National Pupil Database
The Department for Education gives away millions of children's identifying school records to companies without families' permission. That's wrong. We want that to stop. The National Pupil Database and national Learner Records are *your* personal details and history collected across your Early Years and school life from age 2-18. Or perhaps they may be your children's or grandchildren's data. It's 21 million names and home address. Exam results. Mental health, autism, disability, and learning difficulties. Child offender and teenage pregnancy. Military services family. Named records now even reveal students' religion and sexual orientation from equality monitoring. Since 2012 the Department for Education has handed out identifying and sensitive, personal confidential data to journalists, businesses, charities, think tanks, academics and other third parties. Millions of records have been given away, over 2,500 times, to hundreds of people or organisations. You aren't told to whom and it's without your permission.
A timeline of DDM, DfE and ICO actions
2012
November: Michael Gove announced plans to open up the National Pupil Database for commercial re-use. He changed the law to let the Department for Education distribute identifying pupil-level extracts from the National Pupil Database “for a wider range of purposes than currently possible” to “maximise the value of this rich dataset”. He said, “We want to give organisations greater freedom to use extracts of the data for wider purposes, while still ensuring its confidentiality and security.”The Education (Individual Pupil Information) (Prescribed Persons) (England) Regulations 2009 is changed to allow the DfE to share pupils’ personal data collected from educational settings in England with certain third parties. This must be “for the purpose of promoting the education or well-being of children in England” as set out in the Education Act 1996, which is amended by the Education (Individual Pupil Information) (Prescribed Persons) (England) Regulations 2009 (Amended 2013). The 1996 Act s537A(7) creates an expectation of professional confidentiality in that it expressly prevents publication of the information “in any form” which includes the name of the pupil or pupils to whom it relates. The Department breaches this commitment, and instead communicates names and addresses to an opaque and unlimited chain of third-parties; including from 2015, the Home Office for the purposes of the Hostile Environment.
2015
October. Jen Persson begins discussion with the DfE Deputy Director, Education Standards Evidence and Dissemination Division, to resolve issues of Subject Access and fair processing.December: A revised Memorandum of Understanding (data sharing agreement) between the DfE and the Home Office, in place since July 2015, v1.0 is finalised and signed off on December 18, 2015 to share the individual confidential data including nationality "(once collected)" of up to 1,500 children a month from school census with the Home Office. This remains unknown in the public domain until October 2016, after the first school census collection of children's nationality data the day before.
2016
June 2016: Jen continues discussions with the DfE Deputy Director, Education Standards Evidence and Dissemination Division, and the DfE Director for Data and Education Standards Analysis, with regard to growing suspicions that the DfE is hiding plans to begin sharing pupil data with the Home Office for the purposes of the Hostile Environment.July: Schools Minister Nick Gibb MP, denies that the new (nationality and country-of-birth) data due to start being collected from October 2016, will be shared with other Government departments in a written parliamentary question 42842, when asked if the DfE consulted (a) schools and (b) parents on the new requirement to collect country of birth data in the 2016-17 school census; how parents are informed of their right to opt out of providing that information; for what purpose that information will be used; and whether that information will be shared with other Government departments. Nick Gibb replies. "The data will be collected solely for the Department’s internal use for the analytical, statistical and research purposes described above. There are currently no plans to share the data with other government departments unless we are legally required to do so. The Department have not consulted directly with parents regarding the changes to the school census."
The #BoycottSchoolCensus" took on a life of its own and the timeline can followed in parallel.
2017
February: The Director General at the UK Statistics Authority wrote to and worked with the DfE, requesting changes in 2017. December: The use of pupil data by the Home Office and police was included for the first time in the quarterly third-party data published figures of data shared with "external organisations".
2018
March: The Director General at the UK Statistics Authority wrote to and worked with the DfE, again requested changes in 2018. The DG made 10 recommendations including on public engagement with families. Ed Humpherson also wrote, "We also reviewed DfE’s response to Parliamentary Question (PQ) 1090654 about NPD data sharing. The PQ response was correct to state that no “personal confidential identifying data” was shared. However, the response also contained an inaccurate statement about the risks of identification...."
