[sims] Removal of Pupil Nationality, Country of Birth and Proficiency in English

[smarties11]

Hi All,

 

Now the DfE have published the technical guidance for the 2018-19 census runs (https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/720748/2018-19_School_Census_Business_and_Technical_Specifications_Version-v1.1.pdf), it confirms the removal of Proficiency in English, Pupil Nationality and Pupil Country of Birth data collection items, in line with their u-turn on this earlier in the year

 

Under GDPR, we will no longer have a legal basis to collect this data; so we would either need to ask for consent from parents to continue to hold it - or delete the data. As it isn't critical to their education we will be deleting it.

 

It is possible to remove COB and PIE using bulk update (for current students only) but there is no bulk update routine I can see to remove pupil nationality, nor is there any easy way to remove this data for leavers or pre-admissions?

 

Any ideas? Perhaps SIMS will provide this facility in the next update? @PhilNeal?

 

Thanks!

[jmak]

Interesting...

 

I've just read the guidance and there's a subtle difference.

 

For the Nationality and Country of Birth, it says: "Schools must no longer request this information from parents, or retain the data within their system, for purpose of transmitting to the department via the school census."

 

For proficiency in English it says: "Schools are therefore no longer required to assess a child’s proficiency in English for purpose of transmitting to the department via the school census."

 

We definitely won't collect Nationality and Place of Birth, but intend to continue collecting proficiency in English as we believe it is essential to effectively educate the pupils. Therefore we also won't be asking for consent for that item.

[elsiegee40]

I read this today DfE: Schools 'must no longer request' pupil nationality - Schoolsweek

 

EAL (English as an Additional Language) is a vulnerable group measure in ASP, so it will be interesting to see if this is removed.

[MrMat]

Hi All,

 

Now the DfE have published the technical guidance for the 2018-19 census runs (https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/720748/2018-19_School_Census_Business_and_Technical_Specifications_Version-v1.1.pdf), it confirms the removal of Proficiency in English, Pupil Nationality and Pupil Country of Birth data collection items, in line with their u-turn on this earlier in the year

 

Under GDPR, we will no longer have a legal basis to collect this data; so we would either need to ask for consent from parents to continue to hold it - or delete the data. As it isn't critical to their education we will be deleting it.

 

It is possible to remove COB and PIE using bulk update (for current students only) but there is no bulk update routine I can see to remove pupil nationality, nor is there any easy way to remove this data for leavers or pre-admissions?

 

Any ideas? Perhaps SIMS will provide this facility in the next update? @PhilNeal?

 

Thanks!

 

Bulk Update for Pupil Nationality is in the BETA release so it should be available in the next SIMS update.

[Banjo]

I read this slightly differently. As this information will no longer be in the cesnus export spec to the DfE, then any data already collected for these measures will fall under the current retention polices. If you were to collect this information in the future you would most likely need to jump through the hoops of 'consent', 'privacy impact assessents' and 'legal basis of processing' to continue to do so as these would now change.

[smarties11]

I read this slightly differently. As this information will no longer be in the cesnus export spec to the DfE, then any data already collected for these measures will fall under the current retention polices. If you were to collect this information in the future you would most likely need to jump through the hoops of 'consent', 'privacy impact assessents' and 'legal basis of processing' to continue to do so as these would now change.

 

Personally I say it is safer for it to be removed completely. If you don't, and then lets say it appears on the data collection form, you are then asking parents to check and confirm a piece of data you are holding without a legal basis or consent. You don't need this data to provide an education service to the pupil, and you'd have a hard time justify why you are retaining this data to an angry parent or the ICO. It was controversial when it was brought in, suspicions were raised that this data was being shared with the home office so the chances of a parent being annoyed at this data being retained are quite high.

[Banjo]

Personally I say it is safer for it to be removed completely. If you don't, and then lets say it appears on the data collection form, you are then asking parents to check and confirm a piece of data you are holding without a legal basis or consent. You don't need this data to provide an education service to the pupil, and you'd have a hard time justify why you are retaining this data to an angry parent or the ICO. It was controversial when it was brought in, suspicions were raised that this data was being shared with the home office so the chances of a parent being annoyed at this data being retained are quite high.

 

I think that would be bad practice.

 

When you start selectively deleting data on children that are still with you, ahead of the schools overall retention polices where does it stop?

 

Do you delete all the detention records from last year, or their achievements from 2 years ago as you no longer need them?

 

Much easier to get your data collection form right and have a consistent and coherent school policy on pupil data retention.

[smarties11]

I think that would be bad practice.

 

When you start selectively deleting data on children that are still with you, ahead of the schools overall retention polices where does it stop?

 

Do you delete all the detention records from last year, or their achievements from 2 years ago as you no longer need them?

 

Much easier to get your data collection form right and have a consistent and coherent school policy on pupil data retention.

 

Where does it stop? It stops here, with this unprecedented situation that covers data which we didn't want to collect in the first place, that many parents objected to, that has seen scandal in the media, but we were required to do so by the DfE, but are no longer required to collect.

