Higher Education and Research Act 2017 (Cooperation and Information Sharing) Regulations 2018

Baroness Garden of Frognal Excerpts

Tuesday 24th July 2018 Lords Chamber

[Baroness Garden of Frognal (LD)]

My Lords, we on these Benches share the concerns expressed by the noble Lord, Lord Watson, and so eloquently expressed by the noble Lords, Lord Adonis and Lord Lucas. Will the Minister say what data the OfS is likely to share with Pearson? We note that Pearson is the only for-profit organisation on the list; the others are public bodies or registered charities. What is the commercial value of the data that it will be sharing, and will the OfS be charging the awarding bodies for access to this commercially sensitive data?

To pick up on the concerns expressed by the noble Lord, Lord Adonis, will data by which students can be individually identified be sent to the OfS by awarding bodies, and, if so, how will the consent of students to this transfer of data be obtained? It is surely important that that should happen. In summary, how will the OfS comply with the Data Protection Act in this, and can the Minister offer us any reassurances on these very disturbing aspects?

[Viscount Younger of Leckie (Con)]

My Lords, I thank the noble Lord, Lord Watson, for tabling this Motion. The noble Lord has raised concerns that these regulations create significant powers for the Office for Students to grant access to students’ confidential data to a single commercial provider. He also calls on Her Majesty’s Government to carry out a privacy impact assessment on the regulations. Before addressing the noble Lord’s concerns, I reassure noble Lords that these regulations are very much in the interests of students and taxpayers. They enable the OfS to work appropriately with other bodies to address any potential wrongdoing or concerns about quality, students’ experience, and the management and governance of the higher education system. These regulations are essential for the OfS to do its job well, and will be accompanied by strong safeguards around data protection and privacy.

The noble Lord, Lord Watson, asked about the timing of the laying of these regulations and proper scrutiny. I reassure him that these regulations are absolutely subject to proper scrutiny, as is any other statutory instrument laid under the negative procedure. They are important to the OfS being able to operate effectively as a regulator.

--- Later in debate ---

[Viscount Younger of Leckie]

I think that it would be wise if I continued with my remarks and then, if there are further concerns, I shall be happy to listen.

First, the noble Lord, Lord Watson, referred to the “single commercial provider” within the regulations, which is Pearson Education Ltd. To reassure him and the noble Baroness, Lady Garden, I emphasise that Pearson is included in these regulations solely in its capacity as the awarding body for HND and HNC qualifications. This is in the same way as other awarding bodies have been included in the regulations—namely, the Scottish Qualifications Authority, Gateway Qualifications Company Ltd and the Vocational Training Charitable Trust.

The OfS would share with Pearson only information that related to the provision of HNDs and HNCs. For example, as happens now between the DfE and Pearson, the OfS might wish to alert Pearson to an issue around the quality of this provision or suspicions of wrongdoing relating to HND or HNC provision. This sharing would be done in the interests of students and the taxpayer. Any data sharing would be underpinned by a data-sharing agreement stating that Pearson could not use that data for any other purposes. This is just one of a range of strong safeguards and protections that will be in place, as I will set out shortly.

The noble Lord, Lord Watson, raised a question about Sir Michael Barber and his potential conflict of interest. There are already information-sharing agreements between the DfE and Pearson. Sir Michael Barber no longer works for Pearson and, in any case, he was not involved in the drafting of the regulations. Therefore, I reassure the noble Lord that there really is no conflict of interest. In addition, if it emerged in the future that the OfS wished to share information or co-operate with any other organisation not currently included in these regulations, and this was to fulfil a function of that other body, I make it clear that this would be possible only by amending the regulations.

The noble Lord, Lord Watson, and my noble friend Lord Lucas asked why Pearson is included and whether awarding the HNC and HND makes it unique. They also asked about transparency surrounding what they can do with the data. I reiterate that Pearson is included only because it owns, designs and awards HNDs and HNCs. The collaboration agreement with Pearson will be published—there is transparency. Data-sharing agreements will not be published, as they may contain commercially confidential information about the circumstances that have led to the concerns that are being shared with the other party.

The noble Lord, Lord Watson, asked whether Pearson can sell on data. The answer is: absolutely not. The information sharing will be underpinned by data-sharing agreements which will specify the purposes of the data sharing, and these purposes will not include selling data. If Pearson did so, it would be in breach of the data-sharing agreement and subject to sanctions by the Information Commissioner—a serious matter.

