Pupil Data: sensitive data release

The request was successful.

Dear Department for Education,
with reference to the FOI request: Ref: 2015-0048682 and the associated letter.

You have confirmed that in the release of 5 years worth of data (2008-2012) from the National Pupil Database the Department for Education released children's sensitive personal data including SEN and FSM indicators, ethnicity and language, in February 2013 to The Telegraph.

These identifying and sensitive items, or identifying data items were matched at individual pupil level with census data for KS2, KS4 and KS5 datasets before release at individual level.

Please can you provide:

1. the legal basis (in form of written legal advice used at the time if available, or anything relevant and similar) that met Schedule 3 of the Data Protection Act 1998 to permit the release of sensitive data. If no past evidence is available, please provide what is currently used to make similar decisions.

2. the written business case used to ascertain why these particular data were necessary, and that less identifying and sensitive data would meet the requirement. (If nothing more than the application form already provided is available, there's no need to provide again.)

3. Please can you confirm what small numbers suppression, if any, was applied before this release. (Not what the users may have applied before their statistical publication, but what was applied to the data before providing to them.)

4. That request stated: "in order to get further assurance on this element, we are currently in the process of reviewing older data requests with an aim of receiving the relevant confirmation of deletion." Can you confirm the total number of older data requests for which you have received or not received this confirmation - whichever is easier to provide - and I appreciate this may be partial (i.e. at the time of writing we have reviewed 50 / 450 requests, and of those we have received 49 destruction notices already, for example).

Thank you for your support.
Sincerely,

Jen Persson

Department for Education

Dear Jen Persson.

Thank you for your recent enquiry. A reply will be sent to you as soon as possible. For information; the departmental standard for correspondence received is that responses should be sent within 20 working days as you are requesting information under the Freedom of Information Act 2000. Your correspondence has been allocated reference number 2015-0054037.

Thank you

Department for Education
Ministerial and Public Communications Division
Tel: 0370 000 2288

show quoted sections

Dear Department for Education,
with reference to the FOI request: Ref: 2015-0048682 please may I ask for a status update?

Made on 30th November, it is now overdue the maximum response time of 20 working days, December 30th. While I appreciate this has latterly included the Christmas and New Year period and the holiday time may differ a little, 32 standard working days have since passed, and some indication of progress, perhaps in providing part of the information you have already obtained, would be constructive.

Thank you.
Sincerely,

Jen Persson

Dear Department for Education,
please can you provide an update of the status of this request which is long overdue the statutory obligation.
If there has been a decision made to withhold information, please let me know as soon as possible.

Thank you for your support, in the interests of the 20 million individuals' now affected by the data releases from the National Pupil Database to which this relates.

Sincerely,
Jen Persson

Dear Department for Education,
Please pass this on to the person who conducts Freedom of Information reviews.

I am writing to request an internal review of Department for Education's handling of my FOI request 'Pupil Data: sensitive data release' made on 30 November 2015 and which the Department acknowedged on December 2, 2015 and despite my reminder / requests on January 17 amd March 7 2016, I have received no reply. It is now six months overdue. I am therefore writing to request an internal review.

In summary the request was for:

1. the legal basis (in form of written legal advice used at the time if available, or anything relevant and similar) that met Schedule 3 of the Data Protection Act 1998 to permit the release of sensitive data. If no past evidence is available, please provide what is currently used to make similar decisions.

2. the written business case used to ascertain why these particular data were necessary, and that less identifying and sensitive data would meet the requirement. (If nothing more than the application form already provided is available, there's no need to provide again.)

3. Please can you confirm what small numbers suppression, if any, was applied before this release. (Not what the users may have applied before their statistical publication, but what was applied to the data before providing to them.)

Part 4. can be ignored as it has been mase available in the 3rd party release rergister published in May 2016.

A full history of my FOI request and all correspondence is available on the Internet at this address: https://www.whatdotheyknow.com/request/p...

Thank you for your consideration.

Sincerely,
Jen Persson

Department for Education

Dear Ms Persson,

Ref: 2015-0054037

Thank you for your request for information, which was received on 01/12/2015. The request has been dealt with under the Freedom of Information Act 2000 (“the Act”).

I would like to offer my apologies for the delay in responding. The Department takes very seriously its obligations under the Act, including the requirement to respond within the statutory deadline of 20 working days. I am afraid that we have not been able to maintain this standard in this instance and while there may be considered to be mitigating circumstances, this delay is not acceptable and I am very sorry for the inconvenience which it may cause you.

You asked the following questions about the previous FOI response (2015-0048682) and associated letter:

You have confirmed that in the release of 5 years’ worth of data (2008-2012) from the National Pupil Database the Department for Education released children's sensitive personal data including SEN and FSM indicators, ethnicity and language, in February 2013 to The Telegraph.

