Policy - CCTV Facial Recognition

1. Introduction

The purpose of this policy is to outline the schools use of facial recognition technology (FRT) to support security, attendance, and operational efficiency while respecting the privacy rights of students, staff, and visitors in confluence with Thailand’s Data Protection Act (PDPA)

2. Scope

This policy applies to:

• All students, staff, and visitors whose facial data may be collected or processed
• All systems and platforms using facial recognition technology on campus
• Any third-party vendors engaged in FRT services for the school

3. Legal

• Facial data used for identification is considered sensitive personal data under section 26 of PDPA
• Processing on sensitive data requires explicity, written consent from the data subject or their legal guardian
• The school will follow principles of necessity, proportionality, transparency and security.
  
  

4. Permitted Use Cases

Facial recognition technology may only be used for the following purposes:

• Use Case
  • Campus Access Control for enhanced physical security ( Consent required; opt-out available )
  • Attendance Tracking (Secondary School Years Only) for enhanced physical security (Not used in Primary Years)
  • Visitor Management System for Security screening (Temporary data only)
  • Safeguarding for  Missing student who may present a danger to themselves (Not used if there is no evidence of intention to self harm)
  • Violent Intruder for Quickly locating intruders on campus (Temporary data only)
    
    

5. Prohibited Use

Facial recognition will never be used for

• Behaviour monitoring or emotional analysis
• Covert surveillance 
• Classroom observations
  
  

6. Consent and Notification

The school will obtain explicit written consent form:

• Parents/guardians for students under 20 years of age
• Staff members and adult visitors
• All affected individuals will be provided with:
  • A clear explanation of the technology and its purpose
  • A copy of the schools Privacy Notice
  • The option to opt out and use alternative identification methods

7. Access and Retention

Facial recognition data will be:

• Stored in encrypted form (facial templates, not raw images)
• Hosted on secure, access-controlled servers
• Retained only for the duration necessary to fulfill the stated purpose
• Automatically deleted after a maximum of 30 days, unless needed for investigation compliance

8. Data Protection Compliance

• All data access will be logged and monitored
• The Data Protection Officer will oversee the FRT related processing and review the system integrity annually
  
  

9. Rights of Data Subject

• All individuals (or their guardians) have the right to:
  • Access their facial data
  • Correct any inaccuracies 
  • Withdraw consent at any time
  • Request deletion of their data (subject to legal and operational constraints)
  • Requests can be made through the data protection request form