Biometrics

General orientation, not legal advice; biometric rules differ substantially and some jurisdictions have specific statutes. Identity controls can be evaluated beside the scheduling workflow, but biometric templates require a much higher justification than ordinary operational records.

Where a system matches a face against a stored template, or models typing rhythm as an identifier, it is processing biometric data for identification. That is a distinct category.

Why it is treated differently

Biometric identifiers are permanent. A compromised password can be changed; a face cannot.

They enable identification across contexts the individual did not anticipate.

And the error rates differ by group, which makes the harms unevenly distributed — the skin tone note covers this.

Several regimes therefore require a stronger basis, and some require explicit statutory authority or specific consent.

The questions to answer first

Is a template stored, or is the comparison made and discarded?

Where is it stored, for how long, and who can access it?

Can a student require deletion after the assessment?

Is there a non-biometric alternative for a student who objects?

And has the necessity been documented specifically — not "for identity verification" but why a human document check is insufficient for this assessment.

The non-biometric alternative

For identity, one usually exists: a person compares a document to a face.

It is slower and it works.

An institution that cannot offer it has made biometric processing compulsory, which is a harder position to defend than it needs to be.

Behavioural biometrics

Typing rhythm and interaction patterns used as identifiers fall in the same category in several regimes, and institutions frequently do not realise this.

Given that the technique is also weakly supported — its own note covers that — the sensible position is to switch it off.

High legal bar, low evidential value, and it disadvantages assistive technology users. There is little to be said for it.

Specific statutes

Some jurisdictions have dedicated biometric privacy laws with private rights of action and substantial statutory damages.

Institutions operating across borders, or with students located elsewhere, may be subject to them regardless of where the institution sits.

This is a genuine and under-appreciated exposure for distance programmes, and it is worth specific advice rather than a general assumption.

Retention

Templates should have the shortest retention of anything in the system.

End of assessment period is a defensible default.

And deletion should be confirmed, including from supplier backups, for the reasons the retention note sets out.

The proportionality test in practice

High-stakes licensing exam, large cohort, remote candidates, real impersonation risk: the argument can be made.

Weekly class test: it cannot.

Applying the same identity flow to both is the commonest failure, and it is a configuration decision rather than a necessity.

What to check

Does your system store stored face template — do you know?

Which assessments use biometric identity checking, and was that decided or inherited?

Is a non-biometric alternative available?

And has anybody checked whether a specific biometric statute applies to your student locations?

The point

Behavioural biometrics carries a high legal bar and low evidential value, and it disadvantages assistive technology users.

There is little to be said for leaving it switched on.

Worth stating

Some jurisdictions have dedicated biometric statutes with private rights of action and substantial statutory damages, applying by where the individual is.

For distance programmes that is a genuine and under-appreciated exposure.

Also worth knowing

Templates should have the shortest retention of anything in the system, with end of assessment period as a defensible default.

High legal bar plus permanent identifiers makes this the one category where keeping data by default is hardest to justify.

And finally

High-stakes licensing with a real impersonation risk can justify biometric identity checking; a weekly class test cannot.

Applying the same identity flow to both is a configuration decision rather than a necessity.

Summary

Ask whether a template is stored and whether a non-biometric route exists. For identity checking one usually does, since a person can compare a document to a face.

In summary

Biometric identifiers are permanent, enable identification across contexts, and have error rates that differ by group.

That combination is why several regimes treat them as a distinct category with a higher bar. For wider institutional context, consult the National Institute of Standards and Technology.