National pupil data: next legal steps

It is now two years and one week since the ICO published their summary of a regulatory audit concerning the Department for Education’s (“DfE”) failure to comply with data protection law. On the anniversary, the DfE published a short blog about the School Census but failed to mention the audit or give any update on it, despite long overdue previous promises made to MPs in Parliament to do so. It failed to mention rights. It was rather misleading about whose data was in the data released to third parties, and the process around it.

Not only has the DfE refused to publish a copy of the ICO report or any timeline to assess what was and was not to be actioned by when, but they have repeatedly failed to provide details they have promised of the steps that they are taking to address the failings.  In the meantime, as far as we can see, the DfE’s practices in relation to the collection and sharing of children’s information seem to continue largely unchanged, and worse, have continued to ignore necessary changes before further starting new data expansions.

The National Pupil Database includes information collected annually at child-level, as part of the Alternative Provision Census. This information includes extremely sensitive information concerning any special educational needs; learning difficulties; social emotional and mental health needs; speech, language and communication needs; physical disability; autistic spectrum disorder; vision impairment; hearing impairment; or other difficulty or disorder.  It also requires the disclosure of matters such as pupils’ pregnancy; mental health or physical health need; permanent exclusion, or the fact that a child has been placed in a young offender institution. We first complained to the ICO and the DfE on this in 2017.

The current deficiencies include a failure by the DfE to comply with the transparency and notification obligations required by the UK General Data Protection Regulation and Data Protection Act 2018.  The DfE has failed to provide a Privacy Notice to parents and children setting out what information is collected, why it is collected and what is then done with it.  Linked to this, the DfE does not appear to have appropriate procedures and safeguards in place in relation to the handling of this information.  This should include mechanisms for enabling the right to object to the processing of the data, a process for inaccurate data to be corrected, and adequate safeguards in relation to the sharing of the data with third parties.

We have therefore instructed solicitors at Leigh Day, and barristers at Monckton Chambers. We have sent the Department a detailed 29-page Letter Before Claim setting out the ways in which we consider that the DfE is behaving unlawfully. We have requested a response within 21 days.  In the absence of a satisfactory response that addresses the concerns, we anticipate issuing formal Court proceedings by making an application for permission to apply for judicial review.

If you want to help us with the legal costs associated with investigating and bringing this legal claim, including the risks of having to pay the DfE’s legal costs if the challenge is unsuccessful, you can help us here https://www.crowdjustice.com/case/labelslastalifetime/ Thank you to all our supporters so far, who have made the long process to get here possible. We’ve still far to go and we hope you’ll stick with us.