Enforcement action in 2019

Data protection law without enforcement is ineffective to protect children’s rights and privacy. We’ve taken a look at some of the ICO action over the last 12 months. To date, there has not been any enforcement actions or fines of schools, public authorities, third-parties or edTech suppliers in England state schools, under the GDPR.

The ICO has carried out twelve audits since 2018 of academy trusts. in England from which it published ten audit summary reports, that we set out below. Given the widespread practices and concerns that we have been contacted about by staff, parents and the concerns of young people themselves, it seems statistically likely that many schools, — and their data processing third-parties– included in these audits, have unlawful practice.

Every school for example, submits personal confidential data to the National Pupil Database, three times a year. In October the ICO wrote to defenddigitalme saying, the ICO initial findings into NPD practice found that there were wide ranging and serious data protection issues.

“This investigation has demonstrated that many parents and pupils are either entirely unaware of the school census and the inclusion of that information in the NPD, or are not aware of the nuances within the data collection, such as which data is compulsory and which is optional. This has raised concerns about the adequacy DfE’s privacy notices and their accountability for the provision of such information to individuals regarding the processing of personal data for which they are ultimately data controllers.”

Can children and families in England and Wales expect to see enforcement action in 2020? We await outcomes on eight regulatory complaints, affecting thousands of UK schools and millions of children worldwide.

Outside the UK, there have been two decisions taken on data processing in schools, since the GDPR came into effect in May 2018, both in use of facial recognition. We are tracking action in the education sector here.

---

ICO school trust audits in England

These audits suggest that some of the most basic procedures are lacking in a sample of approximately 400 schools managed by academy trusts across England. According to 2018 figures from the National Audit Office, as of January 2018, 7,472 of the 21,538 state-funded schools in England (35%) were academies.

None received high assurance ratings in any area. Neither did any receive the final option, very limited. The latter surprises us having reviewed over 500 school privacy policies 2018-19, plus our own research and assessment.

ICO audit recommendations include actions that should already be the basics of data protection, but that are commonly missing, including:

• The article 6 lawful basis for processing activities has often not been identified and where special category data has been identified, an Article 9 condition often still needs to be identified and recorded.
• Creating a Record of Processing Activities (ROPA) as required by Article 30 of the GDPR.
• Implementing new systems should be screened for privacy prior to being used and DPIAs carried out for high risk processing.
• Responsibility for the security of personal data at a senior level needs to be assigned, and a programme of information security audits introduced to ensure that the data held is secure.
• Role and function specific training needs should be documented and a programme of training be provided accordingly. In particular, ensuring that more specific data protection training is provided, such as, for the data protection officer (DPO), the senior risk owner and data sharing roles.

Breakdown by Academies’ trust

Active Learning Trust (Jan 2019)

Active Learning Trust website. Company number 07903002
21 schools in Suffolk and Cambridgeshire. The majority are primary schools but also includes infants, 2 special schools and one secondary.

Summary findings [download. pdf]

• Introductory meeting: 10 May 2018
• Telephone interviews: 11 October 2018 and 15 October 2018.
• Audit fieldwork was undertaken at ALT’s Office, Ely and Neale Wade Academy, March between 16 October 2018 and 18 October 2018.

Academies Enterprise Trust (May 2019)

With 62 schools, AET is one of England’s largest academy trusts. Company number 06625091. At its peak, AET had 77 academies, but it became one of the most high-profile academy trusts to run into difficulties. Company number 06625091

Summary findings [download. pdf]

• Introductory meeting: 17 December 2018
• Telephone interviews 6 March 2019 and 7 March 2019
• Audit fieldwork was undertaken at AET Offices, London, and Aylward Academy, London, between12 March 2019 and 13 March 2019.

Delta Academies Trust (March 2019)

Delta Academies Trust is a multi-academy trust, operating 46 primary and secondary schools, in North East England. Company number 07386086.
Summary findings [download. pdf]

• Introductory meeting 12 November 2018.
• Telephone interviews 31 January 2019 and 1 February 2019
• Audit fieldwork was undertaken at DAT Offices, Knottingley, and De Lacy Academy, Knottingley, between the 5th and 6th February 2019.

