Scottish pupils 'sex survey' data advertised

[ArabellaScott]

https://www.bbc.co.uk/news/articles/c5yvr65dpgzo

'Data from a controversial survey which asked school pupils as young as 14 about their sexual experiences has been advertised for use by external researchers, without the explicit consent of children or parents, BBC Scotland has learned.
The Scottish government's Health and Wellbeing census hit the headlines in 2021 after asking highly personal questions of more than 130,000 school children, raising concerns among education experts and families.
Parents said they were not told the nature of the questions in advance and were not asked to agree that their children's private information could be shared.'

...
'However, the data is now being offered publicly to external researchers via the website of Research Data Scotland, a charity created by the Scottish government in 2021 with a stated aim of making it easier to access data around health and wellbeing.

we were in one of the areas that had this survey. I knew I was right to withdraw my children from it. They were 13 and 15 at the time.

I also withdrew my children from the survey.

It gives me no pleasure to see that I was right to.

The Scottish government cannot be trusted.

It seems that not one teacher told a single child that it wasn't compulsory. The Government lied, when they had the teachers tell the children that their answers would not be shared; now they're for sale.

Compounding their errors, the data is searchable and individuals may be identifiable. There is then the possibility of the data being hacked, or mined by a bad employee.

I can't believe that people are trying to swat it away, as something minor. It's a huge scandal.

Anyone surprised?

And I do not trust a single word out of Jenny Gilruth's mouth.

It's not only searchable but it's linked to their candidate number that's used for everything including your exam results.
Thankfully I'm another one of the parents who refused permission.

Yes we did. The public discontent is probably the reason half the LAs declined to take part.

Hoardasurass · Today 20:07

Well, that's good - I would have refused as well. What about the parents who missed it, or didn't understand the implications? It's a nasty piece of snakery indeed.

I think in my younger son’s class there were more opt outs but in my elder son’s he was the only one in the class who was removed from the survey. I wonder if because he was older parents didn’t check school bags for letters the same way but I did as I had the younger child. My elder son was annoyed as the teachers were telling the kids it was to help the school and he felt singled out. He had a go at me when he came home.

it came around again in 2023 by which time I was only able to withdraw my younger child, as the elder one was 17.

Another reason it should have been 'opt in', as the govt were advised, rather than 'opt out'.

That is terrifying. I used to think Nicola Sturgeon seemed sensible- now I know all this, I think she & her henchpeople are all insane. Remember also when they gave a porn film national funding? What is going on?

This is brilliantly laid out.

Although it wasn't using candidate numbers, the BeeWell survey (linked upthread) in England has significant parallels:

Children have been given a survey that asks very intimate questions.

✅ Including questions which ask 12-15 year olds about sexual orientation and which conflate both this and the PC of sex with "gender identity" in the opening 3 questions. From this foundational positioning of gender identity as factually true, children are asked questions about their well-being.

No consent sought.

✅ Parents were contacted on an opt-out basis, meaning that if they didn't see the notification of the survey in school communications (or didn't fully understand what it entailed) their child was given the survey. Prior to this, their child's personal identifiable information had already been sent to BeeWell. Children were asked to consent to how their data was being used at the point at which they completed the survey, during the online sign-in process (surveys were completed online, using the platform provided by BeeWell). It is highly likely that most just ticked it without much thought because of how it was positioned e.g. schools had written to parents, it's valuable information to help with mental health of current and future generations of children etc etc.

No consideration of the impact on children, a proportion of whom will have been abused. Questions that children may well not want to share in a classroom setting, or have a teacher/teaching assistant see their responses to. No provision made for children who were upset or impacted by these questions.

Consideration and support was given.... but arguably this made it worse, because "support" was in fact a heavy push of the belief that we all have a gender identity. The online survey had hyperlinks to information from the Pride Trust and other information about gender identity, further embedding this belief as fact. Children are likely to trust this information because they are accessing it in school.

the survey combined some potentially 'outing' information with the sensitive information. So 'jigsaw' identification is potentially possible.

