News: Challenging the Department for Education on excessive pupil data collection

UPDATE: January 2024

In December 2023, the courts refused us permission to pursue this with a legal challenge. We believe that the twice-daily data collection on a named basis by the DfE at national level is excessive and unnecessary and carries disproportionate risks, rather than for example, national collection and retention of only aggregated statistics, while named data remains at local level.

The ruling does not dispute or affect the significance of the concerns the Information Commissioner raised, or our own view at Defend Digital Me that there is unlawful practice — and we continue to challenge the DfE misuse of excessive pupil data collection for (a) commercial reuses giving children’s identifying pupil records away by the million from the School Census, without families’ consent or any opt out, (b) the same commercial reuse of anyone’s records who has been a pupil since 1996 and now an adult, and (c) Home Office misuse for immigration enforcement to use pupil records for up to the last 5 years, to match and find pupils or relations the HO demands.

Pupil data are collected expressly in law “for the purposes of education”, families and former pupils have still not been told about these reuses or offered their right to object as set out in data protection law, and any misuse must stop.

THE STORY

In January 2022 the Department for Education (“DfE”) announced a “new daily attendance data collection trial”, collecting personal data about school children in England, through the company Wonde contracted to act as the ‘middle-man’.

The DfE had asked schools to sign up to a daily attendance tracker ‘trial’ which would collect real-time data from their registers “to help address absences more quickly”. What role the national Department has for interventions with the individuals whose names and details it would collect was unclear, in what appeared to be an obviously excessively frequent, unnecessary and disproportionate data collection. We asked, and were told the data was being extracted every two-to-four hours, every day. Why the national needs could not be met by collecting statistics, or why a less intrusive option was not explored for the, “expansion of [the] existing data collection” as described by the DfE, or “for the new daily frequency and via this new means,“ was not explained anywhere. If this is about absence, why is the national Department collecting data daily from millions of children who never miss school?  And who exactly will access what data as part of the Attendance Alliance at the DfE? Who would tell pupils and families?

We wrote to the ICO on February 1st with concerns. In May, we made a request for information as little had been forthcoming.

The communications and documents that the Information Commissioner’s Office (“ICO”) subsequently released in response to our Freedom of Information Request in July, show that at that time, and when the data collection started, the DfE had not in fact worked with the ICO on its DPIA, contrary to the DfE’s initial communication to schools (which the ICO subsequently asked it to edit /retract). Nor had the DfE had a Data Protection Impact Assessment (“DPIA”) signed off before processing began, as required by law.

The ICO asked the Department to pause the high risk data collection, and carry out the risk assessment. The Department declined to pause.

The ICO also flagged that the DfE had failed to meet its DPIA obligation as it must be completed prior to starting the data processing. When the DPIA was subsequently signed off and provided to the ICO (then retracted and another version sent the next day), the ICO went on to document a wide range of concerns described in over ten A4 pages (at the end of the bundle), including about the excessive 66-year data retention period (just like the Schools Bill), and the DfE’s failure to demonstrate the necessity of the data processing.  At the time of writing, the DfE does not appear to have made any substantive changes to address the ICO’s long list of concerns, including being unable to demonstrate it has met its lawful obligations. The DfE seems to be carrying on, business as usual 8 months later after those ICO findings on this ‘trial’, much as it did after its 2020 ICO audit.

As of September 1st, we were told 65% of schools were sharing their daily attendance data, that’s 14,443 schools out of 22,060 that have been approached by Wonde and asked to share data.

We are very concerned at the policy-level decision making, as well as lack of care and attention paid to the process, once again, before starting a new national data collection at scale, and that includes highly sensitive data, and which poses risks to the fundamental rights and freedoms of pupils. Not only what is being done, but how. Our legal team at data rights agency AWO, has written to the Department to seek urgent answers on our behalf as there is a lack of transparent information being provided to schools, parents and children about the data collection. The DfE’s initial response to us has confirmed that the daily attendance data is likely to be used to support legal interventions, including issuing fixed penalty notices and prosecuting parents. The DfE’s response also leaves important questions hanging, regarding how daily pupil data could be used in future phases of the project and who it could be shared with.

