Pupil data: application, approvals and oversight process

The request was successful.

Dear Department for Education,
I request the following under the Freedom of Information Act 2000. Please provide the following as was available on 22 July 2015.

With reference to all national level databases containing pupil level data - such as the National Pupil Database and/or School Level Database where any responsibility for them is held by DfE.

With reference to the two application review panels mentioned in https://www.gov.uk/national-pupil-databa...) - the Data Management Advisory Panel (Tier 1) and the NPD Data Request team. (Tiers 2,3,4) Where I refer below to panel(s), please include both.

Please provide the following each as an electronic document (such as word, an original pdf file) for each national database/-set and its relevant approvals panel (if the same document applies to more than one data store, please provide it only once and please indicate to which data and which data oversight panel each file provided refers.)

I expect this to be a straightforward gathering of a total of max. 7 documents, however if the information is not available in a readily structured document format, please provide the information as you have it available. Please do not let anything which is not available interfere with the provision of other items that are.

1. Approvals panel(s) Terms of Reference (TOR). (This should include a) the membership, b) accountability i.e. to whom the panel(s) reports, c) the meeting arrangements of the panel(s) including any known forward looking meeting dates and d) the file listing how and where the minuted decision making for all applications is to be documented and/or published. (As for example done by DAAG http://www.hscic.gov.uk/article/2192/Arc... and http://www.hscic.gov.uk/daag or similar to parts of http://adrn.ac.uk/media/279009/adrn014-a...))

2. Panel(s) structure and formation process. (If not already included in the TOR (ref Q1.) Please detail panel(s) a) membership (ratio of expert/lay members, quorate, b) selection process and position length, as well as c) the panels’ names/org /titles. d) And further any permanent document listing, or the documented process to record for each meeting, any conflicts of interest - such as in http://www.hscic.gov.uk/media/17776/draf... or https://adrn.ac.uk/using-the-network/app...)

3. Ethics process documentation. This file should be the document devoted to or referencing in part the ethical review process which a) applicants should follow, and/or b) used by the DMAP and/or NPD Data Request Team panel(s) during the application review to aid decision making.

4. Privacy impact assessment /checklist (For but not exclusive to Tier 1 requests, used by the panel or applicant as provided in the DfE/NPD process during applications’ review)

5. Research applicants' purposes' merit assessment criteria. (Used by the panel during the applications’ review for but not exclusive to Tier 1 requests, similar to http://www.esrc.ac.uk/_images/framework-...)
I refer to the 2012 consultation document and regulations that widened purposes: "‘producing statistics’ where this is ‘for the purpose of promoting the education or well-being of children’" or "conducting research into the educational achievements of pupils and who require individual pupil information for that purpose'" and the Education (Individual Pupil Information) (Prescribed Persons) (England) Regulations 2009.

6. The document which tracks any benefits achieved through release of the data.

7. A list of any audits carried out since December 2012 of organisations or individuals that have been data recipients, the date of audit, its purpose, and how it was performed. (If readily available any findings as well, but omit if time does not permit.)

Thank you for your consideration.
Regards,

Jen Persson

Department for Education

Dear Ms Persson

Thank you for your recent enquiry. A reply will be sent to you as soon as possible. For information; the departmental standard for correspondence received is that responses should be sent within 20 working days as you are requesting information under the Freedom of Information Act 2000. Your correspondence has been allocated reference number 2015-0034755.

Thank you

Department for Education
Ministerial and Public Communications Division
Tel: 0370 000 2288

show quoted sections

Department for Education

3 Attachments

Dear Ms Persson,
Thank you for your freedom of information request, which was received on 23rd July 2015. Your request is given in Annex A (attached). I have dealt with your request under the Freedom of Information Act 2000 (“the Act”). A copy of the information which can be disclosed is included in this reply.
Please be assured that the department will only disclose pupils’ and/or children’s personal information where the law allows us to, and in compliance with the Data Protection Act 1998<http://www.legislation.gov.uk/ukpga/1998...>. There is specific legislation which allows the department to share individual pupil data from the NPD with persons named in the Education (Individual Pupil Information) (Prescribed Persons) (England) Regulations 2009 (Amended)<http://www.legislation.gov.uk/uksi/2009/...>. This includes schools, local authorities, other government departments and agencies. These regulations also allow the department to disclose individual pupil data, subject to the Data Protection Act 1998<http://www.legislation.gov.uk/ukpga/1998...>, to persons who, for the purpose of promoting the education or well-being of children in England are:

· Conducting research or analysis;