2019
May: the first DPIAs of the NPD and the AP census are both released in answer to an FOI request.June: Our legal team submitted a full regulatory complaint regarding national pupil data practices to the ICO, on behalf of defenddigitalme.
November: The ICO wrote to our Director but addressed to Liberty, with initial findings. “Our view is that the DfE is failing to comply fully with its data protection obligations. Primarily in the areas of transparency and accountability, where there are far reaching issues, impacting a huge number of individuals in a variety of ways,” and that the DfE, "was failing to fully comply with the GDPR because many parents and pupils are “either entirely unaware of the school census and the inclusion of that information in the national pupil database or are not aware of the nuances within the data collection, such as which data is compulsory and which is optional”. (Schools Week).
2020
October: the ICO released a short executive summary from the DfE compulsory audit in response to our case made in June 2019 and complaints by Liberty (first begun in 2015). Among its 139 findings, it identified that, "The DfE are not providing sufficient privacy information to data subjects as required by Articles 12, 13 and 14 of the GDPR," and that "The DfE are reliant on third parties to provide privacy information on their behalf however, this often results in insufficient information being provided and in some cases none at all which means that the DfE are not fulfilling the first principle of the GDPR, outlined in Article 5(l)(a), that data shall be processed lawfully, fairly and in a transparent manner."
2021
January: The Department published its first and only formal response to the ICO audit in the House Library, paper reference DEP2021-0072 which it concluded by saying, "The department is committed to this programme of work" and it would publish a further update in June 2021. No further update has been made to date.February: DDM and DfE officials meet and a range of issues are discussed including the question, "there are 23 million people in the database, only 8 million currently in schools, the rest won’t be getting the same information. How will they be told?" and. DDM was told by DfE officials that, "By September this year there will be new privacy notices and FAQs for new parents." (none is forthcoming)
April: The Schools Minister Nick Gibb promised Liberal Democrat MP Daisy Cooper an update on the ICO audit in a parliamentary question UIN 179576, tabled on 12 April 2021 and said it would be published in June 2021. It was not.
June: In answer to a further follow up written parliamentary question, UIN 20537, tabled on 22 June 2021, it was promised (delayed) by July 22, 2021. It has still not appeared to date. November: The DfE has not responded to our FOI for a copy of the full audit findings to be published although its receipt was acknowledged.
2022
January: In January 2022 the Department for Education (“DfE”) announced a “new daily attendance data collection trial”, collecting personal data about school children in England, through the company Wonde contracted to act as the ‘middle-man’. The communications and documents that the Information Commissioner’s Office (“ICO”) subsequently released in response to our Freedom of Information Request in July, show that at that time, and when the data collection started, the DfE had not in fact worked with the ICO on its DPIA, contrary to the DfE’s initial communication to schools (which the ICO subsequently asked it to edit /retract). Nor had the DfE had a Data Protection Impact Assessment (“DPIA”) signed off before processing began, as required by law.The ICO asked the Department to pause the high risk data collection, and carry out the risk assessment. The Department declined to pause.
Nearly three years after the audit began and the breach in the Learner Records Service was exposed in the press, The ICO issued a reprimand to the DfE over the 2018-20 LRS data breach which states, "The DfE must take steps to improve transparency around the processing of the LRS database so Data Subjects are aware and are able to exercise their Data Subject rights, in order to satisfy the requirements of article 5 (1)(a) of the UK GDPR,and, "Normally, the ICO would expect the DfE to provide an update on the steps taken after a three month period." Trustopia was dissolved, and its commercial company directors saw no repercussions from unlawful practice at all. The Department’s legal advice at the time was not to pursue breach of contract pending the ICO investigation. The company has since ceased trading.
2023
January. The DfE added another sensitive new label to pupil records, a “young carer” label in the termly School Census pupil-level data collection without any plan to tell children or families. It is not fuly thought out and we have some concerns.March. The ICO publishes an article in Civil Service World saying, "Our approach with the DfE resulted in positive change. I am very pleased with the progress the DfE has made in the past two years towards improving their overall compliance with people’s information rights in general, and the security of shared datasets in particular."
March. Call for action from over 25 signatories to call on the UK Information Commissioner to uphold children’s rights in the Hostile Environment in a letter on the 2023 International Day for the Elimination of Racism.
