2016 in review. What’s happened in pupil data privacy in England?

2016 was the year that every child’s Internet use has come under mandatory surveillance and recording, opening a slippery can of worms, risking a spiral of silence, with teachers turned into “frontline stormtroopers” shutting down debate. Safeguarding and well-being conflated with the Prevent agenda. All thanks to statutory guidance “New measures to keep children safe online at school and at home” that took effect from September 2016. Some schools stretch this snooping into personal devices, and the private life and family home, 24/7, 365 days a year. Big Brother Watch brought out a report in November on Classroom Management Software – Another Brick in the Wall. We believe there is much to be done on clarity of what information is being collected about pupils, by whom, when, where, why, and what it is used for.
2016 was the year we discovered that school census data was compromised in its collection purposes. Information about named individual children is being passed to the Home Office on a monthly basis, in an arrangement in place since July 2015, following the Immigration Taskforce discussions, in which the DfE and Home Office had reached an agreement to collect and share new nationality data from children from September 2016. Our efforts have been to encourage the Department for Education (DfE) to increase transparency of all third-party use of the National Pupil Database (NPD). We challenged the purposes of the expansion of the school census in the Statutory Instrument before it was laid in July and as soon as Parliament sat in September.
The House of Lords agreed a regret motion in the prayer period at the end of October: that this House regrets that information about pupils’ nationality and country of birth collected under the Education (Pupil Information) (England) (Miscellaneous Amendments) Regulations 2016 (Statutory Instrument 2016/808) could be used to help determine a child’s immigration status.
The policy brought criticism from the NUT, the UK’s largest teaching union, which called for transparency of all data use and consent, and brought condemnation from across opposition parties in the Commons, including the Lib Dems, from the Labour Shadow Secretary of State for Home Affairs and joint blanket policy statement from the Greens together with the SNP and Plaid Cymru.
Our timeline tells the story at-a-glance from the beginnings to today, and our latest briefing carries more detail including Freedom of Information requests, and questions and answers. The media reports cover the key events.
Together under the umbrella of the Against Borders for Children campaign with support from over 20 rights’ organisations, changes won on School Census since September 2016 include:

• Early Years collection scrapped: The government withdrawal of the plan to collect the new data from pre-schoolers (2-5 year olds) and Alternative Provision.
• Separate database: The data collected from 5-19 year olds has been stored in a separate database, reported Schools Week. It will be kept separately due to its ‘sensitivity‘ and not linked into the National Pupil Database, or be released in the same way as identifiable NPD data (i.e. to the press). Given the rise in xenophobic sentiment in the British media, as noted by the United Nations, rights’ groups share concerns about access by journalists.
• Right to retract data from autumn census:  Data submitted can be retracted on request via the new census update in Spring – however this is yet to be communicated to pupils, parents and schools, as far as we know.
• Nationality data will not be passed over to the Home Office: The Department published the MOU with the Home Office documenting the non – educational purposes of use since 2015 and plans to share nationality data in the same way, however the question remains, is it used within the DfE anyway for these purposes?

We continue to call for an end to the recently expanded census data collection of country of birth and nationality data for all children in England after confirmation that it was agreed in a compromise package of immigration control measures, not educational purposes or the well-being of children.

Transparency

The Department for Education agreed to publish steps towards improved public transparency on the uses of the national pupil database information about school children in England, collected since 2000 in state funded education, through the school census. A new document including a flow chart  shows some of how data moves across the national education system, the DfE published their DMAP Terms of Reference, they updated the Third Party Release Register on a more regular basis. And as part of the request release register, destruction dates are now published.
Using whatdotheyknow.com we established a current baseline measures and facts, on the size of the database and data request process. Releases of identifiable pupil level data, still have no clear ethical or privacy impact review criteria before release. The volume of each request is unknown when it comes to releasing millions of pupils data at a time and parents are refused Subject Access Requests so cannot establish the data accuracy or be told if their own or their child’s data has been released. There is unclear legal basis for the release of sensitive data.
The Government Internal Audit Agency (GIAA) had rated assurance as ‘Limited’ on NPD, on vetting and validation of applications to access the National Pupil Database, information retention procedures, and data handling guidance, and concluded that improvements were needed according to The DfE Consolidated Annual Report and Accounts 2014-15 published in April 2016, and the Director General for Regulation at the UK Statistics Authority [UKSA] called for the Department to improve transparency and data handling of the National Pupil Database.
But the important use of pupil data by the Home Office since 2015, was not willingly made clear until August under pressure for public transparency, after Freedom of Information requests and Parliamentary questions.
The school census expansion adding nationality data in the autumn census, and its collection by schools who were not given the full background on why data were being requested, meant many schools asked for passport data or misinformed parents and pupils they had no choice but to provide the personal data. Fair processing failed from children across England in the autumn census. It doesn’t look better for Spring 2017. We continue to suggest schools support parents and pupils rights to decline the new data collection, and make clear that they can opt out of providing this optional data without sanction, or ask for its retraction.

Security. Pupil data privacy and safe data, safe access, safe users

In September 2016, the Department for Education tasked the Open Data Institute with work to look at better privacy preserving models of data access. This positive work will continue into 2017 and we aim to secure solutions soon for the safe use of pupil data, in safe settings with a system of safe users using safe data, transparent use, and fair data collection. We will continue to support the DfE and the NPD Steering Group.

Fair processing and consent

The lack of fair processing and overruling parents and and pupils’ consent in pupil data collection has been highlighted in the autumn census 2016, through the expansion of country of birth, nationality and expanded language and ethnicity data. There is a lot of work that needs done on improving the clarity of necessary and required data for schools, parents and pupils to make informed decisions on providing it.

2016 in summary

In 2016 we’ve begun work upon which we will build in the coming year in transparency, safe data use, and fair processing, particularly around school census, and new legislation that adds new datasets or expands the purposes of their use, under the Department for Education.
While much of our direct work with the Department has been highly positive, we hope next year brings fewer surprises.
We thank all our supporters, and campaigners, and all those in 2016 who have contributed to what has been achieved this year to make the collection and use of pupil data better, and safer.
We depend on your support in much of our work, and we look forward to defending better pupil privacy together in the next twelve months, for the rights and autonomy of all children and young people in England, and for long term public benefit, some of which we include in our next post. Here’s to 2017.

---

Selected blogposts:

January 2016: National Pupil Database – using data from the School Census
February 2016:
Twenty million pupils’ identifiable data handed out from the National Pupil Database
and Scope creep in National Pupil Database now means names released
April 2016: Parallel processes will not work for Pupil Data (With reference to the Digital Economy Bill)
and Three Strides towards Transparency
June 2016:
Rights and obligations under the Data Protection Act for processing sensitive data
and  Schools must collect extra census data for children from autumn
July 2016: School census changes add concerns to the richest education database in the world (LSE DIgital Parenting blog)
and Pupil data collection turns Kafkaesque in 2016-17 school and early years census
August 2016: Home Office and Police have accessed data from the National Pupil Database
September 2016: Responses to controversial new law: changes to the school censuses 2016-17
and Ten Reasons Why we Shouldn’t Collect Every Child’s Country of Birth in Schools
School census expansion summary: Further details and links in our 2016-17 school census timeline and end of year overview briefing.