Microsoft Teams Collection of Students’ Biometric Data Provokes Concern in NSW

Microsoft’s voice and face enrollment feature in Teams has come under scrutiny in New South Wales (NSW) after it was discovered that the technology had been enabled by default across public schools without prior approval from the state’s Department of Education. The feature, designed to improve meeting experiences by enhancing speaker attribution and audio clarity, operates by creating a biometric profile using a user’s facial and voice data.

Microsoft describes the tool as a way to improve transcription and reduce background noise during Teams meetings, especially in rooms equipped with Microsoft Teams Rooms devices. According to official documentation, users retain full control over their biometric profiles and can opt out at any time through the Teams desktop client. Admins and security teams are also able to manage whether enrollment is enabled or disabled for specific users.

In this case, the NSW Department of Education was not notified before the feature was activated in March of this year. The department became aware of the situation in early April and took immediate steps to disable the setting and ensure that any voice or facial profiles previously created were deleted. “The Department of Education does not collect student biometric data. Any face or voice recognition profiles that were created have been removed,” a spokesperson confirmed.

The rollout has sparked criticism from some public figures and advocacy groups, not because of how the technology functions, but due to the lack of transparency and oversight. Shadow Education Minister Sarah Mitchell called the incident “a complete breach of privacy and trust,” and questioned why parents and students had not been informed. “Not only do we not know how long the data was held, but we also have not been told what the data was used for while it existed,” she said.

Microsoft’s data retention policy states that biometric data is typically stored while a user remains enrolled and is deleted within 90 days of account deletion. However, the department has not disclosed how many users were affected or whether direct notification has been provided to families or school staff.

The incident comes amid a broader discussion in Australia about data governance and digital safeguards in public institutions. While the Teams feature may be common in enterprise environments, its introduction into public schools without administrative oversight has renewed calls for clearer policies around default settings, especially where biometric data is involved.

Sources: The Australia Today, Information Age

—
May 20, 2025 – by Ji-seo Kim