Information watchdog sounds alarm over live school attendance tracker

DfE failed to properly assess risk of collection of pupil data now used by 14,000 schools nationwide, says ICO

DfE failed to properly assess risk of collection of pupil data now used by 14,000 schools nationwide, says ICO


Ministers failed to properly assess the data protection risks of their new live attendance tracker before its launch and misled schools about the involvement of the information watchdog.

Documents seen by Schools Week show the Information Commissioner’s Office (ICO) raised numerous concerns about the “high-risk” pilot. Officials questioned its legal basis and its plans to hold the data for 66 years.

The Department for Education has collected daily attendance data direct from 14,000 school registers since February through a partnership with the edtech firm Wonde.

Data collected includes pupils’ sex, ethnicity, free school meals eligibility and special educational needs status.

Ministers plan to use the model to replace the termly school census. It forms part of what the government calls a “zero tolerance approach to absenteeism”.

Important safeguarding checks not completed

Organisations are required by law to carry out a data protection impact assessment (DPIA) for collections that are likely to result in a “high risk” to individuals.

The DfE assessed the risk of the pilot as low, but the ICO said it was “clearly in the high risk category”.

In documents obtained by campaign group Defend Digital Me under the freedom of information act, the ICO said the DfE “did not complete” a DPIA before the collection began on February 7.

Data processing “commenced one week prior to final sign-off”, it said.

The department claimed when approached that it did conduct a DPIA “as part of the preparation for the pilot”, but was unable to provide proof. Instead, it shared the first version of the DPIA, which was dated February 15.

The dossier shows how ICO officials scrambled to find out more after the scheme’s launch. It even asked the DfE to pause the pilot until a full risk assessment could be done, but the department said this was “not possible”.

‘Schools wouldn’t have signed up if they knew’

The law also requires organisations to consult the ICO about “high risk” collections. In an email to schools on February 8, the DfE claimed it had been “working closely” with the ICO on the impact assessment.

But the ICO ordered the DfE to correct this “inaccuracy”, as the DPIA was only shared a week after the collection began.

Geoff Barton, the general secretary of the ASCL school leaders’ union, demanded a “full explanation about what went wrong and the concerns raised”.

“From the DfE email schools would have formed the impression that the data protection impact assessment had been sorted with the ICO, when the ICO had not actually seen the impact assessment at that stage.

“This is completely unacceptable and if schools had known that an important part of the process for safeguarding data had not actually been completed, it is unlikely they would have signed up to the trial.”

Attendance tracker data will be held for 66 years

The ICO raised a host of other concerns, warning the DfE had not been clear about the “specific legislation” underpinning the collection.

The watchdog also warned the department’s “limited” impact assessment did not “adequately explain” the need to hold the data for 66 years.

A DfE spokesperson said data protection “has been a central consideration throughout our attendance data collection pilot”.

“We have taken all action required under data protection laws in relation to the pilot, and voluntarily engaged with the ICO to understand the position and take any action to address the limited areas where concerns were raised.”

An ICO spokesperson said: “The DfE informally engaged with us regarding its strategic data collection and we provided advice.”

pupil nationality attendance tracker
Jen Persson

The regulator refused to answer detailed questions about the DfE’s claims, nor confirm whether concerns had been addressed.

It is not the first time the government has faced criticism for its handling of pupil data.

In 2016, ministers were forced to admit they planned to share nationality data with the Home Office for immigration control. The controversial collection ended in 2018 after it was boycotted by schools.

A damning audit by the ICO in 2020 found the department had broken data protection laws in the way it handled pupil information.

Defend Digital Me has questioned the rationale for the new collection, which comes as ministers are preparing harsher penalties for school absence.

Jen Persson, its director, said: “The volume of sensitive data to be sent to the DfE for 66 years is vast.

“The department suggests that it’s no different from what was collected before, just more often. But if so, then why change it?”

More from this theme


Schools demand national campaign against abusive parents

More than a third of school staff report receiving verbal abuse from parents

Freddie Whittaker

United Learning trust sued for defamation over investigation report

Former associate head files claim in the High Court

Jack Dyson

Report reveals how top trusts closed ethnicity attainment gap

Diversifying curriculum was one of the successful strategies in government study commissioned after Sewell report

Samantha Booth

EYFS results improve, but some pupils far behind

DfE says improvement may show Covid recovery or familiarity with new assessments - but gender gap widens

Freddie Whittaker

Help us ‘minimise’ exclusions, councils tell regional directors

The Association of Directors of Children's Services (ADCS) wants academy regulators to 'play greater role' in cutting exclusions

Samantha Booth

Reduced cash threatens ‘invaluable’ alternative provision pilot

AP specialist taskforces provide mental health professionals, family workers and speech and language therapists

Amy Walker

Your thoughts

Leave a Reply

Your email address will not be published. Required fields are marked *