News / pupil privacy

Second half of autumn term 2017-18 school year data report card

pupil privacy / December 22, 2017

A wrap up of our work in the second half term of the autumn term in the 2017-18 school year. We continue our work towards safe, fair, and transparent collection and use of national pupil data.

Expansion of the Alternative Provision School Census

The Department for Education (DfE) will collect teen pregnancy information from school children, from January 2018, along with other codes, to record children who have been transferred from regular school into alternative provision for other mental and physical health, or young offender reasons. These data will be added to the National Pupil Database, from where identifying pupil level data are released to a wide range of third parties.
Without fixes, this data collection should not go ahead on January 18th.
After a dismissive response on November 30th to concerns raised discretely in September, we wrote to the Secretary of State, Justine Greening on International Human Rights’ Day, December 10th, supported by representatives of over 20 NGOs and leading child rights’ academics, asking her Department to respect and strengthen the digital wellbeing of children across England.
We said that if the DfE cannot end the distribution of identifying data for indirect and commercial re-use purposes, and commit to children’s confidentiality; we believe the government should not collect the data at all. We put forward nine proposals, within the larger scope of the whole National Pupil Database solutions needed, to restore public and professional trust in the school census and data handling, through a commitment to safe, privacy preserving solutions and transparent expansion decisions.
The stigma and potential harm from these data uses, will limit children’s development and future flourishing. We’re not only concerned about the new reasons for transfer, but reasons for exclusions; theft, alcohol, sexual misconduct and violence among others.
As John Carr, OBE and Secretary of the Children’s Charities’ Coalition on Internet Safety told Buzzfeed,
“Once a mistake, even an honest one, gets into a digital record it can haunt you for life, so it seems to me vital not only that accurate information goes into a child’s record, but also that it is based on reasonable judgments that have been properly made by appropriately qualified people.
“An individual teacher’s prejudice should not be able to blight a child’s career chances and life opportunities forever, and of course the basis on which any information about a child is shared with any third parties must be clearly stated and be fully justifiable.”
We’re also concerned about possible uses for these data without transparent oversight and future scope creep. A request for sensitive identifying data in 2013, by the University of Cambridge Institute of Criminology was not fulfilled, according to the approved third-party register, but the DfE was also “unable to retrieve this documentation.”
There is however no transparency of the volume of how many children’s data have been given away in approved uses either, because,
“the Department does not maintain records of the number of children included in historic data extracts.” (PQ109065)
The DfE launched work on a privacy-preserving API for the National Pupil Database, and the safe settings model was presented to the NPD Steering Group in July. We are still waiting for news of any progress of change. But with the AP Census Expansion as set out above, we couldn’t wait any longer to insist on an end to the current data distribution model. We hope you will help us do so.
Here’s what you can do. Take action today and before January 18th.

School census use by Home Office, Police, and Pupil nationality data collection

We welcome increased transparency at the Department. The use of pupil data by the Home Office and police was included for the first time in the quarterly tracking published earlier this month. We hope the new numbers become a regular publication in the public domain. The DfE had begun to refuse our quarterly FOI request to publish figures on how many children’s data were requested and matched in 2017, and refused to provide any updates to the Memorandum of Understanding to show how data are used monthly by the Home Office.
We are concerned that there is no oversight of how this MOU could be changed at any time.”The Department does not currently routinely publish all underlying data sharing agreements,” and it seems has no plans to do so (PQ108061).
We also welcome that the DfE published its statistics for the first time on December 14, 2017 on the return rate of nationality and country of birth data after two census collections of nationality and country of birth data.
In summary, in January 2017, there were 8.1 million pupils registered at schools in England.