✅ The BeeWell survey is a blank cheque for potentially the rest of the child's life into adulthood. If parents didn't opt their child out, there is no cut off date of when the researchers will stop matching the data they have gathered to other personal information. The information in the opt-out form says that in future, BeeWell intends to map the data to future mental health, exam, salary and other records to build a picture of how each child fares during life and how this maps back to their mental health (and gender identity) as a teen.

Thirdly, the LA said the info wouldn't be shared. And now it's up for sale to researchers.

BeeWell states that the research which uses the information (which will include anonymised data) will be shared with schools and other organisations. It's possible that schools which participated will get this for free but obviously this sharing will also be monetised as that will be partly how the project is funded.

So all in all, two slightly different scenarios but with very much the same theme: something is positioned to parents and children as valuable to their and others' mental health (with implicit guilt about being selfish if not participating), when in fact it's actually a data mining exercise which may lead to harmful mental health (and potentially other detrimental) outcomes for the participants..

Urgghhh!

An awful lot of ‘we didn’t collected the data, LAs did so it is their fault’ followed by ‘it is a good thing that the government collects data so we will be pressurising the LAs that refused to do our bidding.’

An example of how the SNP works in microcosm:
Bad = LAs fault/Westminsters fault
Good = Isn’t the Scottish Government great?

And absolutely no recognition of the issue at hand.

I hope the LAs take note that if GDPR was found to have been broken, Jenny Gilruth will have no compunction about throwing them under the bus.

The very first problem is a lack of awareness of what is and isn't appropriate to ask/teach/suggest to children.

(A lack of awareness is the most charitable assumption.)

The next problem is a failure to grasp how 'consent' works - not on a tacit assumption of agreement, but on seeking an informed, positive choice.

(Again, a failure to grasp is the most charitable assumption.)

The next problem is laxity in implementing rules that have been set up specifically to protect children.

(Laxity is the most charitable assumption.)

The last problem is the sharing of information that we were told would not be shared.

(The most charitable assumption here is a lack of rigour in thinking through consequences and risk.)

The best case scenario is that government and education professionals are careless, lazy, ignorant, and/or unable or unwilling to understand consent and safeguarding.

The worst case scenario is that they are deliberately seeking to undermine trust, safeguarding, and child safety.

We can usually assume Hanlon's razor. I genuinely hope that's the case here.

I think another thing that's common to all of these issues is self justification fallacy - that because the person's intent is good, they are incapable of making mistakes, and that anyone who criticises or asks questions is operating in bad faith, is therefore the enemy, and must be ignored/smeared/derided. This leads them to double down.

🎯

anyone who criticises or asks questions is operating in bad faith, is therefore the enemy, and must be ignored/smeared/derided. This leads them to double down.

Like this, where a child is made to feel guilty/different and ends up being cross at the adult who was doing the right thing in relation to safeguarding:

My elder son was annoyed as the teachers were telling the kids it was to help the school and he felt singled out. He had a go at me when he came home.

That any child should feel that their own parent is in the wrong, when it's the school, the LA and the government who is failing them is awful. Safeguarding has been flipped over on its head, where suddenly the ones doing it are the "baddies".

I hope the LAs take note that if GDPR was found to have been broken, Jenny Gilruth will have no compunction about throwing them under the bus.

As with the BeeWell survey, it's going to come down to a privacy law expert who also understands scientific research methodology being able to prove that this survey did not meet the criteria for "public task" under GDPR. I'm neither of these things but I can't imagine it would. Irrespective of the inappropriate question content (which obviously also needs addressing), there are other, opt-in methods that could be used to do surveys.

IMO the bigger the organisation and the harder it is to force personal ownership (sack) the more difficult it is to get staff worry about the bus.

People make decisions.
They make different choices when they will be personally impacted.

Authorising with no risk of self harm (pay fine, job loss, jail) on an "Unknown, unknown" is easy.
Its forcing the individual to take ownership at each level that is the problem.
"someone else" did the a risk assessment process that I rely on when I have know idea what was done is a culture.

