Sharing of school pupils' data put on hold

The national pupil database compiles data from school censuses

The government has halted researchers and others from accessing personal information about UK schoolchildren, it has emerged.

The Department for Education said the step was a temporary move to modify the national pupil database's approval process.

It told the BBC that the step was required to be compliant with a shake-up of EU data privacy rules.

The law gives children and others new rights and comes into force on 25 May.

"The department takes the use of personal information and the implications of the General Data Protection Regulation very seriously," the DfE said in a statement.

"We've temporarily paused applications for data from the national pupil Database ahead of the implementation of the GDPR."

The national pupil database is designed to help experts study the effect of different educational strategies over time.

Access was "paused" on 1 May, and the DfE has said it expects to provide further information in June.

Campaigners have raised concerns that many parents are unaware that data on millions of English schoolchildren can be shared with academics and businesses.

Applicants can request different levels of access, with the highest level including individual children's names, addresses, ethnicities and disabilities, among other factors.

A recent survey by the data privacy campaign Defend Digital Me suggested most parents (69%) did not know about the data-sharing.

Currently, parents and children are not allowed access to their data.

Gender, ethnicity, exam performance and reasons for absence can all be accessed by third parties under certain rules.

Defend Digital Me is calling for a change in how the data is managed.

Prof Ross Anderson - a leading cyber-security expert at the University of Cambridge - has also raised concerns, despite the fact that other researchers at the institution have made use of the data.

"The government is forcing schools to collect data that are then sold or given to firms that exploit it, with no meaningful consent," he blogged on Monday.

"There is not even the normal right to request subject access so you can check whether the information about you is right and have it corrected if it's wrong.

"Our elected representatives make a lot of noise about protecting children; time to call them on it."

Academic research

English records in the national pupil database have been kept since 1998 and include more than 21 million named English schoolchildren.

Freedom of Information (FoI) requests made by Defend Digital Me also found data on 1.2 million Scottish children had been collected since 2007, though in that case the pupils were not named.

The information, collected by the DfE, is generally gathered via school censuses.

Source: Defend Digital Me

Records of who has accessed the data and why are available on the DfE's website.

Requests from academic researchers make up the majority of data extract applications processed by the DfE.

Many relate to projects studying education in the UK, for example.

Academic researchers' use of personal datasets has faced scrutiny recently - notably after it was revealed that data gathered by a Cambridge University researcher had been passed to Cambridge Analytica.

There is no suggestion that Cambridge Analytica had accessed national pupil database records.

Who accesses data on school children?

Besides academic researchers, there are also requests from private companies, which use the data to aid education policy consulting services to local authorities.

The Home Office has requested data on schoolchildren under its immigration control and Syrian resettlement programmes - though the latter request has yet to receive approval.

The BBC's Newsnight programme also requested data, in March 2017, when it was producing a package on the English school system. It was given tier-two access, which includes pupils' ages and ethnicities but not names or home addresses.

The DfE records that Newsnight later destroyed the data in accordance with rules around access.

Defend Digital Me has said that the government does not currently allow parents or children the right to see records relating to them or to have them corrected if inaccurate.

According to the group's survey of 1,004 English parents - carried out by Survation - 79% would choose to see the records if they were able to.

"Defend Digital Me is campaigning to have that changed, and wants the government to respect children's subject access rights... in the General Data Protection Regulation [GDPR]," the report said.

Jen Persson, the group's director, told the BBC: "As a mother with three children in primary school four years ago, I didn't know there was a national pupil database at all or that my children's personal data were stored at named level, given away to commercial third parties."

'Parents unaware'

She said that everything she had since discovered, thanks to research and FoI requests, was "not widely known at all".

The research by Defend Digital Me "raises serious questions", said Ailidh Callander, a legal officer at civil liberties group Privacy International.

"It is important that data practices in the education sector are examined thoroughly - particularly given the sensitivity of children's data," she told the BBC.

Defend Digital Me has also investigated the use of web monitoring software on computers used at school

A spokeswoman for the Information Commissioner's Office (ICO) said that it had engaged with the DfE about its processing of pupil data in the past "and continues to do so".

"The GDPR requires that personal data is processed fairly, lawfully and transparently, as well as enhancing people's rights," she said.

"We understand that the DfE is reviewing its processing of pupil data as part of its GDPR preparations. And the ICO will continue to engage with the DfE on this."