Catching up we’ve rolled an update status from the end of the Summer term into the first half term of the 2017-18 school year. There have been a number of policy announcements and pieces of legislation passed that affect children’s data privacy and education workforce data in England and Wales. We continue our work towards safe, fair, and transparent collection and use of national pupil data.

What’s New?

National Pupil Data: Moving pupil data towards safe, fair, and transparent use

The Department for Education contract announcement launched work on a privacy-preserving API for the National Pupil Database, the next step in their committment to changes in National Pupil Data management, announced in the UK Digital Strategy in March 2017. The DfE is still reviewing ‘data sharing governance and release practices’, and we are waiting for progress. The safe settings model was presented to the NPD Steering Group in July, and we submitted feedback.
The third-party release register has been split in two, and pre-2017 archived.

School census: Pupil nationality data collection

On October 13, after fifteen months, the Department for Education has released the disputed information from the nationality expansion decision making by the Star Chamber Scrutiny Board. DfE sent a letter [download .pdf 66.7 kB] to accompany the release of the disputed materials [download .pdf 288 KB]. There is no evidence that the Board were told of Home Office plans to use the information and its live data sharing agreement already in place.
The DfE has withdrawn their appeal, which means we will no longer need to attend the Information Rights Tribunal hearing, planned for November.
At the start of the term, the Department for Education (DfE) released new advice for the school census, after the Information Commissioner’s Office had advised on changes needed. The latest version, updated today, is school census guidance v1.3.
This term’s school census on roll day was October 5. We sent a message to schools, spoke to various groups, and keep answering questions from individuals. Schools must offer pupils and parents the opportunity to retract nationality data if schools submitted data but had not explicitly asked parents, or wrongly said it was required. Guidance confirms: These data are optional and do not affect funding.
Use of pupil data by the Home Office and police is still not included in the quarterly tracking published by the Department for Education. We will request this on a quarterly basis to have it in the public domain until it becomes routine as part of the DfE transparency objective.
The Department for Education has refused our FOI request to publish figures on how many children’s data were requested and matched in 2017, or updates to the Memorandum of Understanding to show how data are used monthly by the Home Office.

School Governors’ nationality data

School Governors’ data also continues to be collected without oversight or transparency and should be stopped and deleted after the ICO has informed the Department that it has no legal basis. We continue our efforts to end this.

Expansion of the Alternative Provision School Census

The Department for Education will collect teen pregnancy information from school children, from January 2018, along with other codes, to record children who have been transferred from regular school into alternative provision for other mental and physical health, or young offender reasons.
We are concerned that this will be on a named basis, retained indefinitely, and used without consent. These data are also used across government in Troubled Families, shared with National Citizen Service, given out to journalists and commercial businesses at identifiable level, and stored forever; all without pupils’ consent or parents’ knowledge or ability to check if data are accurate.
While we understand that government may have concerns and want to understand children being offloaded out of mainstream education for the wrong reasons, compromising children’s privacy for life, should not be necessary or proportionate. It ticks every box for needing a Privacy Impact Assessment.

Data Exchange

Steps for the “Data Exchange” which will enable EdTech products to “talk to each other” seem to be moving forward. While laudable that DfE wants to make data collection less burdensome for schools, what are often seen as ‘barriers’ for schools to share data with local third parties, are in fact legal and ethical protections of children’s confidentiality. We still await confirmation whether or not a PIA or data protection impact assessment has ever been done.
The pupil data strategy is far from clear and there are no more details in the public domain or with NAO.  We’ve asked for more info and will post more when we get it.