  • 23.5% of pupils have no recorded country of birth
  • 20.6% country of birth is not yet obtained (NYO)
  • 1.9% country of birth refusal (plus 1.1% not known – should be used where truly unknown and separate from NYO) = 153,900 refusals.
  • 25.6% of pupils have no recorded nationality of which 22.5% is not yet obtained and 2.1% refusal (1.0 not known) = 170,100 refusals
  • 74.4 per cent of pupils were recorded with a specific nationality. Of those pupils where a nationality was provided, 91.4 per cent were recorded with a nationality of British

The data quality is clearly very poor, with over a quarter not providing nationality, and a significant active refusal rate. The not yet obtained rate is also highly significant, despite Local Authorities and schools being chased by the Department and Schools Information Management System providers, to make sure they returned data or refused, and cut down the not yet obtained rate. We doubt the DfE comment that the number of pupils for whom a nationality has not been provided is “spread proportionately across the overall school population.” In Haringey in September 2017, there was a 70% not yet obtained rate, despite Department for Education staff putting direct pressure on the Local Authority schools.
The numbers don’t correlate with ONS stats  and in our view, this is likely due to the terrible data quality. DfE’s comment on page 9 might suggest the DfE is trying to justify that the gaps are not statistically significant due to being representative across the population. We beg to differ.
Against Borders for Children’s crowdfunder to support their legal case opposing the use of children’s school census data this way, and collection of nationality data, was successful in reaching their stretch goal in the last minutes of their fundraising campaign.
We were relieved that the DfE withdrew its appeal of the ICO ruling to release November 2015 Star Chamber meeting minutes so that we did not have to go to the First-Tier Information Rights Tribunal on November 13, as planned.
There was also a ministerial correction (HCWS272) made by Nick Gibb, Minister of State for School Standards, on the numbers of pupils data released to the Home Office and police. “Information supplied by the Data Modernisation Division of the DfE has been identified as containing incorrect facts in the response provided to Parliamentary Questions concerning the volume of children’s records passed onto the police and the Home Office (PQ48634, PQ48635 and PQ52645) and in figures quoted during a House of Lords Debate on the 31 of October 2016 on the Education (Pupil Information) (England) (Miscellaneous Amendments) Regulations 2016. “
While we welcome the improvement, transparency at DfE, like some schools, stills seems to be selective, and could do better. The first publication of police volume of access to national pupil data, chose to make the time period start in July 2015, so the external data shares for police access said ‘1’ and every other month the table states explicitly wrote ‘nil’. Yet the correction HCWS272, for the months between March 2012 and October 2016, state that 33 access requests of the NPD data were made by the police and 16 of these resulted in data being shared about 62 pupils. The transparency table, does not include these numbers.

School Governors’ nationality data

School Governors’ data also continues to be collected without oversight or transparency and should be stopped and deleted after the ICO has informed the Department that it is excessive. We continue our efforts to end this.

Data Exchange

Steps for the “Data Exchange” which will enable EdTech products to “talk to each other” seem to be moving forward. We’ve seen a little bit of information through an answer to a parliamentary question. According to the answer, the project has undertaken an initial privacy impact screening assessment, which we will look forward to reviewing in due course, but the pupil data strategy is far from clear and there are no more details in the public domain or with NAO. We had asked for more info via Freedom of Information, and the DfE has refused our request. This lack of transparency in a technology implementation project that has been running for over 4 years is never conducive to trust. We hope this changes in 2018.

Parliamentary Questions

Cross-party peers in the House of Lords, called for answers from the DfE, and changes in the handling of children’s school records, ahead of the Alternative provision Census in January. In the first debate at Report Stage of the Data Protection Bill the peers recognised the concerns and asked questions during and after debate.
Questions in Parliament this quarter on pupil data sharing include several on the Alternative Provision census, since the debate in the House of Lords, including one revealing that the Department has not carried out any privacy impact assessment of the AP census, because it, “already collects a range of characteristic information about individuals, these additional items of information (about the same individuals) do not present any new privacy risks over and above those already present so a formal privacy impact assessment was not completed.” (PQ108570)

Legislation and Policy

The Data Protection Bill has almost completed Report stage. We were encouraged in discussions with peers to support shaping an amendment in the bill that would require a code of practice to set out guidance for handling children’s personal data in education, which largely sits outside the realms of consent and GDPR Article 8(1). A code would create clarity, consistency and confidence in the obligations of controllers and processors, and draw together the ways in which rights and responsibilities should be made clear to children, young people and their parents.
We published briefings before all stages, as well as a submission to the Working Party 29 on Automated individual Decision-making and Profiling regards children. We will continue to work towards putting the necessary GDPR safeguards for children in this area into the Bill in 2018 and the shaping of legislation that gives due weight to children, whose data “merit specific protection”.

