The child is not the mere creature of the state: No2NP ruling and the right to a private and family life

A significant ruling in the UK today, struck out at the invasive data sharing planned for children in Scotland. It will likely have implications for other data sharing from children in England, current and future.

We have previously asked for a review of the legal basis for the data giveaway to third parties from the National Pupil Database in England – including confidential and sensitive personal data.

Sensitive data appears to be handed out by the Department while not meeting data protection duties.

The current change underway in the national school census in England will mean the national database will collect, store and share country of birth and nationality information from every child aged 2-19, from autumn 2016.

These data will be extracted through schools information management systems (SIMS) either directly or via the local authority in the school census and early years censuses [read our summary] and there are growing concerns about this change as a significant invasion of privacy [read the article on the LSE digital parenting blog].

Yesterday’s Supreme court ruling for the Scottish Named Persons scheme reiterates the Data Protection requirements that:

“For example, the second principle is that personal data must be “collected for specified, explicit and legitimate purposes and not further processed in a way incompatible with those purposes”.”

We do not agree that in England those purposes are compatible with the purposes that parents give their child’s personal data to school: for the direct purposes of their education. And for this particular case right now, the collection of country of birth, most forms we have seen make no mention of any purposes at all.

Schools’ Minister Nick Gibb’s stated last week that: “The data will be collected solely for the Department’s internal use for the analytical, statistical and research purposes described above. There are currently no plans to share the data with other government departments unless we are legally required to do so.

However, he also confirmed that, “There are currently no plans for the Department to change the existing protocols and processes for the handling and disclosure of confidential information.”

Since all the sensitive and confidential data in the National Pupil Database of 20 million people are shared with a long list of third parties, including commercial companies, charities and other government departments, we await an explanation of how these new items, will be made different, in law, to prevent onward sharing of country of birth, compared with everything else. Saying ‘unless we are legally required to do so‘ when today’s law already allows it means little.

The judgment in the Named Persons case, “(1) The Christian Institute and others (Appellants) v The Lord Advocate (Respondent) (Scotland)”, was streamed live on the Supreme Court website has put into question the validity of the law that enabled the data access it would mean.

Judges in the UK Supreme Court have said that the Scottish law, changed last year to enable this new plan from the end of August 2016,  is after all, “defective” for a breach of Article 8 of the European Convention on Human Rights (ECHR), that guarantees everyone’s “right to a private and family life”.

They declared a law which allowed public bodies to share sensitive private information about children and parents without consent went beyond the powers of the national lawmakers in Holyrood.

The lack of safeguards which would enable the proportionality of any interference with Article 8 to be adequately examined [83-84] were also of concern.The examples was used of information, including confidential information concerning a child or young person’s state of health (e.g. as to contraception, pregnancy or sexually transmitted disease), which could be disclosed to a wide range of authorities without either the child or young person or their parents being aware of the interference with their Article 8 rights, and in circumstances in which there was no objectively compelling reason for the failure to inform them.

In order for that interference to be “in accordance with the law” (for the purposes of Article 8(2)), the measures must not only have some basis in domestic law but also be accessible to the person(s) concerned and foreseeable as to their effects. Accordingly, as currently drafted, the information sharing sections of Part 4 and the Guidance do not satisfy the requirement of being “in accordance with the law” [85].

Because of the lack of safeguards “the overriding of confidentiality is likely often to be disproportionate” (Para. 100).

To read the judgment or see the hand down visit the UK Supreme Court website.

The judges in the No2NP case quoted from a US Supreme Court judgment in their ruling which states: “The child is not the mere creature of the state.” (Para. 73). We agree.
Congratulations to No2NP and all their supporters.

[source: No2NP – Victory! 28 July 2016]