Question to the Department for Education:

To ask Her Majesty’s Government, further to the Written Answers by Lord Nash on 7 November 2016 and 8 November 2016 (HL2421 and HL2689) and further to the Written Answer by the Minister of State for School Standards on 2 February (HC61932), when and how former pupils who provided their personal data before 2010 for the purposes of their own education and who are now older than 19 will be informed of the new broader uses of their individual personal data by third parties since 2011; and whether they are able to withdraw these data or refuse these uses, and if so, when.

The submission of school census data to the Department is a statutory requirement on schools under section 537A of the Education Act 1996. As such, schools do not need to obtain parental or pupil consent to the provision of information and they are protected from any legal challenge that they are breaching a duty of confidence to pupils. Likewise the Department for Education does not need consent to share the data with named bodies or third parties as long as that sharing is lawful and in compliance with the Data Protection Act.

Whilst the legislative background removes those needs, DfE takes the rights of data subjects very seriously and seeks to ensure all data subjects are aware of what data is used for what purposes. Aligned with the Data Protection Act 1998, DfE focuses on ensuring data subjects know:

• the right to know the types of data being held

• why it is being held, and
• to whom it may be communicated.

A ‘privacy notice’ is a good way to be able to meet data subjects’ rights and DfE strongly recommend that these are used by all schools to explain what personal data they collect, why it is collected, who it is shared with and what it is used for. To support schools with using privacy notices in this way the Department have developed a privacy notice template, which is available for schools to use on GOV.UK, which gives access to further information about the Department's use of personalised data.

To maintain public transparency about the uses made of information held by the Department, we also publish a list of 3rd party uses of the National Pupil Database (NPD) that details which organisations have received NPD data, along with an outline of what the data is being used for. (https://www.gov.uk/government/publications/national-pupil-database-requests-received)

Whilst it is not possible for a parent / guardian or an individual child to opt out of the school census collection, and the subsequent holding of such data by the Department, there is certain information (such as ethnicity, first language, country of birth, nationality and whether a child is the child of someone in the Armed Services) which must always be as declared by the parent / guardian or the pupil where a pupil is deemed mature enough to have capacity to consent to sharing their personal data with others. If the parent / guardian or child do not wish to provide any of this information to the school or to the Department, they should tell the school and it will be recorded on the school system as ‘refused’ and will not be transferred to the DfE as part of the child’s school census return. Additionally some data items (nationality, country of birth and proficiency in English) which are collected by DfE are deemed highly sensitive and are not placed into the National Pupil Database, and thus not made available at all for 3^rd party re-use.