Data protection census

[tinkerbotsict]

Saw this article earlier

 

https://www.tes.com/news/school-news/breaking-news/local-authorities-collecting-sensitive-pupil-data-without-consent

[enjay]

I can't speak for your school, but we tell parents some data is shared with DfE. Also, doesn't sound like consent is a factor here, as schools are legally required to include this in their census data.

@jenatddm - what am I missing?

[CAM]

Schools issue a privacy notice to new arrivals. This contains a signpost to the DfE website which orders parents and pupils to check the site for any updates to the notice about how information is collected and used. It also collects information on if the privacy notice has been issued to parents and the response (typically Sought, No Response). This effectively absolves the DfE of it's responsibilities to notify parents as they expect schools to do it (pass the buck!) for them and provide proof the privacy notice has been properly sent and a response received. Given the scaremongering that happened when Nationality, Country of Birth, etc was added to the census it doesn't exactly work well....

[tinkerbotsict]

I can't speak for your school, but we tell parents some data is shared with DfE. Also, doesn't sound like consent is a factor here, as schools are legally required to include this in their census data.

@jenatddm - what am I missing?

 

I just saw the article and thought I would share

[enjay]

I just saw the article and thought I would share

 

Hence me tagging the author, as she is an Edugeek...

[tinkerbotsict]

Hence me tagging the author, as she is an Edugeek...

 

I didn’t release lol

[jenatddm]

Schools issue a privacy notice to new arrivals. This contains a signpost to the DfE website which orders parents and pupils to check the site for any updates to the notice about how information is collected and used. It also collects information on if the privacy notice has been issued to parents and the response (typically Sought, No Response). This effectively absolves the DfE of it's responsibilities to notify parents as they expect schools to do it (pass the buck!) for them and provide proof the privacy notice has been properly sent and a response received. Given the scaremongering that happened when Nationality, Country of Birth, etc was added to the census it doesn't exactly work well....

 

It also collects information on if the privacy notice has been issued to parents and the response (typically Sought, No Response)" sounds intriguing. Not heard that before. You believe DfE collects information if a PN has been issued, proof the privacy notice has been properly sent and a response received? How does that work?

[jenatddm]

I can't speak for your school, but we tell parents some data is shared with DfE. Also, doesn't sound like consent is a factor here, as schools are legally required to include this in their census data.

@jenatddm - what am I missing?

 

You're right consent is not generally the basis for children's data collection in the school censuses, although it's not completely to disregard, given the sensitivity level of the new data to be collected, and their types - the Data Protection Act requires not only Schedule 2, but an additional criteria to be met of DPA Schedule 3.

 

However, some data are in effect consnet based because they are optional and must not be ascribed, but only provided by the parent [or child]. ie ethnicity, service child, in-care, first language, country of birth, and nationality. So those items must be offered with choice, as 'refused' is an option.

 

This specific case in the link, is the Alternative Provision census, and the changes only coming into effect for the first time from Thursday - collecting one of eight reasons for transfer out of mainstream education into an AP setting, incl. pregnancy, young offender, mental health - plus detailed SEND on a named basis.

 

This is a new problem, because DfE / govt says it is the responsibility of LEAs to provide the AP census data through COLLECT to DfE, and yet LEAs have not told children and families who have been in AP provision at any time since January 2017, about the new data items that will be ascribed. The AP census guidance explains the changes, but the School Census guidance does not. But it is the School Census Guidance, not AP Census guidance that is provided to schools. Schools therefore can't tell the pupils leaving them, what the new AP census will collect. But no one seems to tell them after they leave / left either.

 

They key part -- and I'd like your views -- is not what a document says, but what do data subjects understand, can they know who has been given their data that the school hands over, and how easy is it? A PN is not a get out of jail free card. It has to be meaningful. What we have seen so far, is almost none are.

 

Schools tend not to explain this. While some have included a link to DfE's external data shares since 2016, many still simply say something like 'we are required to share some data with the DfE'.

 

Each pupil’s information are sent to the Department, on a named basis, and added to a growing national database of 23 million people, the National Pupil Database (NPD). The data are identifiable at pupil-level, not anonymous, and stored forever. The information include name and address, date of birth, special educational needs, results across the educational lifetime from age 2-19 and more. We at defenddigitalme are concerned because from here, these identifying data -- not anonymised -- are given out to third parties; over 1,000 times as of May 2017, many for commercial re-use and even to newspaper and TV journalists without a child’s or parent’s permission.

 

Given that the data have also been accessed by the police, and currently linked with the Police National Computer data, there has to be clarity on who will access the new young offender data, and why.

 

See ICO on privacy notices and fairness, and why it matters:

 

"the main elements of fairness include:

 

 

• using information in a way that people would reasonably expect. This may involve undertaking research to understand people’s expectations about how their data will be used;
  
  
• thinking about the impact of your processing. Will it have unjustified adverse effects on them? and;
  
  
• being transparent and ensuring that people know how their information will be used. This means providing privacy notices or making them available, using the most appropriate mechanisms. In a digital context this can include all the online platforms used to deliver services."