Thank you for contacting the Department for Education, you will usually
receive a reply within 15 working days.

You can find out how the department processes your personal information by
reading our [1]Privacy Notice.

References

Visible links
1. https://www.gov.uk/government/organisati...

Dear Ms Persson,

REF: 2018-0045200

Thank you for your request, which was received 16 November 2018.

You asked the following:

Under the FOI Act 2000, please provide copies of:

1. Any Data Protection Impact Assessment(s) carried out with regards to
any national collection of children's personal data and a) the AP Census,
and b) the National Pupil Database, including but not only the data now
available through external DfE data shares since March 2012.

Reference:
[1]https://www.gov.uk/government/publicatio...

2. Data sharing agreements referenced for six data applicants/recipients
in the file "National pupil database third-party requests: April 2018"
found online at
[2]https://www.gov.uk/government/publicatio...

a) DR170124.04 / University of Exeter / Date first Extract sent / Date
permission for re-use granted/ Date Application Rejected > August 15, 2017

b) DR171219.01 / EPI Education Policy Institute / Date first Extract sent
/ Date permission for re-use granted/ Date Application Rejected > pending
in the file [no date available]

c) DR170227.03 and DR170908.01 / FFT Education Ltd -- and any other live
data sharing agreement with FFT, where the license date has not yet
expired.

d) DR170221.02 / Angel Solutions / June 22, 2017

e) DR170330.03 / The Bell Foundation / June 13, 2017

f) DR170518.02 / Locrating Ltd / September 12, 2017

I have dealt with your request under the Freedom of Information Act 2000
(“the Act”).

1.     With regards to the Data Protection Impact Assessment(s) (DPIA)
concerning the Alternative Provision (AP) Census and the National Pupil
Database (NPD), these are being withheld under the Freedom of Information
Act 2000. The exemption which applies to this information is section 22
which provides for information to be exempt from disclosure where the
information is held by the Department with a view to its publication at
some future date.

Whilst the Department have always had processes in place that encourage
impact on data subject privacy to be considered and appropriate steps
taken, we are currently undergoing a review of how DPIAs are completed
within DfE to ensure these are effectively and consistently embedded into
our organisational processes. As part of this work, we are using
completion of a DPIA for the NPD and AP Census to test our new processes
and we expect this work to be completed shortly. This will include
publication of the DPIAs to ensure full public transparency about the
Department’s processes and DPIA findings. These will be made available for
both the AP Census and NPD during the first quarter of 2019.

Section 22 of the Act is a qualified exemption which means a public
interest test needs to be carried out. In doing so the following factors
have been fully considered:

·       Although publishing a DPIA is not a requirement of General Data
Protection Regulation or the 2018 Data Protection Act, it is acknowledged
that there is a general public interest in disclosure. As well as
demonstrating compliance, publication will improve the transparency of
government and help engender public trust and confidence.

·       Whilst the full DPIA will include information which might be
considered commercially sensitive or might undermine the security of
departmental systems and processes, a de-sensitised or redacted DPIA will
allow the public benefits of disclosure outlined above to be realised
without the associated risks.

·       The public interest in permitting the government to publish
information in a manner and at a time of its own choosing is also
important. It is part of the effective conduct of public affairs that the
general publication of information is a conveniently planned and managed
activity within the reasonable control of the public authority.

·       The department had already determined that it will publish the
aforementioned requested information via publication of the DPIA.

·       It is not reasonable for the government to be expected to release
piecemeal information in advance of its planned timetable and planned
publication, and there is a strong argument in favour of allowing everyone
to view this information at the same time. If it were to release this
information as requested on varying occasions this would result in partial
or incomplete information being released over a protracted period leading
to potential public confusion and inaccuracy.

The arguments for and against release have therefore been considered and
it is our view that the balance of public interest falls in favour of the
maintenance of this exemption in relation to the information relating to
this part of the request. However we have noted your details and will be
in touch in the new year to inform you when the DPIA is available.

2. I have provided copies of agreements and application forms* for:

*Please note that these are the original application forms as submitted to
us and do not reflect any subsequent email communications with the
requester to clarify their requirements and limit the data requested to
only that which was needed and provided.

·       DR170124.04 / University of Exeter – first extract sent: 15 August
2018, licence expiry date – 30 November 2018 (currently negotiating an
extension)

·       DR171219.01 / EPI Education Policy Institute – first extract sent:
10 July 2018, licence expiry date – 1 May 2019.

·       DR170227.03 / FFT Education Ltd – first extract sent: 1 August
2017, licence expiry date – 30 April 2020.

·       DR170908.01 / FFT Education Ltd – Data sent in three parts due to
data availability. First extract sent: 28 September 2017, second extract
sent: 5 February 2018, final extract sent: 29 May 2018. Licence expiry
date: 31 January 2019.

