Our children's data is given to journalists by the DfE - we can make it stop

[TheABB]

Attendees at #Blogfest15 were surprised to hear their children's personal data are being given away by the Department for Education to commercial third parties. Why do big name newspapers get our kids' personal data and we know nothing about it?

Our children's individual personal and education data are given away today from a National Pupil Database of over 8 million children and young people.

We've spoken to the Schools' Minister and the Department. So far, nothing has improved. After six months of detailed research and enquiries over the last year, it's time to stand up and defend our children's digital identity.

No one should be given our child's personal data for secondary uses not related to the child's schooling or care, and us not be told about it.

Let's get their data back from commercial third-parties who've been given it without our permission. Let's get new policy. Let's get better law. For our children, let's #defenddigitalme

More info and blogs: defenddigitalme.com/
Twitter: @defenddigitalme
Share on facebook: www.facebook.com/defenddigitalme/

Campaign for change in UK Department for Education policy to protect 8+ million children’s identifiable personal data in the National Pupil Database.

In depth details of what must change given in conclusion of evidence to parliamentary committee on Big Data: data.parliament.uk/writtenevidence/committeeevidence.svc/evidencedocument/science-and-technology-committee/big-data-dilemma/written/25380.pdf

What the papers got?: defenddigitalme.com/2015/12/what-sensitive-data-do-the-papers-get-and-why/

Third-party requests since 2012: www.gov.uk/government/publications/national-pupil-database-requests-received

[noblegiraffe]

So they have not been giving away "full names, addresses, dates of birth, service child indicators, looked-after-child in care indicator and unique pupil reference numbers."

What are your specific concerns about what they were given? Non-identifiable data could be analysed for all sorts of useful reasons.

[TheABB]

None of these releases are non-identifiable. Every release listed is individual level. Only 11 out of 466 since 2012, were aggregated, but may have been such small numbers as to be identifying. Full data are released including all the items you list. Including I was surprised to see full names to the Cabinet Office. Postcodes, dates of birth, service child indicators, looked-after-child in care indicator and unique pupil reference numbers go out to a range of third parties. That particular example the Telegraph were refused some things but were still given individual data including ethnicity, language, SEN (special needs) which are all considered sensitive data (has extra protections in law) in addition to all the identifying data of their schooling which isn't considered personal, but is still about them.

Have you ever been asked if you wanted your child's identifiable data to be shared for anything except their administration of school?

[TheABB]

None of these releases are non-identifiable. Every release listed is individual level. Only 11 out of 466 since 2012, were aggregated, but may have been such small numbers as to be identifying. Full data are released including all the items you list. Including I was surprised to see full names to the Cabinet Office. Postcodes, dates of birth, service child indicators, looked-after-child in care indicator and unique pupil reference numbers go out to a range of third parties. That particular example the Telegraph were refused some things but were still given individual data including ethnicity, language, SEN (special needs) which are all considered sensitive data (has extra protections in law) in addition to all the identifying data of their schooling which isn't considered personal, but is still about them.

Have you ever been asked if you wanted your child's identifiable data to be shared for anything except their administration of school?

[noblegiraffe]

Ok, so here's why the Cabinet Office requested data:

"National Citizen Service (NCS) is the Government‟s flagship programme for youth. NCS aims to develop more confident, engaged and responsible young people (between the ages of 16 and 17), through a programme of personal development and social action. Programme phases include a week of 'outward bound' like physical and team building challenges, and implementation of a social action project in the young person's local community. NCS is growing at great speed, providing up to 90,000 places in 2014 compared to 10,000 in 2011. The government announced in the recent spending review that National Citizen Service will continue to grow, with a target of 120,000 places set for 2015 and 150,000 places in 2016. The independent evaluation of the 2012 NCS pilot is very encouraging: 92% of participants thought NCS gave them useful skills for the future; 98% would recommend the programme to a friend; and return on investment is now estimated at up to 2.8 times the cost of delivery. In order to evaluate programme accessibility to young people from harder to reach groups (and achievement of a social mixing goals), Cabinet Office aims to evaluate the recruitment by parties contracted to deliver NCS, using demographic data contained in the National Pupil Database:

• maintained or independent school
  
• ethnicity
  
• receipt of free school meals
  
• in care (or recently left care)
  
• with a statement of special educational needs
  
• disability type"
  

What's the problem with that?

The Telegraph request was
"To provide more detailed information for parents about the relative achievements of different schools in different subjects for different types of pupils."

