In 2017 what’s next for us in pupil data privacy in England?

We are delighted to kick off 2017 by participating in the Against Borders for Children event on January 14, talking about the census in context, where it fails children’s privacy, what better data collection would look like, and a workshop on what you can do about it. Sign up for the free event at EventBrite including panel talks, time for questions and answers, workshops to get organised and tools for getting involved. We all hope to see you there.

On school census collection and the National Pupil Database

We will continue to challenge meeting the basic questions of fundamental rights about all children’s data privacy in the school census collection, including the new sub-set expansion on nationality data, and seek improvements:

• Is it fair? The legality of the collection process is doubtful where parents and pupils are not properly informed about who will use the data, it is being used for many purposes that are not explained, including non-educational uses, and rights to object and opt out of collection have very often not been communicated, across the country.
• There is significant interference in private and family life in both collection and through use of data, in Home Office use, but also more generally where named data have been used for mailshots linked to health data and social science surveys, or maths tests, without consent.
• A privacy impact assessment for the whole National Pupil Database (NPD) has never been done. We continue to ask it should be, and that the privacy aspects of pupil data collection and use should be reviewed for impact on human rights.

We continue to recommend pupils and parents opt out in 2017 of the optional submission of nationality data by letting the school administrator know that they decline to provide country-of-birth, nationality and expanded language data, ethnicity is not new but can also be declined. Anyone who has provided it in the past, may still ask the Department for Education to overwrite data already collected, by asking their school to record ‘not yet obtained’ or ‘refused’ which, the Department says, will be honoured in the data collection of January 19, the upcoming Spring 2017 census on roll day.
While fixing the Home Office ethical and practical applications of government policy is outside our remit, we do stand for good data practice and will continue to speak out and aim to effect change where other Departments’ measures interfere with this. We will continue to call for an end to the collection and use of the country-of-birth and nationality collection, as part of Home Office measures because:

1. Doing nothing means acceptance of this misuse of public and professional trust.
2. Doing nothing means acceptance of Department for Education reputational risk.
3. Doing nothing means that the school census data collection loses all current and future integrity and acceptance of its long term damage to the integrity of national statistics.

We continue to pursue the business case for the expansion, to find out the costs of the change to schools and Local authorities since the Lords Secondary Legislation Scrutiny Committee was told by the DfE:  “All amendments to DfE data collections considered by the SCSB are supported by a detailed business case. As part of the SCSB business case, there is consideration of the cost to schools and local authorities of complying with the request for data (known as the compliance cost) and this is weighed up by the board against the benefits of holding/collecting the data.”
We have asked the Department for information about what the Star Chamber Scrutiny Board (SCSB) was told, and find out whether they are approving the expansion of the state database with full knowledge of its purposes or whether these had been withheld from them. We are pursuing this and will establish the current process, to ensure any future expansion has a transparent sign off procedure with oversight.
We are looking for a commitment to clearer consent and fair processing from the Department in school census collection, that will establish good practice in preparation not only the letter of the law, but the spirit of the GDPR towards children and use of all their personal data collected in schools.
It’s not only about respecting the rights of the child, autonomy, and safe use of personal data in trust. Data used well underpins digital plans for government and can improve decision making, research, and involvement of parents and governors at school level. Ignoring consent, puts these benefits at future risk.

Addressing three legislative bills that remove student privacy, by design

To secure long term benefits of the use of administrative data for the public good, upcoming legislation affecting student data must take privacy into account adequately.