These identifying and sensitive items, or identifying data items were matched at individual pupil level with census data for KS2, KS4 and KS5 datasets before release at individual level.

Please can you provide:

1. the legal basis (in form of written legal advice used at the time if available, or anything relevant and similar) that met Schedule 3 of the Data Protection Act 1998 to permit the release of sensitive data. If no past evidence is available, please provide what is currently used to make similar decisions.

At the time of this request (February 2013) we did not require the requestor to inform us of the conditions for processing that they relied on. The requestor signs an agreement which confirms that they will process the data in accordance with the Data Protection Act (DPA) and it is the responsibility of the requestor to ensure this is the case. As such there is no written evidence available of the condition for processing under Schedule 3 of the Data Protection Act that the Daily Telegraph relied on.

In February 2015 we introduced an additional level of scrutiny where we ask requestors to confirm the DPA conditions for processing they rely on to link data to the NPD. The latest version of the NPD data request application form (question 6b) specifically asks about the conditions for processing on which the requestor is relying. If the request includes sensitive personal data, the answer to this question must convince the Department that the processing of the data is fair and lawful, the latter requiring a condition for processing under Schedule 3 of the DPA. If there is any doubt as to the validity of the response, the legal advisor’s office is consulted for advice.

2. the written business case used to ascertain why these particular data were necessary, and that less identifying and sensitive data would meet the requirement. (If nothing more than the application form already provided is available, there's no need to provide again.)

As previously noted during the assessment of this request the data requirements were discussed with the requestor and their application was moved from a Tier 1 to a Tier 2 request. This significantly reduced the amount and sensitivity of the data requested as a number of highly sensitive and identifiable variables were removed from the request.

There is no further written business case for the approved Tier 2 variables other than what is included in the application form. After a telephone discussion with the Daily Telegraph, the Tier 2 variables requested were subsequently approved as they were required to differentiate between the different intakes that schools have. To effectively compare schools, the Daily Telegraph wished to factor in the “different types of pupil” who are present at different schools. Information on pupil characteristics related to prior attainment: gender, ethnic group, language group, FSM eligibility and SEN provision status were deemed by the Department to be appropriate as these are seen as important factors in levels of pupil attainment. The approved Ethnic Group Major and Language Group Major variables are the least sensitive versions available of this data. The Daily Telegraph did subsequently confirm destruction of this data.

3. Please can you confirm what small numbers suppression, if any, was applied before this release. (Not what the users may have applied before their statistical publication, but what was applied to the data before providing to them.)

There is no suppression applied to data extracts from the NPD before release. Instead, Requesters are required to sign up to strict terms & conditions covering the confidentiality and handling of data, security arrangements, retention and use of the data. These include that no individual will be identified in published data. The Daily Telegraph requested pupil-level data and so suppression was not applicable.

4. That request stated: "in order to get further assurance on this element, we are currently in the process of reviewing older data requests with an aim of receiving the relevant confirmation of deletion." Can you confirm the total number of older data requests for which you have received or not received this confirmation - whichever is easier to provide - and I appreciate this may be partial (i.e. at the time of writing we have reviewed 50 / 450 requests, and of those we have received 49 destruction notices already, for example).
Information on data destruction notices received has been added to the published list of data requests on the NPD website: https://www.gov.uk/government/publicatio....
The information supplied to you continues to be protected by copyright. You are free to use it for your own purposes, including for private study and non-commercial research, and for any other purpose authorised by an exception in current copyright law. Documents (except photographs) can be also used in the UK without requiring permission for the purposes of news reporting. Any other re-use, for example commercial publication, would require the permission of the copyright holder.

Most documents produced by a government department or agency will be protected by Crown Copyright. Most Crown copyright information can be re-used under the Open Government Licence (http://www.nationalarchives.gov.uk/doc/o...). For information about the OGL and about re-using Crown Copyright information please see The National Archives website -http://www.nationalarchives.gov.uk/infor... .
Copyright in other documents may rest with a third party. For information about obtaining permission from a third party see the Intellectual Property Office’s website at www.ipo.gov.uk<http://www.ipo.gov.uk/>.
If you are unhappy with the way your request has been handled, you should make a complaint to the Department by writing to me within two calendar months of the date of this letter. Your complaint will be considered by an independent review panel, who were not involved in the original consideration of your request.
If you are not content with the outcome of your complaint to the Department, you may then contact the Information Commissioner’s Office.

Yours sincerely,

Martin Johnson

Department for Education

Fiona Nicholson left an annotation ()

Mention of the Educational Endowment Foundation seems to be a bit of an Open Sesame https://educationendowmentfoundation.org...