 

Each to their own - we're deleting it and guaranteeing it won't bite us in the future - if you wish to take that risk with your school then that's your call!

[bobsmith]

I disagree with Banjo's point.

 

The examples you gave were all covered by "legal basis" - i.e. providing education and pastoral care to students.

 

The data that is being discussed in relation to removal is data that is particularly sensitive - isn't it actually in the higher band of sensitive data?

 

If the organisation (the DfE) who insisted we collect it for their purposes has now told us not to, then deleting this information would make sense as our legal basis has been removed.

 

I understand the argument against throwing the baby out with the bathwater - but I'm not seeing it apply in this case.

[Banjo]

I disagree with Banjo's point.

 

The examples you gave were all covered by "legal basis" - i.e. providing education and pastoral care to students.

 

The data that is being discussed in relation to removal is data that is particularly sensitive - isn't it actually in the higher band of sensitive data?

 

If the organisation (the DfE) who insisted we collect it for their purposes has now told us not to, then deleting this information would make sense as our legal basis has been removed.

 

I understand the argument against throwing the baby out with the bathwater - but I'm not seeing it apply in this case.

 

The legal basis to collect the data in future (i.e. on behalf of the DfE) has been withdrawn, and that's all.

 

IMO this data is less sensitive than a childs IEP or EHCP or exclusion data as that would cause more harm if that data was exposed.

[Simcfc73]

So how would this apply to boarding schools who have overseas pupils. We need to record their visa information and used the information in the past for analasys of where our pupils come from and why they are chosing our school.

[MartinT]

We record all that data and we have international pupils who board. Proficiency in English is also a useful benchmark for EAL provision.

 

I will double-check but I believe we make our own legal basis if it's in our policy to collect the data. It's certainly on our registration forms.

[jdsa]

https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/principles/storage-limitation/

"You must not keep personal data for longer than you need it."

 

I would argue that the legal basis to retain the data has also been removed, unless you are using this information for a separate reason and have justified it within your privacy notice/consent forms/etc (e.g. in the overseas school visa example, I suppose).

[MartinT]

Retention is a different thing, and we have already deleted data beyond the retention period.

[Ditto]

I read this today DfE: Schools 'must no longer request' pupil nationality - Schoolsweek

EAL (English as an Additional Language) is a vulnerable group measure in ASP, so it will be interesting to see if this is removed.

Doesn't it just change collecting proficiency in English? Language spoken data is still collected. Is there also some funding associated with EAL if you are above certain thresholds?

[Ditto]

Just another thought on this. Let's assume we do want to delete the no longer required DfE data points. OK, I clear it from our MIS - no real issue there. But we're likely to have it in a variety of reports, in emails, printed out etc. That's not a trivial task to remove. Also, suppose it's a column in one of our Google sheets. I can clear from there - but Google, and no doubt other systems, retain all the previous versions where so it's still recorded. And it'll all be in the Vault. And in backups if you have those. Just how far is reasonable to go to be compliant with GDPR?

[bobsmith]

That's another can of worms you've gone and opened there GrahamB!

 

Summary information and individual records can be looked at differently to some degree. So a report that only contains the summary of language proficiency, where individuals cannot be identified, could probably survive your purge of data. The individual records should be hunted down where possible.

 

I seriously doubt even the DfE is gonna be fully GDPR compliant anytime soon.

[jdsa]

@GrahamB Interesting question, I'd wondered this as well. Referring to the ICO again, you can apparently push back on a request for erasure if it is "excessive", either requesting a "reasonable fee" to do the erasure or just outright refusing it. But, of course, what on Earth does "excessive" mean?

[ICTLady]

I was forwarded the following Capita statement from our SIMS support team:

 

Updated 24/04/2018 at 11:05 - Nationality and Country of Birth

Please note that Nationality and Country of Birth will be included in School Census for the last time in School Census Summer 2018 and will not be included in School Census Autumn 2018

We have agreed with the DfE the following way forward.

1. Remove the tags and data from School Census 2018/19 return xml files.

2. Remove the columns for this data from our School Census 2018/19 detail reports.

3. Keep the existing functionality for recording this data in place.

4. Ensure in a future release that this data can be completely removed to satisfy any GDPR requirements.

5. Stay in line with the DfE specifications for CTF 18 so that this data is automatically exported and imported, but in a future release allow a school choice regarding import of this data.

[Ditto]

@GrahamB Interesting question, I'd wondered this as well. Referring to the ICO again, you can apparently push back on a request for erasure if it is "excessive", either requesting a "reasonable fee" to do the erasure or just outright refusing it. But, of course, what on Earth does "excessive" mean?

An interesting point. In this case, there's no request being made by an individual, but the right to retain the information has been lost, so I would think it incumbent on the school to make error effort to delete the data. Interesting to note the comments about informing data processors in the ICO documentation. In this case, I would think it would be reasonable to ask Google to ensure history files and vault data are removed if requested, or to provide tools to achieve that. Anyone fancy asking them?