The info on the parents' section of the website says that it is a "public interest task" and a "process necessary for research purposes", which it turns out is part of a clause specific to the UK in GDPR:
https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/a-guide-to-lawful-basis/lawful-basis-for-processing/public-task/#:~:text=You%20may%20share%20personal%20information,basis%20you%20are%20subject%20to.
According to the ICO website, the following applies (my bold):
You can rely on this lawful basis if you need to process personal data:
- ‘in the exercise of official authority’. This covers public functions and powers that are set out in law; or
- to perform a specific task in the public interest that is set out in law
And:
The processing must be necessary. If you could reasonably perform your tasks or exercise your powers in a less intrusive way, this lawful basis does not apply.
If you can show you are exercising official authority, including use of discretionary powers, there is no additional public interest test. However, you must be able to demonstrate that the processing is ‘necessary’ for that purpose.
‘Necessary’ means that the processing must be a targeted and proportionate way of achieving your purpose. You do not have a lawful basis for processing if there is another reasonable and less intrusive way to achieve the same result.
Looping back to what Cautious said above, there surely must be another way to get data at scale for people of different ages which maps their mental health to their circumstances. I'm no research scientist but the justification for tracking children in the throes of teenage angst to answers they gave aged 13 and 14 (to questions with a bias of gender identity belief as fact) seems woolly at best. Surely they could survey the nation in a different, less intrusive way. For example, when looking at point in time data sets for people of different ages, they could normalise for postcode area and age when comparing them to predict future outcomes for young people when looking at survey responses.
I presume that's the "desired outcome" so that the dataset informs authorities what might contribute towards better outcomes.
I agree with PPs that this needs investigation and exposure. It looks like it needs two skillsets to challenge it:
- privacy law under GDPR
- knowledge of research protocols and how to achieve the desired outcome in the least obtrusive way