The Skills and Post-16 Education Bill: Report stage

Blog / October 6, 2021

The Skills and Post-16 Education Bill [HL] contains Clause 11 about Information sharing in relation to technical education qualifications. According to its notes, the territorial extent includes all of the UK.

Updated December 9, 2021

Clause 11, now at Report Stage in the Commons, is still unamended, and gives the Secretary of State unlimited powers on this identifying, sensitive data, without any safeguards for students and can distribute it to what appears to be an unlimited list of ‘prescribed persons’ —that for the DfE so far on pupil data has meant giving away sensitive and identifying data even to TV and Fleet Street journalists.

The questions asked by Lab. Lady Sherlock in the Lords (just after 7.15pm) on October 21st, still seem to be unanswered. [our numbers added]

“There have been concerns for some time that both practice and indeed legislation in education are loose in relation to data. Clause 11 makes provision to allow data sharing by and with Ofqual, the OfS and Ofsted as well as prescribed persons, and the provisions relate to technical education functions. Could that include students’ personal data? If so, for what purposes? How widely could “prescribed persons” be interpreted?
“Can the Minister clarify whether the scope of Clause 11 extends beyond England? Although the institutions to which the new powers apply are all currently based in England, the people and institutions from which they will obtain personal data under those powers could presumably be at any educational setting across the UK within the scope of the Bill.
“What consideration has been given to the prescribed persons to whom the institution may pass on the data being based outside England in accordance with their own data-sharing powers?
“These days students need and expect consistent controls across their data for collection, for use, for distribution and for destruction when it is no longer required for the lawful purposes for which it was collected. I am aware that institutions have also called for better guidance. Concerns have also been raised that the Bill does not preclude commercial use. Could the Minister comment on that?”

The same mistake to not limit the prescribed persons and not limit the exact data that was affected or it’s narrow purposes was made in the Higher Education and Research Act 2017 — today it means that the government is now sitting on named database of over 4 million named students‘ religion and sexual orientation. Students named records get passed around across these Higher Education and arms length bodies. Students need safeguards on this.

The government responded in the Lords by talking about a of a code of certification—

“The department’s response to this issue is to set up an education sector certification scheme, with the support of the ICO, that would allow the department to set standards in a wide range of areas. This would cover the data protection needs of the whole education sector, not just the 16 to 19 age group covered by the Bill. We feel that a certification scheme, rather than a code, gives us flexibility to deliver elements when they are ready. We will not have to wait until all elements are complete, which allows us to be flexible when responding to priority needs. In addition, as technology and the law change, we are able to update specific standards without having to update a full code, allowing us to remain flexible to future changes.

As the noble Baroness, Lady Garden, mentioned, I have written to both the noble Lord, Lord Storey, and the noble Baroness, Lady Kidron, detailing the department’s ambition and next steps in tackling this issue, which will include writing both to the ICO and to the ed-tech companies by the end of the year.” [our emphasis]

However: In our view, any Certification scheme the government spokesperson mentioned in the Lords is as far as we understand about edTech, possibly covering emerging technology like facial recognition or data distribution for research — but is nothing to do with the public / arms length bodies, like Ofqual involved in this Bill at all.

We believe that the Department for Education is not fit for making new data laws while issues from the ICO’s compulsory audit of the Department for Education are still unresolved.

The Bill is wide-open to misappropriation of students’ personal data. It needs to ensure:

the data should stay in safe settings only, and secure access distributed. Personal data itself should not be distributed.
protection from onward access or distribution, to further sub-processors through the prescribed persons or relevant body who are not listed on the face of the Bill.
an obligation to publish a register of use by data controllers, joint-controllers and their processors.

At best worst case is a duty on the Information Commissioner to prepare a Code of Practice that reaches across all these bodies and prescribed persons, made open to public consultation.

Download our full briefing .pdf 178kB

Download our skeleton outline (2 pager) 120kB

What do students want?

In 2015 UCAS carried out a survey which had 37,000 responses. “A majority of UCAS applicants agree that sharing personal data can benefit them and support research into university admissions, but they want to stay firmly in control.” A large majority, 90%, of respondents said they wanted to be asked for their consent before their personal data is shared with anyone outside of the admissions service.

Students need additional safeguards to control the use of their data at and after collection during its complete life cycle until destruction.

