Jen Persson discusses the background and implications of the Department for Education’s policy and practice on collecting and sharing the personal data of 20 million children in the National Pupil Database. There has been no public or parliamentary consultation on recently proposed changes to collect pupils’ country of birth and other personal data, and this raises significant questions of trust and privacy invasion. Jen is coordinator of defenddigitalme, which campaigns for children’s privacy rights, and improved transparency in policy and practice with regard to the National Pupil Database. She can be found on Twitter via @TheABB or the campaign @defenddigitalme¹. [Header image credit: G. Jofili, CC BY 2.0]
If you feel like you’re not in Kansas anymore, you’re not alone. UK residents including many born in other EU countries, have been tossed around in a twister of British politics since the Referendum, hitting something unexpected with every spin. The menacing atmosphere many children and parents have experienced first-hand recently, has been growing under policies and promises on immigration made in the last Parliament. One that took off in the Department for Education last summer, is about to land.
A year ago, the Telegraph reported that then Secretary of State for Education Nicky Morgan, ‘had ordered officials to investigate how much of a “pull factor” state schools are for families who decide to move to the UK’ in so-called education tourism. Schools have begun the collection and extraction of every pupil’s country of birth for the 2016-17 School census collection, and for the Early Years census next Spring. The Department for Education will extract it along with pupils’ name, date of birth, home address and all their other confidential personal and attainment data collected in school, that go into the National Pupil Database which now holds the data of 20 million individuals. Schools have also been asked to expand the collection of nationality and ethnicity, and the restriction on collecting the ethnicity of under 5s has been lifted. Further changes include adding a unique property identifier to the 5-line pupil’s home address, and the postcode which is already mandatory. Plus the expansion of recording English as an additional language (EAL) skills in a 5 step grade system.
If you haven’t heard about it, don’t be surprised. There has been no public or parliamentary consultation on the proposed changes. No Privacy Impact Assessment has been made. And we await to hear from the Department for Education, what due diligence has been done to ensure that school staff can collect these data and meet their public sector legal duties on equality.
Unease about the plans is growing in staff rooms among teaching staff and parents. We have already seen several school forms asking for birth certificates and ID cards from pupils, to ensure data provided on the form matches “which country issued the pupil’s passport.” The reason given for needing the new data is in the interests of the education system. Some staff and parents are asking whether this may, in fact, be another attempt to gather the migration status of individual children before they are admitted to school. Plans that were reportedly vetoed in 2013. The EAL data fields are poorly designed so one could be forgiven for thinking they are merely a fig leaf for acceptability to justify the collection of the country of birth and nationality for other reasons.
Questions of trust
Teachers are concerned above all that parent-teacher trust may be undermined at the very start of the admissions process. Families might not be clear why identity checks are being requested and whether information will be shared with other organisations. Some families might already avoid state agencies but trust schools, and would want their children to have an education which will be undermined. Undocumented families or those in migration situations will be adversely affected, barriers in enrolment may develop, fundamental rights and entitlements to education called into question.
Trust depends on how these confidential data will be used and by whom. What is it parents expect happens with their children’s personal data entrusted to schools? Today’s existing uses of data from the National Pupil Database are not well communicated. Forms are filled in with the understanding that the information will be used for the direct purposes of their child’s education. Privacy policies are inconsistent and incomplete. Some offer parents the choice of refusing the data while others do not. Most parents that talk to us, think nothing more than statistics are passed on to the Department for Education and many schools think the same.
Few would expect that since 2012, journalists at The Times have received millions of children’s identifiable data for the purposes of ‘picking interesting cases or groups of students’ or that The Telegraph was given 5 years’ worth of individual sensitive data including special needs health data to factor in the ‘different types of pupil’ who are present at different schools and attainment. The list of third party recipients is long and includes one-man data consulting companies, private tutor and pupil matching services, charities, as well as releases for academic research since 2012.
The trustworthiness of pupil data collection further depends on the limitation of the future scope of what purposes data will be used for and who will access them. Scope creep is not fiction, but very real, and today’s use of data by government can mean that what we sign up to, does not stay what we signed up to. Data handed into schools by parents and pupils before 2012 are now used for entirely different purposes since legislation was changed to permit the release of individual pupil data. The new EU General Data Protection Directive is more demanding on children’s data protection and profiling, whereas the Digital Economy Bill in the House of Commons right now, plans the expansion of the scope and users of all our personal data collected in the past by all public bodies, including all our birth, death and marriage data. Laws change.
A second question of trust is how data will be secured. Modern good practices demand that researchers should be accredited and come to the data in safe settings, not get data sent to them. Confidential and sensitive personal data from the 20 million individuals in the National Pupil Database right now are handed out ‘into the wild’ directly to third parties.
The third trust factor, is the quality and integrity of the data collected. While the Government Digital Service has recently done work on standardising country names as an official register, the DfE data will use a “Free text field for country name”, which will result in all sorts of possibilities and poor quality data. Think England, england, Englnd, GB, United Kingdom. Companies House address data similarly stores whatever users provide. It has 12 spellings of Scotland alone. What it is that the DfE wants from Country of Birth is not clear. Official countries, the bit of the world people come from, significant areas of migration, all have a degree of complexity needed to answer different questions that simply ‘what is on the passport’ does not provide. [Correction added on 3 October 2016: The Department for Education technical specification indicates the country-of-birth and nationality fields are not free text and use an updated codeset from September 1, 2016.]
Staff have suggested that the EAL data in this census format is also both intrusive and unreliable and will need to be interpreted with caution since it is not a measure of a pupil’s fluency in English, will have no national moderation, and some say will tell us little more than we already know. Trust in the integrity of these new data at national level is doubtful.
Calls for consultation
Overall there is little justification offered that these new additional data on children’s country of birth will be in the best interests of children, if it is to “ascertain the impact that such entrants have on the education system”. There are no published plans how these data would facilitate targeting any support and this data item is not required for funding. It is unclear why aggregated data, sampling statistics or using data already held by the Office of National Statistics does not meet any new need. It is therefore neither necessary or proportionate to collect this on individual children at national level.
Calls for a working party on English as an Additional Language (EAL) sound sensible to create meaningful assessments and definitions for the data that is actually needed to add value to both children and impact on education policy. On June 30th Sam Gyimah, Parliamentary Under-Secretary at the Department for Education, wrote in response to a Parliamentary question that the government national funding formula to be introduced from 2017-18, will include an EAL factor, but how it will differ from what is already done today is missing and “the precise detail of the formula” will only be set out in consultation. So it would make surely sense to consult upon and decide the data terms at the same time.
The release of identifiable children’s confidential data without consent to companies and journalists is stunning. It jeopardises both the trust in education of some of our most vulnerable families and children, and the quality of data collected. Children’s needs must be put above the needs of the system. A thorough privacy and due diligence assessment must also weigh the legal and human rights implications, and assess the collection design, purposes, risks, cost and benefit.
The new Secretary of State for Education, Justine Greening, brings experience from the development field, and the empowerment of women and girls to the Department. That may bolster the appreciation of the complexity of the named collection of country of birth of individuals and the potential for detrimental impact from using personal data to stigmatise and discriminate. We hope that the DfE will listen to these questions and concerns and respond to the urgent call to engage in consultation with school staff, academics and others concerned with children’s rights and privacy, technical design and cyber security.
This potentially harmful privacy invasion of every school child in England has already begun.
Anyone who wants to support the call for consultation and campaign or has questions is welcome to get in touch.