So they would need ethnic groups/numbers of statements.
The SEN data that was provided to the Telegraph wasn't type of SEN btw, just statement or school action plus.

If this sort of data wasn't shared for analysis, then how would we ever find out stuff like white working class boys are significantly underachieving?

[TheABB]

There's lots of very important stuff done with data and no one suggests it shouldn't be analysed for bona fide research. The criticisms and what need changed are in how it is done, why it is released to whom, and how the risks are mitigated or prevented, as well as benefits measured. (As we outline in all our info on site and submitted to parliamentary committee.)

1. Fairness: First, why are personal data used without people's knowledge or consent? The first principle of data protection law. Everyone should know what is done with their information, by whom and why.
   

1. Consent: Parents sign a form entrusting their data to a school for the child's schooling. It's not an agreement to use it for anything the DfE chooses. Parents don't sign up thinking it will be given to one-man-shows, press and think-tanks and for commercial use. Consent can't say one thing and mean another.
   

1. Security: Don't lose control of it - this is costly in terms of audit oversight (or would have been if the DfE had done any) as well as high privacy impact - good data practice means you don't send sensitive data to sit on Fleet Street desktops. You keep it secure, and people come to the data. This improves people's privacy risk, and protects the benefits you want to see.
   

1. The level of identifiability and the other named uses of data, could also mention for example other Cabinet Office requests in the Troubled Families programmes or with individual intervention with charities - given it's supposedly a statistical database using section 33 of DPA to waive other obligations, named releases aren't permitted. If it is not to be processed in this way, then needs to meet full DPA obligations, like SAR (subject access requests).
   

Given you're happy these are all good uses and users of data, and have no concerns that journalists are given individual level data for example, that bodes well for telling the rest of the population. Public confidence in government data handling is the foundation of future digital services and our kids data security is key to the integrity of their digital identity, so it's vital we get it right for them now, to protect it for them as adults. VTech shows what can go wrong. Typically polls in 2014-15 showed around 86% of the public want asked before any personal datasharing. Public trust in the press, is much lower.

[noblegiraffe]

Given you're happy these are all good uses and users of data, and have no concerns that journalists are given individual level data for example

I didn't say that.
But in instances like the Telegraph one, where the data was used to provide parents with information about the relative performances of schools, lots of parents want this information available so that they can make informed choices.

The sort of reaction you will get will depend on how the question is framed. Your 'DfE is giving your kids' data to journalists' headline is designed to provoke a specific reaction. If your title was 'Proposal to allow schools to refuse to publish data concerning key performance areas' then parents would have a very different reaction.

If your concerns are about control of data - e.g. only allowing access on secure premises instead of emailing off a spreadsheet when sensitive information is involved, then I am with you.

However, making it opt-in/out would instantly make the data meaningless.

[TheABB]

Agreed there are nuances in lots of the discussion, but the basic of consent and fair processing is a question of human rights and respect of the individual, as well as Data Protection legal compliance, not only of paperwork.

"lots of parents will want this information available so that they can make informed choices" agreed, so the questions then need asked in order to provide that public service, how are we ensuring methodology, accuracy, lack of bias, could they do the same with less identifying data etc. Not giving this data to journalists should not be equated with 'we'd lose public interest data analysis.' I agree we need the info, but how they are collected and published needs changed. Achieving better public data should be a goal, but it need not only be done in the way it is today.

Secure access and secure storage are key. I'm really concerned our kids are going to be so reliant on biometrics and digital services in their lives, and DfE practices today appear to have become so gung-ho to give their data away, they're giving out our kids future digital security and keys to their identity.

In this case study; DfE isn't sure if 8+mill. kids identifiable data is still floating around on Fleet Street, when it was meant to have been destroyed in Feb 2014. In Nov 2015 there was still no destruction notice received and the DfE have only followed up after my pressure this year. Now they have to check all the others too. Yet in July 2015 (date of my FOI), they'd not done a single audit.

"If your concerns are about control of data - e.g. only allowing access on secure premises instead of emailing off a spreadsheet when sensitive information is involved, then I am with you." Sounds good. We can get better data and better security and better privacy. They co-exist well.

[TheABB]

Update: 20 million children's (and now adults) personal individual and identifiable confidential data are released from the National Pupil Database. Numbers confirmed these week via FOI = 19,807,973 records since 2000, children aged 2 -19. Releases are of fully identifiable personal and school life information.Recipients include commercial third parties, charities, think-tanks, and press, as well as bona fide academic researchers
bit.ly/1R0eTfI
|#halfterm news| |#pupildata | #defenddigitalme|