Dear Information Commissioner's Office,

Please provide the following information according to the FOI Act 2000.

> A copy of the agreement between the Office of the ICO and Department for Education (DfE) about Unique Pupil Numbers (UPNs).

At the time of the agreement, the (DfE) may have been called the Department for Children, Schools and Families (DCSF) that was a department of the UK government, between 2007 and 2010, -- since renamed as the Department for Education. The Office of the Information Commissioner may also have then been called the 'Data Protection Registrar'.

When Unique Pupil Numbers (UPNs) were first introduced by the Department for Education, measures were agreed in order to minimise any potential risks to the personal privacy of individuals and to ensure UPNs are used within the educational service only.

With reference to Section 2) https://defenddigitalme.com/wp-content/u...

In order to support the search for the document(s) the main elements of the package were:

i. the UPN to lapse when pupils leave schooling (at sixteen years old unless the pupils attend a maintained school providing post-16 education);
ii. the UPN to be as far as possible a ‘blind number’, held by schools on the pupil's electronic record, and only output when required to provide information to the LA, to the Department or other central agencies(e.g. QCA/NAA), or to another school to which the pupil is transferring.
iii The UPN should not be regarded as an automatic adjunct to the pupil's name, routinely appearing on any record or document relating to them;
iv. the UPN to be designated a "general identifier" under the Data Protection Act 1998, rendering its use by any organisation for any purpose unrelated to education illegal;
v. the central pupil database to incorporate "privacy enhancing technologies" (PETs) -specifically encryption of the data to prevent unauthorised access to named records, and automatic logging of any authorised access (to deter improper use of the named records by those few individuals with authorised access to them)."

Thank you.
Sincerely,

Jen Persson

Information Access Inbox, Information Commissioner's Office

Thank you for contacting the Information Commissioner’s Office. We confirm
that we have received your correspondence.

If you have made a request for information held by the ICO we will contact
you as soon as possible if we need any further information to enable us to
answer your request. If we don't need any further information we will
respond to you within our published, and statutory, service levels. For
more information please visit:

[1]https://ico.org.uk/about-the-ico/our-inf...

If you have raised a new information rights concern - we aim to send you
an initial response and case reference number within 30 days.

If you are concerned about the way an organisation is handling your
personal information, we will not usually look into it unless you have
raised it with the organisation first. For more information please see our
webpage ‘raising a concern with an organisation’ (go to our homepage and
follow the link ‘for the public’). You can also call the number below.

If you have requested advice - we aim to respond within 14 days. 

If your correspondence relates to an existing case - we will add it to
your case and consider it on allocation to a case officer.

Copied correspondence - we do not respond to correspondence that has been
copied to us.

For more information about our services, please see our webpage ‘Service
standards and what to expect' (go to our homepage and follow the links for
‘Report a concern’ and ‘Service standards and what to expect'). You can
also call the number below.

For information about what we do with personal data see our [2]privacy
notice.

If there is anything you would like to discuss with us, please call our
helpline on 0303 123 1113.

Yours sincerely

The Information Commissioner’s Office

Our newsletter

Details of how to sign up for our monthly e-newsletter can be found
[3]here.

Twitter

Find us on Twitter [4]here.

 

References

Visible links
1. https://ico.org.uk/about-the-ico/our-inf...
2. https://ico.org.uk/global/privacy-notice/
3. https://ico.org.uk/about-the-ico/news-an...
4. http://www.twitter.com/ICOnews

Information Commissioner's Office

30 October 2019

 

Case Reference Number IRQ0883520

 

Dear Ms Persson,

Thank you for your recent request for information. We received your
request on 20 October 2019 and we are now in a position to respond.
 
We have dealt with your request in accordance with your ‘right to know’
under section 1(1) of the Freedom of Information Act 2000 (FOIA).
  
Request
 
In your email you asked for:
 
A copy of the agreement between the Office of the ICO and Department for
Education (DfE) about Unique Pupil Numbers (UPNs).
 
Response
 
After conducting reasonable searches of our information holdings we can
confirm that we do not hold information in scope of your request.
 
It may be helpful to advise you that the version of the guidance on unique
pupil numbers (UPNs) referenced in your request was published in 1999.
This guidance has been updated by the Department for Education since then,
with the most recent version, released in June 2019, available here:

[1]https://assets.publishing.service.gov.uk...

This concludes our response to your request. We hope the information
provided is helpful.
 
Review Procedure
 
However, if you are dissatisfied with this response and wish to request a
review of our decision or make a complaint about how your request has been
handled you can write to the Information Access Team at the address below
or e-mail [2][ICO request email].
 
Your request for internal review should be submitted to us within 40
working days of receipt by you of this response.  Any such request
received after this time will only be considered at the discretion of the
Commissioner.
 
If having exhausted the review process you are not content that your
request or review has been dealt with correctly, you have a further right
of appeal to this office in our capacity as the statutory complaint
handler under the legislation. To make such an application, please write
to our Customer Contact Team at the address given or visit our website if
you wish to make a complaint under the Freedom of Information Act.
 
A copy of our [3]review procedure can be accessed from our website.

Yours sincerely
 

Shannon Keith
Senior Information Access Officer, Risk and Governance Department
Corporate Strategy and Planning Service
Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow,
Cheshire SK9 5AF
T. 0330 313 1636  F. 01625 524510  [4]ico.org.uk  [5]twitter.com/iconews
For information about what we do with personal data see our [6]privacy
notice.
Please consider the environment before printing this email

References

Visible links
1. https://assets.publishing.service.gov.uk...
2. mailto:[ICO request email]
3. https://ico.org.uk/media/1883/ico-review...
4. http://ico.org.uk/
5. https://twitter.com/iconews
6. https://ico.org.uk/global/privacy-notice/