Bloody hell. 28 million pupils’ data given to betting firms to help sign up young gamblers

[noblegiraffe]

The DfE has reported itself to the ICO for a massive breach of data. Pupil data is legitimately shared with various companies for published purposes.

One of these has passed the data on to gambling firms such as Betfair, supposedly to help with age verification online.

www.thetimes.co.uk/article/revealed-betting-firms-use-schools-data-on-28m-children-dn37nwgd5 (paywall, story also at bottom of attached photo).

The DfE face a massive fine for the breach, but surely the firm that passed it on should be prosecuted as well.

[noblegiraffe]

No one?

Anyone on here with a kid in education over the age of 14 has had their child’s name, address, date of birth and potentially other data handed to gambling firms (and who knows who else), who can then use it to target them.

[InflagranteDelicto]

Fucking hell. That's horrific, and that's before I consider my obsessive 15yo with asd and an addict as a biological sperm donor

[iklboo]

Christ on a bike noble that's horrific! The firm should definitely be investigated and fined.

[MabelChiltern1]

Thank you , noble, I’d like to know more about this.

[YourOpinionIsNoted]

Shitting hell! That's appalling. How is it the DfE's fault though? Shouldn't the blame (and fine) be the company who passed / sold it on to the betting firms?

[noblegiraffe]

The TES have the story now. This is awful

“The Learning Records Service, which contains details of pupils aged 14 and over at both state and private schools, as well as colleges, should only be used for educational purposes.

However, the newspaper has found that GB Group, a major data intelligence company, gained access to the database. It reportedly used the data for age and verification services it provides to clients, which include 32Red and Betfair.

It is reported that the database helped one gambling firm increase the numbers of young people passing its identity checks by 15 per cent.”

www.tes.com/news/gambling-companies-access-data-28-million-children

[TeenPlusTwenties]

But presumably those passing the checks were over 18?

I can see they shouldn't have used the information , but it doesn't seem to be about targeting under 18s, more allowing over 18s to pass checks that they are over 18?

And gambling is legal? (Even though I think online gambling is a very dangerous thing to get into.)

[noblegiraffe]

It could be argued that the data was used to prevent underaged children from gambling but if it increased the numbers passing the checks then it is using education data gathered on pupils in schools and colleges to verify their ability to gamble.

That would not have been an approved use.

[TeenPlusTwenties]

I agree. But not quite as bad as using it to actively target 14 year olds.

[noblegiraffe]

The data has been out of control - it definitely wasn’t meant to be used for this, so there’s no guarantee it hasn’t been used for other stuff too.

Hopefully there’ll be a thorough investigation and heads should roll.

[PhonicTheHedgehog]

Someone’s head will roll but it’s un likely to be the correct head.
I despair.

[RedskyAtnight]

I have a child in education over the age of 14 so I guess his data is included in this. Absolutely shocked. We are very careful about who we share data with, and have drummed this into the DC - but clearly this is pointless if data is going to be shared willy nilly with any company that "someone" thinks is a good idea.

Can't see how it would stop underage gambling either - surely any child who is trying to gamble underage manages to make up a fake ID?

[ListeningQuietly]

THe only way to stop these breaches will be a custodial sentence for somebody

the UK is atrocious at data security - eg misusing the Schengen database

[bombaychef]

You do wonder how incompetent people are at times. Heard it in the radios but then moved on quickly

[ioioitsoff]

This is appalling. I hate the idea of my DCs being included,

[AdoraBell]

WTF? Do you know if I can find if they my DC’s names?

[AutumnCrow]

Deputy heads will roll, more like.

[noblegiraffe]

If your kids are over 14 and in education, Adora, I think they all are.

I also thought when there was a breach, users had to be informed.

[prh47bridge]

I also thought when there was a breach, users had to be informed

The requirement to inform users only applies if there is a high risk that their rights and freedoms are adversely affected. It isn't immediately clear that using the data to prevent underage youths gambling and allow those over 18 to gamble adversely affects their rights. So it may depend on what other data has been disclosed.

[noblegiraffe]

Even when it’s children, prh4?

I guess it depends on whether the gambling companies could see the data.

[whataboutbob]

It’s terrible. I sometimes think the only way to prevent one’s info leaking is to go off grid completely. Just go all Matt Damon in Bourne Identity.

[evilkitten]

It's not like the DfE hasn't got form for this. They were supposed to be 'learning lessons' after they unlawfully shared pupils data with the Home Office last year.

Still, no sign of any ministers taking responsibility and resigning.

[noblegiraffe]

It’s not quite the same thing as the data has been misused by a different company this time. I’m not sure what vetting or training the DfE require to gain access.

[boys3]

28 million subject access requests (SARs) might make those who have the data the squirm, although from reading the fairly brief reports in the links posted there may be quite a few organisation(s) a SAR could be made to.

[prh47bridge]

Even when it’s children

Even when it is children. So yes, if the gambling companies could simply make queries to see whether or not the subject was over 18 that is unlikely to require notification. If they could see the subject's full education record that is more likely to mean that notification is required.