Of the LAs that did take part
Clackmannanshire,, Glasgow, Renfrewshire - SNP minority
Dundee - SNP majority
East Renfrewshire - SNP / Labour coalition
Falkirk - SNP / Independent coalition
Stirling - no overall control, SNP + Labour

I wonder how the SNP councillors there will feel about being thrown under a bus.

BonfireLady

As with the BeeWell survey, it's going to come down to a privacy law expert who also understands scientific research methodology being able to prove that this survey did not meet the criteria for "public task" under GDPR. I'm neither of these things but I can't imagine it would. Irrespective of the inappropriate question content (which obviously also needs addressing), there are other, opt-in methods that could be used to do surveys.

I take a different view DP is a legal requirement so carrying out a census/ mass collection is or should be a high bar.

Would the LA circulate the same census to their adult population; if so, what % need reply to get reliable data.

So in the design stage the named decision makers should have had document

Data Protection Our Obligation to prove "Public Task".
Sub section
▪︎ Scope
▪︎▪︎Do we need use a sample or use the total population
::: we decided to collect from the total population.
▪︎▪︎ ▪︎ Why we need to collect data from 100% of the population
:::: Population sampling works however we decided to spend extra public funds to ........

No matter the outcome the decision makers had that scope obligation. Failure to comply with the law should not be rewarded

As for a LA with no method framework or no expert, they can ask can we get the same outcome using a different way.
Yes always, because sampling has proven to be effective.

If I understand your post correctly, I think we're saying the same thing just from a different angle:

That it's reasonable to conclude that what they have done (both this survey and the BeeWell one... see more details in the linked thread) has broken GDPR law.

At the very least, I'd like to see an opposition politician in both Westminster and Holyrood explicitly ask each government if GDPR law has been broken/misused.

"someone else" did the a risk assessment process that I rely on when I have know idea what was done is a culture.

Yep. This is key. Every Data Protection Officer in the cascade of assessments (the survey provider, the LA, the school) has a separate obligation to validate individually that what is being done is within GDPR. Each role within that chain of data processor, data owner etc has its own obligations. It's not good enough to say "the survey people said it was fine so we handed the children's details over on that basis", yet that is presumably exactly what happened. It would be interesting to see the DPAs (Data Protection Assessments) for each organisation.

To add: I'm guessing the survey providers told the LAs and schools that they could "use this DPA boilerplate and adapt it if you need to", thus setting up a situation where they make it look sufficiently thorough that the LAs and schools think "we don't really understand public task exemption but this is all for the children's benefit and they are the experts"... and they push all risk onto the schools and LAs because they are the ones that are handing over the data.

The politicans will get a data not found answer.

The Information Commissioner's Office is set up from "data subject" funding to do a specific job.

https://ico.org.uk/for-organisations/advice-and-services/audits/

Who can request an audit?
Audits can be carried out at public and private companies, public authorities and government departments. The Information Commissioner has adopted a
□ risk-based,
□ proportionate and
□ targeted approach to audit activities and follows a
□ by-exception approach to reporting.

¤ Tracking the sex life of a 14 year old and retaining that data throughout the life of the child x number of childrens data x possible data breach
¤ principal of why the State has choosen to tacking the sex life of all of the children in Scotland
¤ one database design->usage->distruction
¤ nope. They are children. the IOC should not expect a child to make a complaint when the IOC has extra obligations due to the child being a child.

We welcome requests for audits but we will focus on those areas we feel we will have the
□ biggest impact and
□ organisations who would benefit the most from an
□ independent assessment of their compliance with data protection legislation.

That one database ticks a whole lot of boxes

Schotland has a Childrens Commissioner at a minimum if the IOC wont act the CC should request a by-exception audit.

https://www.cypcs.org.uk/about/commissioner/

Worth writing to the CC and asking for an audit?

Schotland has a Childrens Commissioner at a minimum if the IOC wont act the CC should request a by-exception audit.

👍👍👍

I would say so. Particularly if you're a parent of one of those children. Maybe an organisation like Sex Matters could coordinate a letter on their behalf. The Scottish survey falls under "human rights" in so far as children have rights to be safeguarded effectively.

Given it's already made it in the press with the BBC article, now is the time to keep the story going.