Ministers failed to properly assess the data protection risks of their new live attendance tracker before its launch and misled schools about the involvement of the information watchdog.
Documents seen by Schools Week show the Information Commissioner’s Office (ICO) raised numerous concerns about the “high-risk” pilot. Officials questioned its legal basis and its plans to hold the data for 66 years.
The Department for Education has collected daily attendance data direct from 14,000 school registers since February through a partnership with the edtech firm Wonde.
Data collected includes pupils’ sex, ethnicity, free school meals eligibility and special educational needs status.
Ministers plan to use the model to replace the termly school census. It forms part of what the government calls a “zero tolerance approach to absenteeism”.
Important safeguarding checks not completed
Organisations are required by law to carry out a data protection impact assessment (DPIA) for collections that are likely to result in a “high risk” to individuals.
The DfE assessed the risk of the pilot as low, but the ICO said it was “clearly in the high risk category”.
In documents obtained by campaign group Defend Digital Me under the freedom of information act, the ICO said the DfE “did not complete” a DPIA before the collection began on February 7.
Data processing “commenced one week prior to final sign-off”, it said.
The department claimed when approached that it did conduct a DPIA “as part of the preparation for the pilot”, but was unable to provide proof. Instead, it shared the first version of the DPIA, which was dated February 15.
The dossier shows how ICO officials scrambled to find out more after the scheme’s launch. It even asked the DfE to pause the pilot until a full risk assessment could be done, but the department said this was “not possible”.
‘Schools wouldn’t have signed up if they knew’
The law also requires organisations to consult the ICO about “high risk” collections. In an email to schools on February 8, the DfE claimed it had been “working closely” with the ICO on the impact assessment.
But the ICO ordered the DfE to correct this “inaccuracy”, as the DPIA was only shared a week after the collection began.
Geoff Barton, the general secretary of the ASCL school leaders’ union, demanded a “full explanation about what went wrong and the concerns raised”.
“From the DfE email schools would have formed the impression that the data protection impact assessment had been sorted with the ICO, when the ICO had not actually seen the impact assessment at that stage.
“This is completely unacceptable and if schools had known that an important part of the process for safeguarding data had not actually been completed, it is unlikely they would have signed up to the trial.”
Attendance tracker data will be held for 66 years
The ICO raised a host of other concerns, warning the DfE had not been clear about the “specific legislation” underpinning the collection.
The watchdog also warned the department’s “limited” impact assessment did not “adequately explain” the need to hold the data for 66 years.
A DfE spokesperson said data protection “has been a central consideration throughout our attendance data collection pilot”.
“We have taken all action required under data protection laws in relation to the pilot, and voluntarily engaged with the ICO to understand the position and take any action to address the limited areas where concerns were raised.”
An ICO spokesperson said: “The DfE informally engaged with us regarding its strategic data collection and we provided advice.”
The regulator refused to answer detailed questions about the DfE’s claims, nor confirm whether concerns had been addressed.
It is not the first time the government has faced criticism for its handling of pupil data.
In 2016, ministers were forced to admit they planned to share nationality data with the Home Office for immigration control. The controversial collection ended in 2018 after it was boycotted by schools.
A damning audit by the ICO in 2020 found the department had broken data protection laws in the way it handled pupil information.
Defend Digital Me has questioned the rationale for the new collection, which comes as ministers are preparing harsher penalties for school absence.
Jen Persson, its director, said: “The volume of sensitive data to be sent to the DfE for 66 years is vast.
“The department suggests that it’s no different from what was collected before, just more often. But if so, then why change it?”
Your thoughts