Take action to protect your data

Did you know you have a national ID number at the Department for Education in England? The Unique Learner Number (ULN) has been assigned to over 30 million people, who have been in state funded education, at any age, since 2000. Left school? So has all your personal data and school records.

Until recently, there was a national opt out of data sharing by the Learner Records Service from Department for Education (DfE). This is just *one* of over fifty datasets the DfE controls, and gives away personal confidential data from. The National Pupil Database is yet another separate melting pot of pupil records. Now they say they don’t let learners opt out, despite their proven lack of appropriate safeguards.

  • If you want to object to some of your records being given away, you can follow these steps how to object to use of your Learner Record.
  • Contact the LRS Service Desk on 0345 602 2589. If necessary, refer to their own handout.
  • You can also make a complaint to the ICO if you were unaware that your school records would be passed on to the LRS or National Pupil Database and given away to third parties. Or if the LRS refuse to honour your Right to Object. The ICO helpline is tel: 0303 123 1113.
  • Share this with your friends and family. Contact your MP.
  • If you wish, contact us to ask for help or discuss your experience afterwards, We can track it as an anonymous / generalised case study and it may help us make things better for everyone.

We believe there should be an opt out of the National Pupil Database and all your school records, at the point of collection.

The background is summarised here. The Learning Records Service (LRS) is operated by the ESFA, the Education and Skills Funding Agency, an executive agency of the Department for Education (DfE). The LRS issues Unique Learner Numbers (ULN) and creates Personal Learning records across England, Wales and Northern Ireland. The LRS collects information about learners registering for relevant post-14 qualifications, for example:

  • GCSEs and A-Levels
  • Entry to Employment Certificates
  • Regulated Qualifications Frameworks
  • Welsh Baccalaureate and associated units

This means 14+ education, Apprenticeships (from 1 May 2017), Community Learning, and even Adult Education such as evening classes.

What does the DfE say about your rights?

The privacy notice states the following, aligned with UK data protection law. You can ask to exercise the rights:

  • to ask for access to information about you that is held
  • to have your personal data rectified, if it is inaccurate or incomplete
  • to request the deletion or removal of personal data where there is no compelling reason for its continued processing
  • to restrict processing of your personal data (i.e. permitting its storage but no further processing)
  • to object to direct marketing (including profiling) and processing for the purposes of scientific/historical research and statistics
  • not to be subject to decisions based purely on automated processing where it has a legal or similarly significant effect on you.

What is in my Record?

From full name and address, contact details, to gender and disability, health problems and all about your study, the further identifiers and personal data involved in your individualised, or personal learner record, are listed on pages 4-11 of the User Guide.

The heart of the record is a Unique Learner Number (ULN). In 2014, this number became mandatory within maintained schools for England, Wales and Northern Ireland for pupils aged 14+. This means that at minimum, anyone state educated today aged 14 to 18, as well as anyone in adult further education, is almost certain to have an individualised personal learner record, known as the ILR.

The academic and vocational data in the ILR / PLR (individualised, or personal learner record) may go back to 2009, but does not cover higher education. HESA data are linked to it separately in the All Education dataset.

Personal information stored in the Personal Learning Record are retained (and therefore may be processed by the DfE and by third parties) for 66 years. These information may be being shared with third parties about you, but without your knowledge.

Why it matters

Personal data are given away to third parties by the Department for Education. While the distribution process was tightened up in 2018, for the National Pupil Database, these records are still accessed by and given away to third parties. And there is even less transparency about these ILR data.

You cannot control why the data are shared, or which organisations receive which of your data, some of which is sensitive data, such as health problems. The only choice you have is to opt out of the sharing of the record completely. Since the opt out is offered, we think you should know about it, and act on it, to protect your privacy.

We are concerned that the use of these data increasingly also includes linking with other datasets, and its onward use by others is opaque. For example, with the Office for Students which “may link the data provided by ESFA to other data sources, including (but not limited to) data from the Student Loans Company, the Higher Education Statistics Agency, and the National Pupil Database detailed under seperate [sic] agreements”. It is not clear whether these are for functional, or research purposes and there is no way to know.

National Insurance Number is collected for example, “to match data with Department for Work and Pensions data to assess the economic impact of training programmes on learners, particularly but not exclusively those who are unemployed.”

We are also concerned that DfE may be assuming not opting out, is “explicit consent” which could be considered a basis for using the data for a very wide range of purposes, and lead to unlawful use by third parties.

Background to the Record and its Use by Third Parties

If aged 14 to 19, your school, college or learning provider can give you your ULN reference. Since March 2013, Awarding Organisations have started to print individuals ULN references on their certificates. You should still be able to opt out of national uses of the ILR/PLR without knowing your unique learner number.

“The PLR is a free, secure, online, verified record of what individuals have studied and achieved since age 14. It allows individuals access to their current achievements and exam results. Learners can access their achievements online now through the National Careers Service website.

Individuals can share achievement records with schools, colleges, further education, training providers, universities, employers or careers advisors – as long as the individual does not opt out.Schools, colleges, higher education institutions, careers services, employers and training providers can all use the PLR to inform furthering education, training and employment.” [source: gov.uk]

The privacy notice is pretty terrible.

Data are given out to third parties not clearly explained in the privacy notice. The distribution register is here, listed among External Data Shares, for example ‘DfE external data shares: October 2018‘ [MS Excel Spreadsheet, 93.8KB].

Where these data are involved is listed as “Learner Records Service (LRS) Individualised Learner Record (ILR)”
(Filename: External Data Shares, Note multiple tabs within file)

Can I find out if my own data have been given away? Subject Access Request.

You have the right to ask the DfE if *your* data were sent to which company. This is Subject Access Request. But the DfE currently has no suitable system to manage this at scale. That does not reduce your Right to Know. Read more to find out how you can make a request.