· Producing statistics; or

· Providing information, advice or guidance.
To request extracts of the NPD a requestor must complete the NPD data request application form<https://www.gov.uk/government/publicatio...> and Information security questionnaire<https://www.gov.uk/government/publicatio...>. Decisions on whether data can be released are subject to a robust approval process and are based on a detailed assessment of who is requesting the data, the purpose for which it is required, the level and sensitivity of data requested and the arrangements in place to store and handle the data.
The data variables held in the NPD are organised into 4 tiers, depending on sensitivity, with tier 1 being the most sensitive. All data requests are assessed by the NPD data request team against the above criteria. In addition, requests which include tier 1 variables are also assessed, and the final decision made, by the Data Management Approvals Panel (DMAP) as appropriate.
As requested I attach the DMAP Terms of Reference (ToR) – see Annex B (attached), with a small number of redactions where we have applied section 40(2) (personal data), this is because the information in question includes personal data. Personal data is that which relates to a living individual who can be identified from that data, or from that data and other information which is likely to be in, or to come into, the possession of the requestor. Disclosure of this information would contravene a number of the data protection principles in the Data Protection Act 1998, and would be regarded as ‘unfair’. By that, we mean the likely expectations of the data subject that his or her information would not be disclosed to others and the effect which disclosure would have on the data subject. Section 40(2) is an absolute exemption and is not subject to the public interest test. The ToR details the panel membership; they are DfE senior personnel who have been selected due to their role in the department concerning data analysis, data sharing and data security. The time served on the panel by the current members ranges from 5 months to 22 months.
DMAP meets on a monthly basis, the exact date being subject to availability – the next is currently scheduled for 2nd September. Any issues that need to be escalated above DMAP will initially be reported the Director of the Data Education Standards Accountability Group with a further escalation route to the Secretary of State if necessary. The Data Requests Team completes a DMAP template for all requests put before the panel, which are then discussed in the meeting. Comments from this discussion and the decision of the panel are then recorded in the relevant template. These completed templates are not made publically available but a copy of this template is included for information – see Annex C (attached).
The Department publishes a list of external NPD requests received since April 2012. This includes the organisations that submitted the request, the project aims under which the data has been requested and an indicator as to which requests had been approved and which had been rejected. This information is published on the NPD website here: https://www.gov.uk/government/publicatio...
The ICO’s code of practice explains the privacy issues that organisations should consider when planning projects that use personal information. We do not have a separate ethics committee or conduct a PIA for each request but when assessing each request we take into account what the applicant states about the ethics process they have been through for their proposed work and the applicant must state that they have ensured their intended use is DPA compliant. The requestor must inform us if they intend to publish anonymised results of their analysis (we refuse any request to publish named data) so that we can assess these results prior to publication to ensure that data confidentiality is not being compromised. We do not record the assessment and outcome in a central location and we are not able to track subsequently the benefit of the release of data as standard practice. The information security questionnaire allows us to review the requestor’s data security arrangements - we assess and score this questionnaire and will not share data if we have concerns. We reserve the right in our terms and conditions to audit the Requester’s compliance with its responsibilities under the Agreement in respect of technical and organisational security measures to further verify their arrangements; however, we have not needed to exercise this power to date.
The information supplied to you continues to be protected by copyright. You are free to use it for your own purposes, including for private study and non-commercial research, and for any other purpose authorised by an exception in current copyright law. Documents (except photographs) can be also used in the UK without requiring permission for the purposes of news reporting. Any other re-use, for example commercial publication, would require the permission of the copyright holder.

Most documents produced by a government department or agency will be protected by Crown Copyright. Most Crown copyright information can be re-used under the Open Government Licence (http://www.nationalarchives.gov.uk/doc/o...). For information about the OGL and about re-using Crown Copyright information please see The National Archives website -http://www.nationalarchives.gov.uk/infor... .
Copyright in other documents may rest with a third party. For information about obtaining permission from a third party see the Intellectual Property Office’s website at www.ipo.gov.uk<http://www.ipo.gov.uk/>.
If you have any queries regarding this response please contact me – if you could please quote the reference number above in such communications.
If you are unhappy with the way your request has been handled, you should make a complaint to the Department by writing to me within two calendar months of the date of this letter. Your complaint will be considered by an independent review panel, who were not involved in the original consideration of your request.
If you are not content with the outcome of your complaint to the Department, you may then contact the Information Commissioner’s Office.
Yours sincerely,
Dr Richard Lumley
Department for Education

show quoted sections

Dear Department for Education,
thank you for your response, which I appreciate in the 20 day period that closes today.
Please can I ask for the following clarifications about some of the materials not provided:

Point 1: Missing - please provide TOR document(s) for the NPD data requests group (tiers 2-4) not only DMAP (tier 1) as done.
Point 2: Missing - please provide the structural governance and oversight details for the NPD data requests group (tiers 2-4) (only provided for DMAP)
Point 3: You did not provide because there is no standard criteria to measure the ethics' score of data releases.
Point 4: Missing - please provide the "self checklist" as listed on the DMAP application file you provided as you did not otherwise provide any privacy impact assessment
Point 5: You did not provide because there is no criteria to determine an applicant's standard against 'research' purposes.
Point 6: You did not provide because there is no tracking of benefits or follow up to data releases.
Point 7: You did not provide, because there have been zero audits to date of NPD recipients.

