Betting firms use schools data on 28m children: one year on

One year after the Sunday Times revealed betting firms’ access to school data on 28 million children from the Learner Records Service (LRS), where are we now?

On October 7, 2020  the ICO published a summary of its findings after a compulsory audit of the Department for Education.

Our legal team wrote to the ICO to formally request a copy of the ICO’s full audit report. The ICO has declined. The question must be asked what the Regulator is most interested in protecting here?

The ICO audit found the Department in breach of data protection law in multiple ways, including failing in regard to Articles 12, 13 and 14 of the GDPR and UK Data Protection Act which are about telling people how to exercise their rights, about that their data would be collected, and to whom it would be given and why for example, but we don’t know the exact details as the ICO won’t release it.

As far as we can see, nothing in that regard has changed in the Department policy or practice. Is there to be any enforcement action from the ICO?

In November the Department responded in answer to a parliamentary question that they will publish formal response in January 2021. But will it publish the full audit and timeline of commitments to change?

This week on January 21st the School Census and Early Years Census and other data collections went ahead and gave the Department even more personal data about the pupils currently enrolled in state education despite our letter to the Department with questions over its lawfulness.

We are asking the Department to release the full audit and its action plan to make the necessary changes and demonstrate that the collection and processing are now lawful.

After all, it gives away the personal data of 28 million people without our permission from the LRS. And in a separate question with a an even higher level of breach of confidentiality, 21 million sensitive and identifiable records from the national pupil database. Transparency on their actions is surely the least the Department should offer us all.

There are after all, many outstanding questions as Nigel Nelson and Jo Phillips asked on the BBC Papers the day the story broke: “This is an absolutely shocking story”. “You would expect it would only be used for educational purposes.” “Do we know whether these people could get data about disabilities or special educational needs?” “12,000 organisations have access to this database.” “Who are these people, and why?”

[Clip: BBC Papers January 18, 2020, Martine Croxall, Nigel Nelson and Jo Phillips.)

Update:

On January 29, 2021 the DfE published a written response to the ICO Audit nearly one year on https://depositedpapers.parliament.uk/depositedpaper/2282906/details
In April 2021, in answer to a written Parliamentary Question 179576 Nick Gibb, Schools Minister, made a public written commitment to “publish an update to the audit in June 2021 and further details regarding the release mechanism of the full audit report will be contained in this update.”