Statement on student religion or belief, and sexual orientation data in the National Pupil Database

 

“Sixty-two per cent of applicants think sharing their personal data for research is a good thing, and 64% see personal benefits in data sharing.  But most applicants say they should be asked first, regardless of whether their data is to be used for research, or to speed up their applications for student finance or accommodation.”

The ICO must investigate with urgency how it is, that named national databases of sexual orientation and religion exist, and have been passed around so many public bodies without students knowledge for so long. Anything but statistics must be destroyed and not kept after collection.

There must be robust action taken to make these data, and every use of students’ personal data on and off campus, safe, lawful, trusted, and transparent. Collection and distribution like this should be unthinkable.

We have written to the Department to ask for urgent changes.

Hazel Shearing, Buzzfeed journalist, talked to the BBC Radio 4 Today Programme, about the issues (original link: https://bbc.in/2yi07Pa) “A student that shares their sexual orientation will have to click through several links to establish their data could end up in a database with the State.”

Ten changes we want to see

1. Students’ best interests and rights must remain paramount in policy making, including student trust in equality monitoring.
2. These data collected to date (since 2012) must be removed from the national pupil database and destroyed at named level.
3. There must be anonymisation and aggregation at the point of collection. Only anonymous statistics should be retained by universities, HESA, the Department for Education, or any third parties.
4. Students and former students, must now be told where their sexuality and religion data (and all the rest) are and have been distributed to by HESA, the OfS and other relevant bodies. There is already a legal obligation for accountability from data controllers to be able to meet this obligation to anyone’s data they process.
5. Personal confidential data should not be distributed at individual level. Make distributed safe access possible rather than pass around the raw data. (ie following UKSA 5-safes model)
6. The Higher Education and Research Act 2017 legislation should be amended by secondary legislation to ensure:
   • only statistics can be lawfully distributed to third parties without the express knowledge and consent of an individual.
   • a statutory duty on HESA and the OfS (and relevant others) to publish a register of their data access by which third parties and for what purposes.
7. HESA’s data collection and processing powers must be reviewed not expanded given their apparent careless attitude to student confidentiality.
8. Personal confidential processing by government departments and their arms length bodies must be independently reviewed as part of a National Data Strategy for safe, fair and lawful policy and practices.
9. Every university as well as any other education bodies sharing data with HESA must review their policies and legal position.
10. Independent oversight is needed for education data to restore any semblance of safeguarding of confidentiality and trust in the sector.

Do students consent to these data collections?

Students provide equality monitoring data voluntarily to universities during applications and interactions during their higher education, but many universities data policies are long and opaque, or simply wrong.

Students may not have understood or been misled by unclear wording, and not know that their personal information are sent to HESA in identifiable form. Some suggest data are only shared as statistical returns. Universities can fail to inform students that their record will be joined together to their national pupil records, or require multiple clicks to follow without explaining the purposes of sharing such sensitive data, or fail to mention explicitly that they pass on sexual orientation or religion at all.

They may have been collected from any student studying in England, Northern Ireland, Scotland and Wales. Former students since 2012 may now be living anywhere in the world.

The data are linked with other personal data.

The Department for Education in England on receiving these equality monitoring data from HESA, then links and stores the data on individual named records in the National Pupil Database. This database, a melting pot of over 25 different collections, now holds a total of over 21 million individuals, and each record could typically contain over 400 different items of data from a lifetime of education gathered from school census, collections from children starting in the Early Years at age 2.

Records are retained forever. As a result, now in 2019, the national pupil database record for millions of students and former students, contains their sexual orientation and religion, as part of their detailed personal record: name  and date of birth, gender, ethnicity, home addresses, attainment, special educational needs, reasons for exclusion, indicators for service families (armed forces) or children in care. And much more.

We are told by the DfE that the sexual orientation is not distributed to the commercial third parties to whom all these other data have been distributed by the Department for Education to a wide range of third parties since 2012; journalists, charities think tanks, commercial companies as well as academic researchers. We can only hope that they have not distributed sexual orientation or religion amongst it, and that they never will. But data is being passed around the system from JISC/HESA, UCAS, Higher Education funding bodies, and the OfS at least.

Hope alone, is not a safeguard. What about the distribution channels and unauthorised access? This data handling poses a potential risk to communities that we must not be complacent about, or dismiss as no longer dangerous.

The potential labels on named records