Video: How does data blunder affect battle against Covid-19? (PA Media)
The Department for Education broke the law in its mishandling of the national database containing details of every school pupil in England, the Information Commissioner’s Office has concluded in a highly critical report.
The report marks the second time in less than a year that the DfE has been publicly rebuked by the privacy watchdog for failing to adhere to data protection laws.
After an investigation triggered by complaints from groups including Liberty, the ICO found that the DfE had failed to comply with sections of the general data protection regulation (GDPR). It said there was “no clear picture of what data is held by the DfE” and that its handling of millions of pupil records “could result in multiple data breaches”.
Related: Department of Education criticised for secretly sharing children’s data
“The audit found that data protection was not being prioritised and this had severely impacted the DfE’s ability to comply with the UK’s data protection laws,” the ICO said.
The audit lists more than 130 recommendations for the DfE to improve its data safeguarding, with 32 classed as urgent and 57 as high priority by the watchdog.
Sam Grant, the policy and campaigns manager of Liberty, said: “This report displays a shocking failure of privacy protections, which is dangerous for our rights.
“The type of data collected by the DfE can reveal a huge amount of sensitive personal information about us, and often about children and young people. The government has routinely misused this data to enforce cruel and oppressive policies like the hostile environment. This cavalier attitude to our personal information puts people, including the most marginalised, at risk.”
According to the ICO, the DfE had “no formal proactive oversight of any function of information governance, including data protection, records management, risk management, data sharing and information security” at the time of the audit in February.
Access to the national pupil database (NPD) has become highly controversial after it was revealed that in 2015 the department agreed to share details with the Home Office to “create a hostile environment for those who seek to benefit from the abuse of immigration control”.
In November 2019 the ICO also criticised the DfE for sharing children’s personal data with the Home Office and for failing to properly comply with data protection laws.
In its latest report the ICO found that only 12 out of 400 applications for access to the NPD had been turned down, “due to an approach which is designed to find a legal gateway to ‘fit’ the application rather than an assessment of the application against a set of robust measures”, it stated.
The report also criticises the DfE for blurred lines of responsibility and poor internal decisionmaking, noting that there was “some confusion” over roles within the DfE and its agencies.
In response, the DfE said it accepted the ICO’s recommendations in full.
“Since the ICO completed its audit, we’ve taken a number of steps to address the findings and recommendations, including a review of all processes for the use of personal data and significantly increasing the number of staff dedicated to the effective management of it,” a DfE spokesperson said.
“As well as welcoming these moves, the ICO has recognised the stringent processes we have in place to make sure children and young people’s personal data is secure.”
The ICO noted that the DfE “showed a willingness to learn from and address the issues identified”. But it warned that it would take further action if the DfE failed to make changes.