·       DR170221.02 / Angel Solutions – first extract sent: 22 June 2017,
licence expiry date – 31 May 2020.

·       DR170330.03 / The Bell Foundation – first extract sent: 13 June
2017, licence expiry date – 31 May 2018, confirmation that the data has
been destroyed received October 2018.

·       DR170518.02 / Locrating Ltd - Not supplied as previously provided
in December 2017 under FOI 2017 – 0056929. Confirmation that the data has
been destroyed received November 2018.

In addition to the above, the following are other live data sharing
agreements with FFT, where the license date has not yet expired. Please
note, these do not include data shares where FFT are processing the data
under contract to another organisation.

·       DR140617.03 / FFT Education Ltd – first extract sent: 2 October
2014, licence expiry date - 31 March 2019.

·       DR170214.02 / FFT Education Ltd – first extract sent: 9 May 2017,
licence expiry date – 30 April 2020.

·       DR170928.01 / FFT Education Ltd – first extract sent: 10 May 2018,
licence expiry date – 28 February 2020.

·       ASP accreditation – the attached documents were issued to
suppliers successful in the 2017 exercise to accredit suppliers with early
access to performance data. The agreement details the data suppliers
received under the terms of the agreement.

‐          The original agreement is dated 30/05/17.

‐          The original agreement was subject to variation in June 2018.
The agreement was updated to take account of GDPR.

‐          The original agreement was further varied in September 2018 to
clarify data descriptions and provide updated governance information.

You will notice that the information attached contains a number of
redactions to which we are applying section 40(2) (personal data).
Personal data is that which relates to a living individual who can be
identified from that data, or from that data and other information which
is likely to be in, or to come into, the possession of the requestor.
Disclosure of this information would contravene a number of the data
protection principles in the Data Protection Act, and would be regarded as
‘unfair’. By that, we mean the likely expectations of the data subject
that his or her information would not be disclosed to others and the
effect which disclosure would have on the data subject. Section 40(2) is
an absolute exemption and is not subject to the public interest test.

The information supplied to you continues to be protected by copyright.
You are free to use it for your own purposes, including for private study
and non-commercial research, and for any other purpose authorised by an
exception in current copyright law. Documents (except photographs) can be
also used in the UK without requiring permission for the purposes of news
reporting. Any other re-use, for example commercial publication, would
require the permission of the copyright holder.

Most documents produced by a government department or agency will be
protected by Crown Copyright. Most Crown copyright information can be
re-used under the Open Government Licence
([3]http://www.nationalarchives.gov.uk/doc/o...). For
information about the OGL and about re-using Crown Copyright information
please see The National Archives website
-[4]http://www.nationalarchives.gov.uk/infor...
.

Copyright in other documents may rest with a third party. For information
about obtaining permission from a third party see the Intellectual
Property Office’s website at [5]www.ipo.gov.uk.

If you are unhappy with the way your request has been handled, you should
make a complaint to the Department by writing to me within two calendar
months of the date of this letter. Your complaint will be considered by an
independent review panel, who were not involved in the original
consideration of your request.

If you are not content with the outcome of your complaint to the
Department, you may then contact the Information Commissioner’s Office.

Yours sincerely,

Samantha Morrison

Department for Education

References

Visible links
1. https://www.gov.uk/government/publicatio...
2. https://www.gov.uk/government/publicatio...
3. http://www.nationalarchives.gov.uk/doc/o... blocked::http://www.nationalarchives.gov.uk/doc/o...
http://www.nationalarchives.gov.uk/doc/o...
4. http://www.nationalarchives.gov.uk/infor... blocked::http://www.nationalarchives.gov.uk/infor...
http://www.nationalarchives.gov.uk/infor...
5. http://www.ipo.gov.uk/ blocked::http://www.ipo.gov.uk/
http://www.ipo.gov.uk/

Thank you for contacting the Department for Education, you will usually
receive a reply within 15 working days.

You can find out how the department processes your personal information by
reading our [1]Privacy Notice.

References

Visible links
1. https://www.gov.uk/government/organisati...

Dear Ms Persson,

Thank you for your request for information, which was received on 14
December 2018.

You asked the following:

Thank you for your reply to this FOI request, received 16 November 2018
and fulfiled on December 14, 2018. This is linked, but I understand that
it will be treated as a separate FOI request.

Subsequent to the agreements provided, and related only to data processing
by FFT, please can you provide any other agreement(s) which were in effect
for the same organisation and their affiliates, for any time period in
2016, 2017 and 2018.

