UPN and Educational Software

[TechMonkey]

Working in an Independent I've not had to deal with UPNs a whole lot but I'm starting to wonder if we should. One reason was more and more systems we export data to ask for it and currently we are just using a Unique id from our MIS. But looking at the guidelines from the DfE they say:

It must be held electronically and only output when required to provide information to the LA, central government or another school/academy to which the pupil is transferring. Under the Data Protection Act 1998, the UPN is designated as a ‘general identifier’ making its use for any purpose unrelated to education illegal. A pupil’s admission number, rather than the UPN, should be used as the general pupil reference number on the admission register or paper files.

My interpretation is that a company shouldn't ask for the UPN and a school should not give it out. Am I correct or being overly cautious and if I am correct why are companies asking for them?

[forkies]

When it states "unrelated to education illegal", technically you are using it to provide some sort of educational content such as a VLE?

[pcstru]

IMO you should be a little bit cautious, but it is not clear cut. There are some things to consider :

 

UPN is not an ordinary bit of data as the DfE advice says it is a general identifier under the DPA and it's use is controlled by the Secretary of State. The advice also says you should use admission number where you need an ID to do data matching AND you should not give it out to data subjects even as part of a normal subject access request. That last bit I think just emphasises this is not a normal piece of data.

 

That said, you are allowed to process it - so when you run a CTF file in, it will almost certainly match on UPN. Being part of a school to school transfer, it is covered by the guidance. As is sending it via ASC to central government. If your MIS is a cloud based system then your provider is simply acting as a 3rd party supplier under your DP registration so that should be OK (nothing else is being done with the data).

 

The issue might arise with a 3rd party that was offering other services, so they are processing the UPN for reasons other than the purposes explicitly listed by the guidance, say to allow them to uniquely track an individual at a national level between different customers (i.e. when the student changes school/educational provider, they offer a service to 'transfer the previous schools data'). IMO this may be problematic in a number of ways and you should seek guidance from the ICO.

[TechMonkey]

Thanks both. This tally's with my thinking. I guess you could say that tracking (as in progress and achievement) and assessments are educational but I would still feel a bit funny giving them out. Admissions number may be better.

[pcstru]

Thanks both. This tally's with my thinking. I guess you could say that tracking (as in progress and achievement) and assessments are educational but I would still feel a bit funny giving them out. Admissions number may be better.

I only know of one supplier that demands UPN (or another national identifier) and who is using it in a way that worries me - everything else I've dealt with asks for admission number. They say they have referred it to the ICO and I'm waiting for a response back from that.

[Linfit]

You are right to be cautious - UPN's were implemented for a specific reason and their use is restricted - when the Diploma's were introduced (remember them ?) they needed a national tracking system but the exam boards were not allowed by the DFE to use the UPN - this resulted in the introduction of ULN's, which have fewer restrictions on their use than the UPN's. Other than school to school or school to LA stuff, I would use admission number, and would not supply the UPN if asked.