Security woes risk Labour’s huge data push, ministers told

Radical plans for ministers to scrape real-time data from schools to shape policy moves are in danger of being “screwed up” by tight deadlines and security gaffes, experts have warned.

The government’s little-known “data spine” scheme will see information – including pupil records – fed straight to Department for Education officials.

Claire Archibald, legal director for law firm Browne Jacobson, labelled the project one of the government’s “most ambitious” proposals – but warned that is “precisely where the risk lies”.

“The question of who builds it, who hosts it, who has access, and on what legal basis, is not detail to be resolved later in the procurement process,” she argued.

“It is the central question, and it needs a credible, transparent answer before any route to market is established.”

Real-time info

Schools Week revealed in January ministers hoped management information service (MIS) providers would help them “harness the potential” of the real-time data they collect to inform decisions.

The following month Labour rebadged the scheme as the “data spine” in the schools white paper.

It said the project would “create a secure, privacy-respecting and streamlined way” to share information – like pupil records and attendance, progress and assessments figures – across “different systems in education”.

Government papers now show the scheme has been added to plans to create a MIS framework, which will give schools “a route to market” for the tech and enable “them to analyse, use and report on key data”.

‘Screw-up’ fears

We reported in November that civil servants were drawing up the purchasing route to shield schools from the £200 million MIS turf war, which has seen high-profile legal disputes involving some of England’s largest MATs.

Academy trusts will have to ensure their contracts are aligned with the framework – which has not launched yet – by September 2027. From that point, they will have to use the framework to secure their next full-term deal.

Caroline Wright, director general of the British Educational Suppliers Association, is “concerned by the speed at which the department is moving ahead”.

This was due to the “complexity of the market dynamics within the MIS landscape and the lack of commercial expertise and knowledge of officials and ministers in this area”.

One policy expert, who helped draw up the white paper and asked not to be named, also doubted the data spine could be readied in time for next year.

“I am worried that through this rushed or ham-fisted approach they could inadvertently screw up the whole thing. They appear to be sneaking this through the MIS framework.

“This is a lot of student data that is going to be moved from MIS into some kind of central DfE receptacle. I think parents will want to know what’s being planned.”

DfE’s security record

They also noted the department “does not have a great track record for handling data”.

In 2020, the Sunday Times uncovered a firm providing age-verification services for gambling companies had been wrongly provided access to an education database containing the information of 28 million children.

The DfE was later reprimanded by the Information Commissioner’s Office (ICO), which concluded the department had “failed to protect against the unauthorised processing” of data by third parties “for reasons other than the provision of educational services”.

And earlier this week, the names and contact details of school leaders were among more than 600,000 records stolen by hackers in a cyber attack targeting the DfE’s help portal and Turing Scheme database.

The department has referred itself to the ICO, National Crime Agency and National Cyber Security Centre.

Steve Rollett, of the Confederation of School Trusts, stressed schools “are responsible for lots of potentially sensitive data about pupils and their families”.

Thus far, there “has not been enough detail from the DfE about what will be collated into the national ‘data spine’ and how it will be used”.

Data opt-outs

Archibald warned there is “deep and growing mistrust between individuals and institutions when it comes to how children’s data is used, by whom, and for what purpose”.

She pointed to figures showing over 3.3 million people have permanently opted out of NHS data sharing proposals.

“The DfE’s data spine is the most ambitious proposal in the schools white paper and, in data infrastructure, ambition is precisely where the risk lies,” she added.

“The hard part is governance, accountability, parental trust, and the enforcement mechanisms that turn a policy commitment into something schools and families can actually rely on.”

The DfE did not respond to requests for comment.