The noble Lord, Lord Watson, asked about parliamentary scrutiny, and I would like to add to the words that I used. The regulations were scrutinised by the JCSI before they came into force, and there was a debate in the Commons in Committee on this very matter. The inclusion of any new body in the regulations would therefore be subject to the same parliamentary scrutiny and oversight as these regulations have received.

Secondly, the noble Lord, Lord Watson, was concerned about the sharing of students’ confidential data. Data privacy is a particularly pertinent topic in the current climate, and this is precisely why the Government have strengthened the legal framework underpinning data sharing by the OfS compared to the previous regime. I emphasise, however, that the main purpose of these regulations is to enable information sharing at a provider or course level. Personal data would be shared only if there were serious concerns—for example, around fraud or malpractice—and there was a specific need to share personal data to investigate a specific issue.

The noble Lord, Lord Watson, also raised concerns that students’ confidential information will be shared without the consent of those to whom it refers. I reassure noble Lords that any data sharing will be subject to data protection legislation. While consent is one lawful basis on which information may be shared, there are other bases for data sharing; the circumstances will dictate which is most appropriate. The OfS will always seek consent where it is appropriate to do so. However, where data sharing is to investigate wrongdoing or fraud, for example, and seeking consent would jeopardise the investigation, the OfS may rely on another lawful basis for information sharing.

In addition, I reassure noble Lords that these regulations do not oblige the OfS to share any information or to co-operate with any of the bodies in the regulations, including Pearson. They simply make this possible where appropriate. It will be for the OfS, or in some cases the Secretary of State, to decide when to do this, and this will be decided in the context of the general duties and functions of the OfS as set out in primary legislation.

I would like to go further. I reassure all noble Lords that there will be strong safeguards for any data sharing that is carried out with all bodies included in the regulations, including Pearson. For example, any information sharing will be subject to strict data protection laws governing its use, as stipulated by the primary legislation. These regulations do nothing to undermine data protection law. The OfS will also publish its collaboration agreements with other bodies online, including stating where data sharing agreements are in place.

It might happen, for example, that the OfS needs to share information with another body as part of a joint investigation. In this case, the OfS would also create a bespoke data sharing agreement. This agreement would state what data will be shared, with whom and why, on what legal basis, and how it will be processed and kept secure. This would also set out individuals’ rights in relation to their data. The OfS would only ever share data with precisely who needed to see it and only ever precisely what they needed to see to resolve the issue. A data sharing agreement is binding: if any organisation breaches this, the OfS as the data controller would stop this arrangement and, where appropriate, inform the Information Commissioner, who could then take action. Make no mistake: this would apply to every organisation in the regulations, and Pearson would be no exception to this.

I now turn to the final point from the noble Lord, Lord Watson, in which he called on Her Majesty’s Government to carry out a privacy impact assessment on the regulations. I thank the noble Lord for raising this point, because data privacy impact assessments are indeed a useful tool. Under GDPR, however, the Government are not obliged to conduct such an assessment. Furthermore, it would not be appropriate to do so. While the Government, in writing these enabling regulations, have identified the overall situations and reasons where the OfS may wish to share information, the need for a data privacy impact assessment should properly be considered by the organisation that will be sharing the data, once the specifics are known. Much of the data sharing would be in response to emerging concerns: for example, where there are suspicions of wrongdoing. It is only at this point that the nature and extent of privacy risks can be properly assessed and fully effective solutions put in place. The OfS is aware of the sensitivities around the sharing of personal data and takes its responsibilities to safeguard personal data extremely seriously. It will consider whether a data privacy impact assessment is needed, and will carry this out where appropriate, before sharing information that could impact on personal privacy.

I hope that, having put a lot of emphasis on these safeguards, I have reassured the House that data sharing—in particular with non-government bodies, including Pearson—will be undertaken in an appropriate way and for the right purpose, with strong protections in place.

[Baroness Garden of Frognal]

I apologise to the Minister, but could he answer my question as to whether the OfS will be charging Pearson for the data that it shares with it?

[Viscount Younger of Leckie]

I will write to the noble Baroness with that information. It may not only be a charge; there may be an agreement in place and I would prefer to get the full information to her.