It is now two years and one week since the ICO published their summary of a regulatory audit concerning the Department for Education's ("DfE") failure to comply with data protection law. On the anniversary, the DfE published a short blog about the School Census but failed to mention the audit or give any update on it, despite long overdue previous promises made to MPs in Parliament to do so. It failed to mention rights. It was rather misleading about whose data was in the data released to third parties, and the process around it.

Not only has the DfE refused to publish a copy of the full ICO audit report or any timeline to assess what was and was not to be actioned by when, but it has repeatedly failed to provide details that were promised of the steps that they are taking to address the failings. In the meantime, as far as we can see, the DfE’s practices in relation to the collection and sharing of children’s information seem to continue largely unchanged, and worse, have continued to ignore necessary changes before starting further new data expansions.

The National Pupil Database includes information collected annually at child-level, as part of the Alternative Provision Census. This information includes extremely sensitive information concerning any special educational needs; learning difficulties; social emotional and mental health needs; speech, language and communication needs; physical disability; autistic spectrum disorder; vision impairment; hearing impairment; or other difficulty or disorder.  It also requires the disclosure of matters such as pupils’ pregnancy; mental health or physical health need; permanent exclusion, or the fact that a child has been placed in a young offender institution. We first complained to the ICO and the DfE on this in 2017.

The current deficiencies include a failure by the DfE, as described in the ICO audit to comply with the transparency and notification obligations required by the UK General Data Protection Regulation and the Data Protection Act 2018.  The DfE has failed to provide a Privacy Notice to parents and children setting out what information is collected, why it is collected, and what is then done with it.  Linked to this, the DfE does not appear to have appropriate procedures and safeguards in place in relation to the handling of this information. This should include mechanisms for enabling the right to object to the processing of the data, allowing inaccurate data to be corrected, and adequate safeguards in relation to sharing of the data with third parties.

We have therefore instructed solicitors at Leigh Day, and barristers at Monckton Chambers. We have sent the Department a detailed 29-page Letter Before Claim setting out the ways in which we consider that the DfE is behaving unlawfully. We have requested a response within 21 days.  In the absence of a satisfactory response that addresses the concerns, we anticipate issuing formal Court proceedings by making an application for permission to apply for judicial review.

You can help us by supporting us to raise funds for the legal costs associated with investigating and bringing this legal claim, including the risk of having to pay the DfE’s legal costs if the challenge is unsuccessful. You can help us here by sharing this page. Thank you to all our supporters so far, who have made the long process to get here possible. We’ve still far to go and we hope you’ll stick with us.

The Department for Education (DfE) has published its response to the ICO audit. You can read what the DfE released here.

There are still lots of unanswered questions one year after the exposure of gambllng companies using personal data from the national Learners Records Service.

As Nigel Nelson and Jo Phillips asked on the BBC Papers on the day the story broke: “This is an absolutely shocking story.” “You would expect it would only be used for educational purposes.” “Do we know whether these people could get data about disabilities or special educational needs?” “12,000 organisations have access to this database.” “Who are these people, and why?”

There is still lots to do to make the national pupil data handling lawful, safe, fair and transparent to every person who the records are about. We and our legal team are expecting responses any day now from the DfE, on what happens next. Whatever it is, we will work day and night to get it made right. 

Short term responses in the pandemic by the DfE have been reactionary and contradictory but many will have long term implications; on the one hand making back to school messaging about looking after the most disadvantaged pupils while also planning to undercount school funding needs for the least well off pupils. Propping up the 'Tech Giants' and sending out devices but while having no vision for long term edTech use in a learning environment and its purpose in education.

We are therefore honoured and delighted to have received a big boost to our long term efforts and legal-fighting-funds from @CARE2Liberate and @BlackEdAllies today, in solidarity with our work with No More Exclusions  on the reasons-for-exclusion data collected in the Alternative Provision Census, and our campaigns rooted in social justice. They’re all on Twitter @CARE2Liberate and @BlackEdAllies and @NExclusions.

Thank you NME. And thank you to all our supporters. If you can, please share this crowdfunder with friends and family. Together we are making a difference. You can also take action via our website. Find out what's in your own or your child's national pupil records. It's free and confidential. It's about you.

See and share the short film #MyRecordsMyRights at https://youtu.be/ash1YlIC1BA.

Yesterday the ICO published its summary of findings from a compulsory audit of the Department for Education. It was damning and far reaching.

The Department’s data handling is unsafe, unaccountable and unlawful.  

The audit found that data protection was not being prioritised and this had severely impacted the DfE’s ability to comply with the UK’s data protection laws. It made a total of 139 recommendations for improvement, with over 60% classified as urgent or high priority. The DfE are not fulfilling their duties that data "shall be processed lawfully, fairly and in a transparent manner.”

What's next?

The Department will need to be transparent about its failings and measures in place to fix them. We welcome that the ICO has found what was necessary and appears to expect action from the DfE. The facts and evidence speak for themselves that regulatory intervention was long overdue but now the Department needs scrutiny and to make public commitments to change. We will continue our legal action if the changes are not satisfactory to make all pupil data safe, fair and transparent.

Thank you to all our supporters so far.  You help us hold government to account.

You can continue to help us.

• Email your friends about our success and to pledge support to our case
• Post a link on social media
• Tweet in support.
• Watch and share our animation and call to action.
• Please pledge again if you can as we need all the help we can get to keep going

You can also take action via our website. Email your MP based on our supporters' template. Call on them to support a rights' respecting digital environment in education. Find out what's in your own or your child's national pupil records. Share the latest updates. Thank you.

https://defenddigitalme.com/my-records-my-rights/

Since we started this case in 2018 we've been working hard behind the scenes. It's taking time, but we are making progress and we won't give up.

Thank you to all our supporters so far.  You help us hold government to account.

With support from the Digital Freedom Fund our legal team has continued to work on the case from our work with the Supervisory Authority and into 2020 and we're delighted to see our case included in their Annual Report.

You can continue to help us too.

• Email your friends to pledge support to our case
• Post a link on social media
• Tweet in support.
• Watch and share our animation and call to action.
• Please pledge again if you can.

You can also take action via our website. Email your MP based on our supporters' template. Call on them to support a rights' respecting digital environment in education. Find out what's in your own or your child's national pupil records. Share the latest updates.

https://defenddigitalme.com/my-records-my-rights/