The Higher Education and Research Bill waters down Applicants’ personal data privacy. And the Technical and Further Education Bill for Apprentices, and FE Students is worse. Both expand the purposes to which Applicants or Apprentices and FE Students may be put. The HER Bill (Part 3 Research sections 73 and 74 powers to obtain and use application-to-acceptance information) brings UCAS held data under the control of the Secretary of State for Education for the first time, in perpetuity. Further amendments have been proposed in the Lords to clause 9 (a transparency duty) which raise privacy issues for students.
Users of the data whether for commercial products or public interest research argue there is reluctance on the part of UCAS to release data for commercial competition reasons, on which we take no position, but on data privacy the bills are disastrous. Although UCAS had strong support for their position at Committee stage from a number of opposition MPs and the Minister made a statement which clarified and put into the Parliamentary record the government’s intention with regard to the provision of admissions data, it made no change to the face of the Bill.
Past record shows that this is not enough. When the National Pupil Database began to collect children’s names with their detailed records, MPs promised that the government was not interested in using them. Today the Home Office has access to named children’s school and home address from the NPD, and names are used by other government departments, for linkage across other datasets, as well as being used by academic researchers through access to identifiable data directly from the DfE.
The issues in the HER Bill in the now labelled clauses 73 and 74 are similar across the bills, and solutions summarised in our brief 3 page consultation submission on the Technical and Further Education Bill could be considered for all.
DfE currently holds only a subset of FE and HE data.  Millions of people will have their right to privacy of their personal data impinged on,  if these bills go ahead unchanged. Our personal data will be used by third parties without consent, or record of who used it, why, or for what public benefit.
Combined with the Digital Economy Bill’s open ended purposes, these new legislation on student data, means the Secretary of State could agree to pass these data on to every other government department, a range of public bodies, and some private organisations. Safeguards and oversight are needed. Unchecked these Bills create the conditions needed for catastrophic failure of public trust.
If the Home Secretary has put international students at the centre of her plans to cut migration this should be deeply worrying. Will the MOU between the DfE and the Home Office Removals Casework team be a model for access to all areas of education data, or even all public administrative data?
As regards the specific opposition amendment proposed at the last minute in the final reading in the Commons in the Digital Economy Bill on automatic registration for Pupil Premium: if this amendment to the government plans is taken up in Lords committee stage, we’ll be asking for changes to ensure the intentions can be met and also retain the privacy rights of the public. (It is worth noting it was already discussed and excluded from the legislation during the open government policy making planning for the Bill, over the last 2 years.)

Pupil data privacy and DfE data access infrastructure

In September 2016, the Department for Education tasked the Open Data Institute with work to look at better privacy preserving models of data access. This positive work will continue into 2017 and we aim to secure solutions soon for the safe use of pupil data, in safe settings with a system of safe users using safe data, transparent use, and fair data collection.
This will mean changes to current practice in which identifiable data are released into-the-wild and more efficient ways for the Department to ensure data retention and destruction are managed, other than individual audit on a frequent basis. We will continue to support the DfE NPD Steering Group in its change and intent to become a leading Department in good practice in safe data, transparent use, and fair data collection within an expectant framework of the GDPR. As the DfE hopes to embed data in parents understanding of education in a parents portal, and increase the use of research and data, these improvements will not be an optional extra, but be fundamental if their data plans are to bring about the benefits they want, and reduce risk.
When it comes to linkage including education data in other datasets, such as in master child health records. we’ll be looking to see good consent practices adopted in any new policy for newborn screening starting in 2017 and ensure safeguards are in place for some of our children’s most sensitive data uses. 

The year ahead

There’s lots to be done in 2017 to protect pupil privacy and to improve young people’s data handling at, or coming under, the control of the Department for Education. The lack of complete honesty by government Ministers about Home Office and other government department use when asked about the census expansion means we will be looking for pro-active cooperation in the year ahead, to ensure there are no more surprises.
As part of the NPD Steering Group, we will continue to offer independent advice on privacy and play the role of critical friend when called on.
We will be attentive and active to ensure that we are not only looking at what is, but alert to what is planned and what might be. State databases used in secret have been used to do harm throughout history. As Kershaw said, “the road to Auschwitz was built by hate, but paved with indifference.” As current legislation is written, it must not only about data collected in the past, but think ahead to include privacy by design, for future governments and future policies. This year’s events in politics at home and abroad should serve to show how much that matters. We care about pupil privacy, and good data management, in policy and practice not because it’s about privacy, but because data is about people and the use of it affects individual lives. We are building on what many others have worked on before us, and we are grateful for their continued support.
What can you do? You can come and find out more at the event on the 14th. Sign up for the free event at EventBrite. You can also take action and follow the ABC Schools Campaign for template letters and work together to stop the collection of children’s nationality and country of birth information in schools. You can write to Lords on the three bills currently in Parliament. You can tell your school and parents about the school census, that it is optional and that they can decline or retract data submissions. Then tell your friends, tell your school, the governors, and ask your MP for support. If you’re not sure who that is, you can find out here. You can continue to send us your issues and questions as you have done in 2016.
We depend on others’ involvement and input into much of our work, and we look forward to defending better pupil privacy together in the next twelve months, for the rights and autonomy of all children and young people in England, and for long term public benefit. Here’s to 2017.