This should in particular be with regard to information that indicates

a) further or different types of processing purposes, not those in the
information in the agreement already provided, this may include but not
only limited to an agreement to processing for the purposes of risk
scoring and profiling, and data creation by FFT

b) transfer or change in the role of Data Controller.

c) onward data sharing or agreements with regard to their position as a
data recipient from others, (such as being a recipient of pupil data which
has been processed by the DfE, first given to another third-party such as
RM Education (indicative for explanatory purposes)) and passed on to the
FFT)

d) whether or not FFT has been provided any data by DfE that refer to the
reasons for exclusion in the AP census, which were collected for the first
time in the January AP Census 2018.

I have dealt with your request under the Freedom of Information Act 2000
(“the Act”).

The Department holds some of the information you have requested. However,
the Department estimates that the cost of complying with your request
would exceed the cost threshold applicable to central Government. This is
£600 and represents the estimated cost of one person spending 3½ working
days locating, retrieving and extracting the information.

However, if you were to make a new request for a narrower category of
information, the Department may be able to comply with your request within
the cost limit, although I cannot guarantee that this will be the case.
Providing copies of all current valid licensing agreements, and related
only to data processing by FFT, which were received and processed in
effect for the same organisation and their affiliates, for any time period
in 2016, 2017 and 2018 would be manageable and within the cost threshold.

However, providing copies of all licensing agreements held between the DfE
and organisations, related only to data processing by FFT, which were in
effect for the time period specified, would impact the cost threshold due
to the number of cases in question.

If you are unhappy with the way your request has been handled, you should
make a complaint to the Department by writing to me within two calendar
months of the date of this letter. Your complaint will be considered by an
independent review panel, who were not involved in the original
consideration of your request.

If you are not content with the outcome of your complaint to the
Department, you may then contact the Information Commissioner’s Office.

Yours sincerely,

Samantha Morrison

Department for Education

Dear Ms Persson,

REF: 2018-0045200

With regards to your freedom of information request (reference
2018-0045200), where the Department committed to making available DPIAs
for the National Pupil Database and Alternative Provision Census during
the first quarter of 2019, this note is to inform you of a slight delay in
the ability of the Department to make these available.

We expect to make these documents available as soon as practically
possible due to other pressing priorities facing the civil service at this
point in time. We will ensure you are contacted directly as soon as these
documents become available.

Regards

Gary connell

Head of External Data Sharing & National Pupil Database (NPD)

Data Directorate | Operations Group

You asked the following:

Under the FOI Act 2000, please provide copies of:

show quoted sections

Dear Ms Persson

FOI reference: 2018-0045200

I refer to your request for information, which was received on 19 November
2018.

“You requested: a copy of any Data Protection Impact Assessment carried
out with regards to any national collection of children’s personal data
and (a) the AP Census, and (b) the National Pupil Database, including but
not only the data now available through external DfE data shares since
March 2012.”

I have dealt with your request under the Freedom of Information Act 2000.

The department holds public summaries of Data Protection Impact
Assessments for the two areas requested. A copy of the information
requested is enclosed.

The information supplied to you continues to be protected by copyright.
You are free to use it for your own purposes, including for private study
and non-commercial research, and for any other purpose authorised by an
exception in current copyright law. Documents (except photographs) can be
also used in the UK without requiring permission for the purposes of news
reporting. Any other re-use, for example commercial publication, would
require the permission of the copyright holder.

Most documents produced by a government department or agency will be
protected by Crown Copyright. Most Crown copyright information can be
re-used under the Open Government Licence
([1]http://www.nationalarchives.gov.uk/doc/o...). For
information about the OGL and about re-using Crown Copyright information
please see The National Archives website
-[2]http://www.nationalarchives.gov.uk/infor...
.

Copyright in other documents may rest with a third party. For information
about obtaining permission from a third party see the Intellectual
Property Office’s website at [3]www.ipo.gov.uk.

If you have any queries about this letter, please contact me. Please
remember to quote the reference number above in any future communications.

If you are unhappy with the way your request has been handled, you should
make a complaint to the Department by writing to me within two calendar
months of the date of this letter.  Your complaint will be considered by
an independent review panel, who were not involved in the original
consideration of your request. 

If you are not content with the outcome of your complaint to the
Department, you may then contact the Information Commissioner’s Office. 

Yours sincerely

Gideon Ovadia | Executive Officer,

References

Visible links
1. http://www.nationalarchives.gov.uk/doc/o... blocked::http://www.nationalarchives.gov.uk/doc/o...
http://www.nationalarchives.gov.uk/doc/o...
2. http://www.nationalarchives.gov.uk/infor... blocked::http://www.nationalarchives.gov.uk/infor...
http://www.nationalarchives.gov.uk/infor...
3. http://www.ipo.gov.uk/ blocked::http://www.ipo.gov.uk/
http://www.ipo.gov.uk/