School breaking Data Protection Act

[ThePainOfLego]

We recently received a letter from the Primary School called "Pupil Premium Data Request". It asks for details regarding the children and parents (including date of births and NI numbers). It has a disclaimer on the bottom about by providing these details you are giving permission for the school to check if your child qualifies for the pupil premium.

I will not be filling this in as (1) we don't qualify for pupil premium or free school meals (2) I do not want to give the school these personal details.

Am I BU in thinking there should be more wording about not keeping details, only using them for a specific purpose, not passing them on etc etc? There is something about the vagueness of this letter that makes me really uncomfortable, even though I like and trust the school.

Sorry to keep posting on my own thread. I have done some more investigation. The letter says the information will be used to check the data on the councils checking service. I have gone onto the councils checking service on the Internet. It says it is run by Babcock 4S... A private company.

ThePainOfLego surely you're not suggesting the left hand should talk to the right hand. Now YABU...

Thepain that's my problem with it really -the information on Scottish children is stored by a private company and is effectively in the 'cloud' -you access it through signing onto their servers.
And they hold so much information about the child and in fact their parents. In a paper folder or on a hard drive you know who has access to that information - and if it is stolen you know it has been stolen.
You as a parent think you are entrusting that information to the person/organisation you give your completed form to. You are not giving it to a private company to store for potentially 'anyone' in the world basically to have access to.
There is a data protection disclaimer on the form ...but if you don't complete it you can't get preschool funding, you can't get into a state school...
I think we should approach these things from a 'what is the minimum information we really need' rather than lets collects as much information as we can as it might be useful in the future (and I suspect the private company intends to sell anonymous data on - the reason they ask for so much information).
I had to fill in a training course registration form for a one day course for the council recently - it asked for lots of info dob, NI number etc and some like martial status and gender I really couldn't see how they were relevant. So I asked them - apparently I only needed to complete the parts in bold - so that was name and address and company worked for ...

Why would the government fund money directly into schools when they could create a complicated and time-consuming form to put people off applying and retain the money? Come on.

Are you in Scotland OP?

Afaik in England FSM entitlement is based on benefits, I'm pretty sure there's no going back over 6 years of employment history. I don't have any knowledge of the Scottish system.

You could take on the school and its data protection issues or you could just not complete the form. You are a better person than me to be worrying about everyone else's data. Much as I'd like to think I would in your shoes I honestly don't thinks I'd have the time.

No, I am in England.

And 6 years because they are looking at whether your child would have been entitled to FSM in the last 6 years. Maybe not employment history, but certainly benefits history for that time.

I am a little worried about being requested to give my details to a massive international company. Not least because Babcock International appear to be involved in many things, including defence. It occurs to me this also means that if Babcock can check if you are, or would have been, entitled to FSM in the last 6 years, then they also must hold ALL THE TAX CREDITS DATA, PLUS ADOPTION ETC DATA FOR EVERYONE IN THE COUNTRY!!!

It should never be wrong to question things like this. It is definitely not because I am against the pupil premium. I think that's a good thing. I don't think collecting massive amounts of data on all parents is a good thing. Giving them to a private company is even worse.

I am a little worried about being requested to give my details to a massive international company. Not least because Babcock International appear to be involved in many things, including defence. It occurs to me this also means that if Babcock can check if you are, or would have been, entitled to FSM in the last 6 years, then they also must hold ALL THE TAX CREDITS DATA, PLUS ADOPTION ETC DATA FOR EVERYONE IN THE COUNTRY!!!

No, that's very unlikely.

What is more likely is that they have an interface between their database and HMRC so that when they enter data into specific fields, their computer system can check them against specific fields in the HMRC records.
They won't have unrestricted access to the HMRC database, there will be extensive checks and balances to ensure that the communication lines are secure.

Howeve,r nothing is 100% - we have evolved and created a technology dependent society and have to live with the consequences of that. You could of course, opt out of modern life, live simply, without engaging with the trappings of the modern world. Ive spent some time in Pennsylvania; the Amish lifestyle is a hard one, but does limit the risk of these things happening.

I think there might be a misunderstanding about ever 6 funding.

They don't go back 6 years but if you qualify in any one year (i.e the current one at the time) your child will get PP for their next 6 years at school even if you stop qualifying during that time.

At least that's what happens in my area, I think it's a countrywide system so I don't suppose different areas will be doing it differently.

What evidence do you have that schools are selling parents data?

If there is nothing in the privacy policy to prevent it, then it will almost certainly happen at some point.

It is usually dressed up as 'sharing' data with 'partners' or 'relevant' organisations.

To be honest, I'm quite surprised at the naivety of your question. Where the public sector have an opportunity to monetise any asset they own, they will use it to its fullest advantage.

vinyl in my experience, schools don't have the capacity or knowledge to "sell" the data they hold.

Academy chains, and local authorities, may well do, though.

pretty schools probably don't/ won't - local authorities ...maybe ...
But this data is on central databases - in the hands of private companies ...companies who specialise in handling data, know that data has value and what the value is . And who will also know exactly how much they can get away with to stay just within the law - probably know more than the local authorities do ... I find it a concern.

I know I confused the issue mentioning Scotland but that is because I know about that system - I know that the type of data being collected on school children is being driven by the database company
(like I said they provide the template forms and the database fields to be completed - the council need to go through and say what isn't a required essential field ...but they have to request that change - the default is they are all required.
If this is the case in Scotland I wouldn't be surprised if it is similar in the rest of the UK.

Fair point, it does tend to be a rung further up the management chain - In fairness, I think the school probably does have the best interests of the pupils at heart.

I think you're right when you say the they don't have the capacity or knowledge to really understand the value of the data they are gathering. The Local Authority though? Whole different ball game.

I can only speak from my personal experience but in my many years of having children at different schools I can't remember a single instance in which I've been asked to provide any details that wouldn't be already be held by my local authority unless there is a market for which days my child has a packed lunch or whether they walk or ride a bike to school.

Maybe my area is different to others - what type of information are people providing to their schools?

And no, bespoke, I'm not at all naive about whether schools are selling data, I'm asking for any evidence that this is happening, who is going to approach schools for tiny amounts of data when they can buy huge amounts much more cost effectively from other sources- it doesn't make sense that this would be happening

Look, I work in this field. My advice is to never hand over any data at all unless you really have to.

Once it has left your control, you will never get it back again. Even bulked and anonymised data sets can sometimes be reverse engineered to re personalise it (I.e to make it personally identifiable again)

I really wish people would catch themselves on to this, just because someone has asked you for data, it doesn't mean you have to hand it over.

A little critical thinking would go a long way here.

I have also worked in this field and frankly, can't get worked up about it.

If my name, dob, ni number and address is floating about in the cyber-ether along with millions of others, the risk of it being used for nefarious purposes is slim and if it is, then there are processes in place to resolve any damage that may be done.

...and if you've got nothing to hide, you've got nothing to fear - right?