Countdown to GDPR: The state of data 2017-18

We welcome that the Department is “undertaking a programme of work in preparation for General Data Protection Regulation coming into effect in May 2018. This will include a review of the policies and processes associated with Subject Access Requests.” (108573). These rights are currently denied and will be reduced further in some circumstances, under the UK Data Protection Bill current draft. We think that given the number of uses of children’s national pupil data for direct intervention, not least the Premier Football League, aside from Home Office immigration enforcement, that the “research exemptions status” no longer applies. We are working to secure the restoration of this right for children and parents, to Subject Access.
The ICO has just published new draft guidance on Children and the GDPR and wants your views. The consultation runs until the end of February.
We continue to receive concerns from young people, parents and teaching staff on the use of student data in the UK. This includes transfers abroad of apps, to the growing use of data analytics in further and higher education, distributing large quantities of individual level data to third parties.
We’re looking forward to finishing our report of the state of today’s data privacy in schools together with specialist input from across civil society organisations in key areas of technology in education, next half term.
You can still help us too, in mapping the education landscape and comment on the GDPR and education in England.

As seen in the Press

December
The Observer Plan to collect data on excluded pupils could put them at ‘lifelong risk’ of stigma and our signatories Letter to the Editor Children’s privacy at risk
Buzzfeed The Names Of Children Who Leave School Due To Mental Illness Will Now Be Added To A Government Database
The Register UK.gov told: Your frantic farming of pupils’ data is getting a little creepy
Schools Week Opinion Government needs to rethink the alternative provision census expansion
Schools Week Schools fail to ‘obtain’ nationality data on quarter of pupils
Sky News
October
Schools Week Pregnant? Offender? What the government wants to know about AP pupils

What else?

Since our last half term report card, Jen was honoured to participate in a workshop meeting at LSE hosted by Professor Sonia Livingstone, with an outstanding group of participants including staff from the Office of the Information Commissioner on Children and the GDPR, discussing the UK approach. A report will follow.
Questions and input from participation in a panel on December 7th at OEB, with a theme of Learning Uncertainty on Data Protection, Privacy and Ethics in Education: Are We Ready for GDPR?  will support our ongoing work in the DP Bill as well as preparation for our report, the State of Data Privacy in Education in England.
There is clearly much confusion in providers, the IT sector, and even trainers themselves on GDPR, as we experienced at the Academies Show in Birmingham in November. Not least on how bulk student data collected from years past can or cannot be used to train AI and for data analytics.
Jen also attended the Ed Tech conference run by Ty Goddard, last month. One report noted his comment afterwards, during a visit to Silicon Valley, “Education and learning technology looks set to be a jewel in the nation’s crown as teachers, education leaders and entrepreneurs build new approaches, tools and platforms across the learning spectrum. That was underlined for us by the great turnout for our edTech UK Global Summit and the buzz in the air.” 
The buzz that day was accompanied by the smell of money. Providers want to see a profit from this market. We must be very careful that the good uses of edTech and potential public benefit, are not lost through exploitation by some product manufacturers who want quick wins, no matter the cost or benefit or its lack thereof, to children in our classrooms. EdTech depends on data from children, about individual children, and their rights are overlooked.
One way to support this better, is a strong framework of ethical and safe use of children’s data which is applied in practice, in the classroom and beyond, and is enforceable. Something we will be working on into the New Year.
More events are planned in 2018, starting on January 8 in Oxford/Didcot where Jen is speaking at the Equalities Conference on the topic of Labels last a lifetime: key steps towards better pupil data and why we need to take them. Come along!

And finally

And most importantly perhaps, a huge thank you to all our colleagues, supporters and friends. And to all those with whom we work indirectly in the goals of delivering safe, fair and transparent pupil data. Wishing you all from Gretna to Great Smith Street to Great Yarmouth and everywhere in between, a very restful Christmas holiday, and a happy start to the New Year.  2018 promises to be as challenging as the last twelve months, but full of potential for better children’s privacy in education. If you want to support our work in any way at all, please do get in touch. We warmly welcome offers of help, support and donations.
And don’t forget, here’s what you can do today. Take action before January 18th. Thank you. Until then, for a little bit of fun pop over to our sing-a-long round up of some of the education news in 2017.