Question to the Department for Education:

To ask the Secretary of State for Education, whether her Department has completed a Data Protection Impact Assessment for Clause 5 of the Children’s Wellbeing and Schools Act.

The department is not required to complete a Data Protection Impact Assessment (DPIA) because personal data will be processed locally. Should this change, the department will conduct and publish a DPIA.

To date, pilot data has been processed locally. The next stage of piloting is under development and individual organisations’ responsibilities are still being determined.

Using the NHS number as the consistent identifier is separate from any health-related information or datasets. From piloting to date, improving connectivity enabled significant improvements in accuracy of records as well as easier location and retrieval of key information relevant to safeguarding children so reducing risk of falling through cracks between public services.

Responsibility for data governance of any data linkage initiative sits with the relevant data controllers. There are many instances of data linkage in place to support safeguarding and welfare of children. In the case of the consistent identifier project, the department, the Department of Health and Social Care, and the NSHSHS Executive are working closely together to ensure that any use of the NHS Number during pilot activity has appropriate governance in place.

Palantir or subsidiaries are not currently involved in work to pilot the Consistent Identifier. Any future organisation which wishes to connect and store the Consistent Identifier will have to satisfy the strict information governance criteria associated with storing and processing that number.