Institute of Physics & Improving Gender Balance project

[mdrabble]

Just had a chat with some staff about a project run by the Institute of Physics about Improving the Gender Balance.

 

We have had an email from them which is assuming automatic opt in if they dont have any objections.

 

Part of the email they sent contains the following "we need to inform parents and pupils of their right to object to their data being process as part of the trial analysis. I am attaching a letter to share with parents to inform them of how the data will be used and a form for them to object. Please send this to parents of all pupils due to start years 9, 10 and 11 in September"

 

The Data they have requested are Firstname, LastName, Gender, DOB, UPN

 

This is a copy of their Privacy Notice they sent across.

Dear parent/carer,

 

Your school has volunteered to take part in the Improving Gender Balance (IGB) programme. The programme aims to improve the gender balance of pupils taking A Level physics. This letter informs you of our plan to process data and your right to object to that data being processed.

 

What will the programme look like?

 

The IGB programme is delivered by the Institute of Physics and the effectiveness of the programme will be researched by a team from UCL University. The programme will recruit 160 secondary schools. We will work with half of these schools and the other half will be the “comparison group” and will not take part. Whether your child’s school will be one we work with or part of the comparison group will be decided randomly. Deciding which schools end up in the two groups using random allocation is necessary to help us understand whether the programme is effective. Schools have an equal chance of being in either group.

 

What does this mean for me as a parent/carer?

 

Neither you nor your child will be required to provide UCL with any information.

 

In order to measure the success of the programme, UCL need to measure how many pupils progress to A Level physics. UCL will access information on subject choice using the Department for Education’s National Pupil Database, which records which exams pupils take. In order to look up this information, UCL need to know which pupils took part in the IGB programme. To do this, we are planning to obtain your child’s name, date of birth, gender and Unique Pupil Number (issued by the Department for Education) from their school. We will not identify your child or their school in any report arising from the research, and no information that could otherwise identify your child will be made public.

 

UCL will obtain the data using a secure data transfer method and then store it in a secure system. This data will not be shared with anyone outside the UCL research team and the Office for National Statistics. We will securely destroy the data as soon as the research project is completed (2026).

 

UCL will process the data under the legitimate interest lawful basis, on the grounds that this research project should benefit society by providing new evidence on improving gender balance in science and the impact on pupils and parents will be negligible. UCL will be both controller and processor of the data and will not process any sensitive (special category) data.

 

Your right to object to data processing

 

Although UCL will not identify your child or their school in any report arising from the research, and no information that could otherwise identify your child will be made public, you and your child have the right to ask us not to use their data in this way. We suggest you discuss this with your child before making a decision, to ensure that they are aware how their data will be handled and their rights to object. If you or your child DO NOT want UCL to process information about them in order to understand whether the IGB programme helps improve gender balance at A Level physics you need to tell your school. To do this, please complete the form below and return it to the office at your child’s school within two weeks. If you do this then no information about your child will be shared with UCL. You can object to the data processing at any time.

 

Am I right in thinking that they should asking for consent and not objections?

[blueday]

As they are using legitimate interest as the lawful basis, not consent, then they don't need to ask for explicit consent. However, they are giving subjects the right to object and the chance to opt out.

[jmak]

Although not GDPR related; I thought we went supposed to share UPN?

[mdrabble]

@blueday you are indeed correct, got an email reply to our queries stating legitimate interest as the lawful basis.

 

This is the reply they sent across

 

Yes, some schools have asked the same question. Just to reassure you that there is no need for an opt-in form, and this approach has been agreed not only by our legal team at IOP and data experts at UCL, but was also signed off by the Department for Education. This is because the trial relies on legitimate interest as its legal basis, not on consent (which would require ‘opting in’). A brief explanation from UCL IOE (the data controller), below:

Under GDPR, there are 6 legal bases for use of data. These are: consent, contractual, legal obligation, vital interest, public task and legitimate interest. In order to control and process data, organisations need to use one of these legal basis.

 

If an organisation relies upon consent as the legal basis, then they need explicit opt-in consent from the individuals in question. UCL Institute of Education (our evaluator and data controller) are not relying on consent as their legal basis.

 

UCL Institute of Education are instead relying on the ‘legitimate interest’ basis for data processing. This is on the grounds that this is a research study and should benefit society, and the impact on pupils and parents will be negligible.

 

When using legitimate interest as the legal basis, you do not need explicit opt-in consent. However, you do need to notify people of what you are doing and give them the opportunity to object. This is why we are asking you to send out this data privacy notice / objection form and we need to stress that they do not need to be sent out with any additional options. This will also remove the logistical nightmare of trying to coordinate opt-in replies.

 

I hope this helps clarify – I’d be happy to speak to the relevant person in school to explain more, if helpful.

[GrumbleDook]

UCL are a major research centre for education and work on a range of projects around EdTech too.

 

There are exemptions within GDPR around scientific research and the research should be compatible with the original purpose for collecting data. That would lead me to question LI (the data was collected under the lawful basis of Public Task) but if the data controller doing the work cannot use public task and there is another suitable lawful basis then that is workable ... but they have to be mindful of the other data protection principles too, e.g. transparency.

 

I know BERA has been updating their guidance around transparency so I might go and dig again, but ... being honest ... what has been sent over so far looks fine.

 

Use of UPN in research is compatible with the use of the NPD (at the moment), but I know there are concerns about NPD anyway ... I'm not going to go down that rabbit hole right now.