Focus Trust (December 2019)

Focus Trust is a Multi-Academy Trust (MAT) comprising of fifteen primary academies across the North of England. Circa 7,000 pupils are enrolled across the academy network and 900 staff members. Company number 11136109

Summary findings [download. pdf]

• Introductory telephone meeting was held on 25 July 2019
• Audit fieldwork was undertaken at Focus Trust’s Central Office, Oldham and Coppice and Roundthorn Primary Academies, Oldham on 22 October 2019 and 23 October 2019.

Greenwood Academies Trust (January 2019)

The Greenwood Academies Trust is a large multi-academy trust in England, centred around the Nottingham Academy, which was formerly the Greenwood Dale School. There are 34 academies within the trust, educating over 17,000 pupils. Company number 06864339

Summary findings (download .pdf)

• Introductory meeting was held 5 October 2018.
• Telephone interviews 28 and 29 November 2018
• Audit fieldwork was undertaken at Greenwood Academies Trust’s Head Office, Nottingham and Nethergate Academy, Nottingham between 4 December 2018 and 5 December 2018.

Northern Education Trust (October 2019)

Northern Education Trust is a multi-academy trust operating in the North of England. It was established in 2010 and operates 21 academies; 11 primary and 10 secondary. Company number 08383879.

Summary findings (download .pdf)

• Introductory telephone meeting was held on 1 July 2019.
• Telephone interviews were conducted on prior to the onsite visit. (date unpublished)
• Audit fieldwork was undertaken at NET’s offices at North Shore Academy, Stockton-On-Tees on 17 –19 September 2019

Ormiston Academies Trust (August 2019)

Ormiston Academies Trust (OAT) is one of the largest not-for-profit multi-academy trusts in England. It educates 29,000 pupils across six English regions, in 31 secondary schools, seven primary schools and one special school. Company number 06982127.

Summary findings (download.pdf)

• Introductory telephone meeting was held on 10 May 2019.
• Telephone interviews were conducted on 24 June 2019, 26 June 2019 and 28 June 2019.
• Audit fieldwork was undertaken at OAT’s Offices, Birmingham, and Ormiston Forge Academy Cradley Heath, on 3 July 2019 and 4 July 2019.

North Norfolk Academy Trust (March 2019)

The five schools in the North Norfolk Multi-Academy Trust are Antingham & Southrepps, Gresham Village School & Nursery, Cromer Junior and Stalham and Sheringham High School. Company number 07800153.

Summary findings (download .pdf)

• Introductory meeting 21 September 2018.
• Telephone interviews were conducted on 14 December 2018, 17 December 2018 and 10 January 2019.
• Audit fieldwork was undertaken in the County of Norfolk at Stalham High School, Sheringham High School, Gresham Village School and Antigham and Southrepps Primary School between 15 and 16 January 2019.

United Learning Trust (May 2019)

United Learning is a group of academies and fee-paying independent schools operating in England. United Learning is the trading name for United Church Schools Trust (UCST) and United Learning Trust (ULT). There were 51 United Learning academies in November 2018. Company number 04439859.

Summary findings (download .pdf)

• Introductory telephone meeting 6 December 2018.
• Telephone interviews were conducted on 27 February 2019, 28 February2019 and 1 March 2019.
• The audit fieldwork was undertaken at ULTOffices, Peterborough, and Kettering Buccleuch Academy (KBA), Kettering, on 5 and 6th March 2019.

Outwood Grange Trust (September 2019)

Outwood Grange Academies Trust is a multi-academy trust that operates thirty-two schools with academy status across northern England and the East Midlands, for 25,000 children in 32 academies. Company number 06995649.

Summary findings (download .pdf)

• A review of OGATs policies, procedures and other key documents was carried out in September 2019 prior to the onsite visit.
• Telephone interviews were conducted on 17 and 18 September 2019.
• Audit on site visit was undertaken at OGAT’s head office, Potovens Lane, Outwood, Wakefield WF1 2PF from 24 to 26 September 2019.