This is not just the small change it looks

This is yet another step along a route to the destruction of student confidentiality. The release of individuals’ identifiable data in Technical Education was already changed in legislation in 2017. Part 3, s40 of the Technical and Further Education Act 2017 changed what data could be collected by the Secretary of State. Now this Bill changes how it can be handed out and to whom, and why, and it is all rather vague because it also includes open ended powers to the Secretary of State to decide who else the data may go to and why.

In the Skills and Post-16 Education Bill,

“This clause inserts new section 40AB into the 2009 Act. It supports effective collaboration between Ofqual and other bodies with functions in relation to technical education qualifications, by introducing information-sharing provisions similar to those relating to the Institute under section 40AA of the 2009 Act.

“It empowers Ofqual to share information in relation to technical education qualifications with the Secretary of State, Ofsted and the Office for Students, as well as with other bodies that the Secretary of State may prescribe. It also allows these bodies to share technical education information with Ofqual.This information sharing may support the technical education functions of Ofqual or the other relevant bodies.” (our emphasis added)

As with all recent legislation and data policy from government, the bill overrides consent, and there are no guarantees on how data may be used by the ‘prescribed persons’ who are unrestricted and undefined in the Bill, and for vague purposes that do not preclude commercial use. That, “could undermine applicants’ trust in the admissions service, degrade the quality of data collected, and potentially deter some people from applying to university altogether,” according to UCAS in 2017 when talking about the changes made to the Higher Education and Research Act (Point 25, UCAS evidence to Committee in 2017).

This Bill on data in Technical Education could usefully learn lessons from those similar historic changes in Higher Education.

In the July 2018 Motion of Regret debate on the Higher Education and Research Act 2017 (Cooperation and Information Sharing) Regulations 2018 Lord Watson of Invergowrie called on the government to carry out a privacy impact assessment on the Regulations. This assessment is also missing from the 2021 The Skills and Post-16 Education Bill [HL].

He made the point that, “during the passage of the Higher Education and Research Bill, noble Lords and MPs raised concerns about the powers in the regulatory function of the Office for Students and questions of institutional autonomy. ” This Skills Bill again expands the powers given to the Office for Students through their expanded data access.

Lord Watson said in debate on July 2018, “They create for the Office for Students to grant access to students’ confidential data to a single commercial provider…the purposes for which the data may be used remain open and vague.” The Skills and Post-16 Education Bill [HL] has the same problem because this Skills Bill once again leaves open the question of who may access the data in future without further consultation, since in future they can add, “other bodies that the Secretary of State may prescribe.”

Lord Watson said in debate on July 2018, “We have a number of concerns, not least that, as I said, there has been no parliamentary debate or public consultation.” This new Skills Bill once again sidesteps any public consultation on a new data grab without safeguards on what happens next.

There must be serious consideration given with urgency on enabling how public administrative datasets are managed. Personal data from the public, from pupils to students and throughout the data life cycle, is easily taken and passed around and lost, or stolen, or given to gambling companies and access credentials left open, unaudited, to companies that have gone bust.

Yet the mechanisms to manage our lawful rights, to permit uses, correct mistakes, and give or withhold consent for further purposes not defined at the point of collection do not exist today by any adequate or consistent routes.

The Government must enable that infrastructure to be put in place for all public administrative datasets. They could usefully start when a project is new, such as here with students age 16+ in technical and further education.

The Bill dates (as of November 11, 2021)

Monday November 15
House of Commons Skills and Post-16 Education Bill [HL] – Second Reading, Ways and Means and Money Resolutions.
Monday 25 October
Skills and Post-16 Education Bill [HL] – Third Reading
Friday 22 October
Last day to table amendments for the marshalled list for: Skills and Post-16 Education Bill [HL] – Third Reading
Monday 18 October
Business in the Chamber at 2.30pm
1. Oral questions (40 minutes)
2. Skills and Post-16 Education Bill [HL] – Report (day 2 of 2)
Thursday 14 October
Last day to table amendments for the marshalled list for: Skills and Post-16 Education Bill [HL] – Report (day 2)
Tuesday 12 October
Business in the Chamber at 2.30pm
1. Oral questions (40 minutes)
2. Skills and Post-16 Education Bill [HL] – Report (day 1 of 2)
Friday 8 October
Last day to table amendments for the marshalled list for: Skills and Post-16 Education Bill [HL] – Report (day 1)