Our legal team is continuing correspondence with the Department. We will also launch a crowd-funder to raise money for the challenge once we hear if the case can proceed.

You can also support by sharing this post with friends: and you can make your voice heard with your MP.

Background

The data items include:

• forename
• surname
• unique pupil number
• gender
• ethnicity
• child looked after**
• child previously looked after**
• SEN support
• education health and care plan
• free school meals including FSM6
• pupil premium
• national curriculum year group
• school unique reference number
• local authority code
• all attendance sub-codes

**What is a “looked after” child? https://childlawadvice.org.uk/information-pages/local-authority-duties-to-looked-after-children/

The sequence of events summarised from the ICO and DfE communications in February and March 2022

The original bundle from 2022 can be read here.

• January 25th Schools are asked to sign up to a new daily attendance data collection trial. https://www.gov.uk/government/news/new-measures-to-increase-school-attendance
• February 1st DDM wrote to the ICO listing concerns about the project.
• February 9th ICO writes to the DfE with a number of questions and describes a number of enquiries they have had (including from DPOs and parents).
• DfE sends ICO a copy of the comms already sent to schools with thanks to those who have already signed up. “We have been working closely with the Information Commissioner’s Office (ICO) on our data protection impact assessment (DPIA). We intend to publish the DPIA and related privacy notices shortly and we will be share them with you at that point.”
• February 9th ICO asks DfE to remove that line in the comms to schools “As the ICO has not yet seen the DPIA”.
• February 9th ICO asks DfE to specify when the DPIA will be complete and signed off
• February 10th ICO asks DfE to pause the collections and any further processing and that schools should not be able to sign up until the DPIA has been completed.
• February 10th ICO sets out the dates for DfE to confirm including the DfE will send the ICO the DPIA on the 14th.
• February 10th DfE tells ICO not possible to pause the collections.
• February 14th V1 DPIA signed off (according to date on final page)
• February 14th V1 DPIA received by the ICO and say they’ll be back in touch once if has been reviewed.
• February 15th V1 DPIA withdrawn by DfE for urgent edit (DfE informs ICO but no detail specified to the ICO why.)
• February 15th DfE sends the ICO ‘slightly updated’ version of the DPIA sent on 14th. V2 DPIA (?) signed off (according to date on final page. Officially still labelled v1 on its front cover but date has changed on final page and DfE calls it 1.1 in the email.
• February 15th DfE confirmed to ICO that a note would be sent “tomorrow” to schools with access to the DPIA and note on ICO independent role
• February 16th DfE sent comms [to schools], “On Tuesday 15 February we formally engaged with the ICO to gain an independent assessment of the risk.”
• February 17 ICO asks DfE if the DPIA is only available to schools / MATs rather than on the gov.uk website and publicly available.
• February 17 DfE tells ICO they issued the comms on 16th (as above) and has “been sending a google link” for anyone requesting a copy of the DPIA until we can get it uploaded to the gov.uk site. These documents will be uploaded online, “by the end of the month at the latest”.
• February 21 DfE apologises to ICO the DPIA is not yet on gov.uk and says it is being made available to schools as well as more widely via a Google drive.
• February 21  ICO asks the DfE to inform them when the DPIA is made available on the DfE website, and gov.uk and to provide a link.
• March 1st DfE tells the ICO that getting the DPIA published on gov.uk is challenging, and they would also be changing the version accessed through the Google drive to ensure only one version is accessed by the public.
• March 15th The ICO sent the DfE ten pages of significant and detailed concerns.

We received this only in July 2022 via FOI, at which point we made our well-evidenced legal complaint to the DfE. A year after ongoing communications but with no real change or resolution, we took the case to the courts. In December 2023, the courts told us that permission had been refused to pursue this legal challenge.