November: Michael Gove announced plans to open up the National Pupil Database for commercial re-use. He changed the law to let the Department for Education distribute identifying pupil-level extracts from the National Pupil Database “for a wider range of purposes than currently possible” to “maximise the value of this rich dataset”. He said, “We want to give organisations greater freedom to use extracts of the data for wider purposes, while still ensuring its confidentiality and security.”
The Education (Individual Pupil Information) (Prescribed Persons) (England) Regulations 2009 is changed to allow the DfE to share pupils’ personal data collected from educational settings in England with certain third parties. This must be “for the purpose of promoting the education or well-being of children in England” as set out in the Education Act 1996, which is amended by the Education (Individual Pupil Information) (Prescribed Persons) (England) Regulations 2009 (Amended 2013). The 1996 Act s537A(7) creates an expectation of professional confidentiality in that it expressly prevents publication of the information “in any form” which includes the name of the pupil or pupils to whom it relates. The Department breaches this commitment, and instead communicates names and addresses to an opaque and unlimited chain of third-parties; including from 2015, the Home Office for the purposes of the Hostile Environment.
2015
October. Jen Persson begins discussion with the DfE Deputy Director, Education Standards Evidence and Dissemination Division, to resolve issues of Subject Access and fair processing.
December: A revised Memorandum of Understanding (data sharing agreement) between the DfE and the Home Office, in place since July 2015, v1.0 is finalised and signed off on December 18, 2015 to share the individual confidential data including nationality "(once collected)" of up to 1,500 children a month from school census with the Home Office. This remains unknown in the public domain until October 2016, after the first school census collection of children's nationality data the day before.
2016
June 2016: Jen continues discussions with the DfE Deputy Director, Education Standards Evidence and Dissemination Division, and the DfE Director for Data and Education Standards Analysis, with regard to growing suspicions that the DfE is hiding plans to begin sharing pupil data with the Home Office for the purposes of the Hostile Environment.
July: Schools Minister Nick Gibb MP, denies that the new (nationality and country-of-birth) data due to start being collected from October 2016, will be shared with other Government departments in a written parliamentary question 42842, when asked if the DfE consulted (a) schools and (b) parents on the new requirement to collect country of birth data in the 2016-17 school census; how parents are informed of their right to opt out of providing that information; for what purpose that information will be used; and whether that information will be shared with other Government departments. Nick Gibb replies. "The data will be collected solely for the Department’s internal use for the analytical, statistical and research purposes described above. There are currently no plans to share the data with other government departments unless we are legally required to do so. The Department have not consulted directly with parents regarding the changes to the school census."
The #BoycottSchoolCensus" took on a life of its own and the timeline can followed in parallel.
2017
February: The Director General at the UK Statistics Authority wrote to and worked with the DfE, requesting changes in 2017.
December: The use of pupil data by the Home Office and police was included for the first time in the quarterly third-party data published figures of data shared with "external organisations".
2018
March: The Director General at the UK Statistics Authority wrote to and worked with the DfE, again requested changes in 2018. The DG made 10 recommendations including on public engagement with families. Ed Humpherson also wrote, "We also reviewed DfE’s response to Parliamentary Question (PQ) 1090654about NPD datasharing. The PQ response was correct to state that no “personal confidential identifying data” wasshared. However, the response also contained an inaccurate statement about the risks ofidentification...."
June: Our legal team submitted a full regulatory complaint regarding national pupil data practices to the ICO, on behalf of defenddigitalme.
2020
October: the ICO released a short executive summary from the DfE compulsory audit in response to our case made in June 2019 and complaints by Liberty (first begun in 2015). Among its 139 findings, it identified that, "The DfE are not providing sufficient privacy information to data subjects asrequired by Articles 12, 13 and 14 of the GDPR," and that "The DfE are reliant on third parties to provide privacy information on their behalf however, this often results in insufficient information being provided and in some cases none at all whichmeans thatthe DfE are not fulfilling the first principle of the GDPR, outlined inArticle 5(l)(a), that data shall be processed lawfully, fairly and in a transparent manner."
2021
January: The Department published its first and only formal response to the ICO audit in the House Library, paper reference DEP2021-0072 which it concluded by saying, "The department is committed to this programme of work" and it would publish a further update in June 2021. No further update has been made to date.
February: DDM and DfE officials meet and a range of issues are discussed including the question, "there are 23 million people in the database, only 8 million currently in schools, the rest won’t be getting the same information. How will they be told?" and. DDM was told by DfE officials that, "By September this year there will be new privacy notices and FAQs for new parents." (none is forthcoming)
April: The Schools Minister Nick Gibb promised Liberal Democrat MP Daisy Cooper an update on the ICO audit in a parliamentary question UIN 179576, tabled on 12 April 2021 and said it would be published in June 2021. It was not.
Nearly three years after the audit began and the breach in the Learner Records Service was exposed in the press, The ICO issued a reprimand to the DfE over the 2018-20 LRS data breach which states, "The DfE must take steps to improve transparency around the processing of the LRS database so Data Subjects are aware and are able to exercise their Data Subject rights, in order to satisfy the requirements of article 5 (1)(a) of the UK GDPR,and, "Normally, the ICO would expect the DfE to provide an update on the steps taken after a three month period." Trustopia was dissolved, and its commercial company directors saw no repercussions from unlawful practice at all. The Department’s legal advice at the time was not to pursue breach of contract pending the ICO investigation. The company has since ceased trading.
2023
March. The ICO publishes an article in Civil Service World saying, "Our approach with the DfE resulted in positive change. I am very pleased with the progress the DfE has made in the past two years towards improving their overall compliance with people’s information rights in general, and the security of shared datasets in particular."