News / Higher Education National Pupil Database

Statement on student religion or belief, and sexual orientation data in the National Pupil Database

BuzzFeed News has revealed that the Department for Education (DfE) holds sexual orientation data on almost 3.2 million people, and religious belief data on 3.7 million people. The records go back to 2012/13, so include both current students and those who have finished university.

Equality Monitoring data from students in Higher Education are passed on from UCAS and universities to HESA, the Higher Education Statistics Agency Ltd. HESA pass these sensitive and personal confidential information on to other funding bodies. These data now sit on a named basis in multiple national databases, including the National Pupil Database at the Department for Education, where it may be linked with hundreds of other pieces of personal confidential information about each individual,  in their lifetime record starting from age 2.

For many worthy reasons, many organisations advocate for the collection of these religion or sexual orientation among equality monitoring data. But any risk of loss, theft, leak or misuse could be devastating to individuals and communities. Risk of damage or distress are high.

There can be no justifiable necessity for distribution of named data in this way that is proportionate to the risks to fundamental rights and freedoms.

Students have been misled up and down the country by their universities for nearly a decade, and don’t know these databases exist. Organisations make no real effort to tell applicants how their personal data are distributed, and abuse a tick-box consent process to fudge their legal responsibilities and accountability.

UCAS and every other body involved across the student sector is actively ignoring their own evidence that students only want their personal data used in ways they can control. In 2015, 90% of 37,000 UCAS students said in response to a survey that they only wanted their UCAS application data to be shared “with active and informed consent”.

 

“Sixty-two per cent of applicants think sharing their personal data for research is a good thing, and 64% see personal benefits in data sharing.  But most applicants say they should be asked first, regardless of whether their data is to be used for research, or to speed up their applications for student finance or accommodation.”

The ICO must investigate with urgency how it is, that named national databases of sexual orientation and religion exist, and have been passed around so many public bodies without students knowledge for so long. Anything but statistics must be destroyed and not kept after collection.

There must be robust action taken to make these data, and every use of students’ personal data on and off campus, safe, lawful, trusted, and transparent. Collection and distribution like this should be unthinkable.

We have written to the Department to ask for urgent changes.

Hazel Shearing, Buzzfeed journalist, talked to the BBC Radio 4 Today Programme, about the issues (original link: https://bbc.in/2yi07Pa) “A student that shares their sexual orientation will have to click through several links to establish their data could end up in a database with the State.”

Ten changes we want to see

  1. Students’ best interests and rights must remain paramount in policy making, including student trust in equality monitoring.
  2. These data collected to date (since 2012) must be removed from the national pupil database and destroyed at named level.
  3. There must be anonymisation and aggregation at the point of collection. Only anonymous statistics should be retained by universities, HESA, the Department for Education, or any third parties.
  4. Students and former students, must now be told where their sexuality and religion data (and all the rest) are and have been distributed to by HESA, the OfS and other relevant bodies. There is already a legal obligation for accountability from data controllers to be able to meet this obligation to anyone’s data they process.
  5. Personal confidential data should not be distributed at individual level. Make distributed safe access possible rather than pass around the raw data. (ie following UKSA 5-safes model)
  6. The Higher Education and Research Act 2017 legislation should be amended by secondary legislation to ensure:
    • only statistics can be lawfully distributed to third parties without the express knowledge and consent of an individual.
    • a statutory duty on HESA and the OfS (and relevant others) to publish a register of their data access by which third parties and for what purposes.
  7. HESA’s data collection and processing powers must be reviewed not expanded given their apparent careless attitude to student confidentiality.
  8. Personal confidential processing by government departments and their arms length bodies must be independently reviewed as part of a National Data Strategy for safe, fair and lawful policy and practices.
  9. Every university as well as any other education bodies sharing data with HESA must review their policies and legal position.
  10. Independent oversight is needed for education data to restore any semblance of safeguarding of confidentiality and trust in the sector.

Do students consent to these data collections?

Students provide equality monitoring data voluntarily to universities during applications and interactions during their higher education, but many universities data policies are long and opaque, or simply wrong.

Students may not have understood or been misled by unclear wording, and not know that their personal information are sent to HESA in identifiable form. Some suggest data are only shared as statistical returns. Universities can fail to inform students that their record will be joined together to their national pupil records, or require multiple clicks to follow without explaining the purposes of sharing such sensitive data, or fail to mention explicitly that they pass on sexual orientation or religion at all.

They may have been collected from any student studying in England, Northern Ireland, Scotland and Wales. Former students since 2012 may now be living anywhere in the world.

The data are linked with other personal data.

The Department for Education in England on receiving these equality monitoring data from HESA, then links and stores the data on individual named records in the National Pupil Database. This database, a melting pot of over 25 different collections, now holds a total of over 21 million individuals, and each record could typically contain over 400 different items of data from a lifetime of education gathered from school census, collections from children starting in the Early Years at age 2.

Records are retained forever. As a result, now in 2019, the national pupil database record for millions of students and former students, contains their sexual orientation and religion, as part of their detailed personal record: name  and date of birth, gender, ethnicity, home addresses, attainment, special educational needs, reasons for exclusion, indicators for service families (armed forces) or children in care. And much more.

We are told by the DfE that the sexual orientation is not distributed to the commercial third parties to whom all these other data have been distributed by the Department for Education to a wide range of third parties since 2012; journalists, charities think tanks, commercial companies as well as academic researchers. We can only hope that they have not distributed sexual orientation or religion amongst it, and that they never will. But data is being passed around the system from JISC/HESA, UCAS, Higher Education funding bodies, and the OfS at least.

Hope alone, is not a safeguard. What about the distribution channels and unauthorised access? This data handling poses a potential risk to communities that we must not be complacent about, or dismiss as no longer dangerous.

The potential labels on named records

01 Bisexual
02 Gay man
03 Gay woman/lesbian
04 Heterosexual
05 Other
98 Information refused
Code Label
01 No religion
02 Buddhist
03 Christian
04 Christian – Church of Scotland
05 Christian – Roman Catholic
06 Christian – Presbyterian Church in Ireland
07 Christian – Church of Ireland
08 Christian – Methodist Church in Ireland
09 Christian – Other denomination
10 Hindu
11 Jewish
12 Muslim
13 Sikh
14 Spiritual
80 Any other religion or belief
98 Information refused
99 Not known