Parliamentary Questions

Questions spotted in Parliament this quarter on pupil data sharing include:
To ask the Secretary of State for Education, how much income her Department derived from allowing third-party organisations to access the national pupil database [106645]
To ask the Secretary of State for Education, whether any data extracted from the national pupil database has been transferred from an approved third-party organisation to any other organisation. [106644]
To ask the Secretary of State for Education, what audit processes her Department has implemented to ensure that third-party organisations which access the National Pupil Database store and process that data in compliance with their original agreements with the Government. [106878]

Legislation

1. The UK Data Protection Bill 2017-18

The Bill has just completed Second Reading on October 10. We published our briefing ahead of the debate, and will revise it before the next stage.
Lord Lucas questioned new powers to make immigration purposes exempt from data protection rights, “Paragraph 4 of Schedule 2, on immigration, takes away rights immigrants have at the moment under the Data Protection Act. Why? What is going on?” — we are concerned about the exemption due to school census use.
Lord Jim Knight asked why a private tutoring pupil-tutor matching website, has been given identifying pupil data, “postcode, date of birth and unique school reference number of all pupils,” and said government “needs to get its own house in order to comply with the Bill.”

2. Wales Workforce national census

A Statutory Instrument comes into effect on October 31 to permit the collection of Wales’ teaching staff data, including name, nationality, and National Insurance Number. The data will be retained forever. The privacy impact assessment has not been published.
There is no published plan for third party register tracking data uses. There is insufficient oversight of uses, and open to scope creep as has happened with pupil data.
The Assembly for Wales will review the SI on October 16.

Reports of note

1. The government has published the Green Paper and consultation closing December 7, 2017.
2.  Children’s online activities, risks and safety: A literature review by the UKCCIS Evidence Group on the UKCCIS webpage.
3. The House of Lords Select Committee on Communications published its report, Growing up with the Internet, the 2nd Report of Session 2016–17. The recommendations were wide ranging and practical, including a call for a national Digital Champion for children. The report mentions our consultation contribution in which we called for change, increased transparency and greater attention to children’s rights.
   

Countdown to GDPR: The state of data 2017-18

We continue work on a report of the state of today’s data privacy in schools together with specialist input from across civil society organisations in key areas of technology in education.
You can help us mapping the education landscape and comment on the GDPR and education in England.
We have pushed back the launch date to after the UK Data Protection Bill so that the implications are clearer. We expect to launch this in Spring 2018, with a view to the General Data Protection Regulation (GDPR) enforceable from May 2018.

Seen in the press

October
Sky News School census boycott over child deportation fear
Gal-Dem We must resist border controls in schools
Left Foot Forward Parents and teachers call for school census boycott amid deportation fears
Politics.co.uk The real Theresa May: How the PM tried to introduce immigration checks in schools
September
Private Eye Class War – Nationality monitoring
Schools Week Information Commissioner cracks down on pupil nationality data collection
July/August
Bristol Cable [Summer Issue 12]: Schools, Children’s Data and Immigration Enforcement
The Teacher, NUT Magazine “Call to end sale of pupil data“
UK Authority DfE works on privacy API for National Pupil Database
June
Open Democracy Child safeguarding cloaks state surveillance and data exploitation

What else?

We thoroughly enjoyed hosting events on Shaping the Future Society and State at the Labour Party and Lib Dem Conference Fringes in September in Brighton and Bournemouth, together with spokespeople from Against Borders for Children, medConfidential, and Hal Hodson, technology Correspondent at the Economist. We were honoured and express our thanks to the Rt Hon Diane Abbott MP and Lord Clement-Jones who  opened the events. We are enormously grateful also to our Chairs, Kevin Courtney and Tamara Cincik, and fellow speakers.
Previous commitments and funding limitations prevented participation at other conferences, rather than any political factors.
We also thoroughly enjoyed speaking since our last half term report card at:
September 25: London NADPO (National Association of Data Protection Officers) Autumn Conference
September 9: London – ResearchED 2017

School census: what you need to know [download handouts Session 1]
Mapping the Education Landscape [download handouts Session 2]
July 4-5: London – EEMA 2017
Privacy vs Identity – Opportunity and Challenges in Education and GDPR in England [download slides]
June 21: London – CognitionX 2017
The Impact of AI on Education. Specialist contributor breakout panel session
May 13: London – OpenTech 2017  [download presentation .pdf 6.3 MB]
23 million children’s records: School census
More events are planned later this year and into 2018. Come along!

---