going and what it's being used for, she said.

"Schools should be places of openness and trust," she added, outlining that turning them into "the panopticon" with these technologies could be at odds with this aim.

She said one of the real problems with this tech is that, unlike having to pick a new password if an online account is breached, your facial markers analyzed by this tool are very difficult to change.

Chelmer Valley High School did not respond to a request for comment from Business Insider.