Further, having read the legislation to which you refer, please can you confirm to me the clauses that you reference specifically in your response, regards purposes, for example " for the promotion of well being or education of children.." as having read both I cannot find these references and wish to be sure I reference your comments accurately and precisely.

Thank you for your time and support.
Sincerely,
Jen Persson

Department for Education

Dear Ms Persson

Thank you for your recent enquiry. A reply will be sent to you as soon as possible. For information; the departmental standard for correspondence received is that responses should be sent within 20 working days as you are requesting information under the Freedom of Information Act 2000. Your correspondence has been allocated reference number 2015-0038190.

Thank you

Department for Education
Ministerial and Public Communications Division
Tel: 0370 000 2288

show quoted sections

Dear Department for Education,
Thank you for your reply - please can you confirm however that you are responding to the clarifications of missing data from the original FOI request (our correspondence has been allocated reference number 2015-0034755.) This is not a new FOI request and as such should not be allocated any new FOI number, nor does a new response time of 20 days begin.

I asked for no new information further to my request of July 23rd, for which the due date is today, August 21st. I just want to receive the items which were not supplied in response, or that you clarify the reason that they were not provided (if for example they do not exist.)

Thank you again.
Yours faithfully,

Jen Persson

Department for Education

1 Attachment

Dear Ms Persson,

Thank you for the follow-up to your freedom of information request, which
was received on 21^st August 2015. It has again been necessary to deal
with your follow-up request under the Freedom of Information Act 2000
(“the Act”). You asked for the following clarifications about some of the
materials not provided in the previous response (Ref: 2015-0034755):

Point 1: Missing - please provide TOR document(s) for the NPD data
requests group (tiers 2-4) not only DMAP (tier 1) as done.

 

There is not a separate panel to discuss Tier 2-4 requests and so we do
not have a TOR document covering these requests. The NPD data requests
team assess these requests and ensure the data sharing satisfies the
legislation, is DPA compliant, and that there are sufficient data security
arrangements in place consulting with department legal advisors and data
security unit as required. Should the NPD Data request team have any
issues of concern, these are escalated to DMAP.

 

Point 2:  Missing - please provide the structural governance and oversight
details for the NPD data requests group (tiers 2-4) (only provided for
DMAP)

 

As above, there is not a separate panel to discuss Tier 2-4 requests and
so we do not have separate structural governance and oversight documents
covering these requests.

 

Point 3:  You did not provide because there is no standard criteria to
measure the ethics' score of data releases.

 

There is no ethics process documentation because, as previously stated, we
do not have a separate ethics committee to assess data releases. However,
as previously stated, when assessing each request we consider the ethics
of the data sharing and take into account what the applicant states about
the ethics process they have been through.

Point 4: Missing - please provide the "self checklist" as listed on the
DMAP application file you provided as you did not otherwise provide any
privacy impact assessment

 

We are not sure what you are referring to here as there is no
“self-checklist” mentioned in the DMAP template that was provided. When we
assess requests we check that the data sharing satisfies the legislation,
is DPA compliant, and that there are sufficient data security arrangements
in place. Annex C in the DMAP TOR also lists the approvals process and the
activities that are undertaken when requests are processed. In addition to
this the requestor themselves are also confirming that they satisfy the
necessary conditions when they sign up to our terms and conditions.

 

Point 5: You did not provide because there is no criteria to determine an
applicant's standard against 'research' purposes.

 

As previously stated, the Department will only disclose pupils’ and/or
children’s personal information where the law allows us to, and in
compliance with the Data Protection Act 1998 and where we are assured the
requestor has a secure system to protect this data. When assessing an
application the NPD data team will ensure this is the case, which may
include an assessment as to whether the research is for the purpose of
promoting the education or well-being of children in England. However, we
do not have a separate document listing these criteria.

 

Point 6: You did not provide because there is no tracking of benefits or
follow up to data releases.

 

We do not have a central log of external publications using NPD data and
do not routinely track the subsequent benefits achieved through release of
NPD data by researchers as standard practice.

 

Point 7: You did not provide, because there have been zero audits to date
of NPD recipients.

 

As previously stated, we reserve the right in our terms and conditions to
audit the Requester’s compliance with its responsibilities under the
Agreement in respect of technical and organisational security measures to
further verify their arrangements; however, we have not needed to exercise
this power to date. We therefore cannot supply you with such a list.

 

Further, having read the legislation to which you refer, please can you
confirm to me the clauses that you reference specifically in your
response, regards purposes, for example " for the promotion of well being
or education of children.."  as having read both I cannot find these
references and wish to be sure I reference your comments accurately and
precisely.

 

The Department for Education has specific legal powers to collect pupil,
child and workforce data held by schools, local authorities and awarding
bodies. under [1]section 114 of the Education Act 2005, [2]section 537A of
the Education Act 1996, and [3]section 83 of the Children Act 1989.

The department will only disclose pupils’ and/or children’s personal
information where legislation allows it to do so, and it is in compliance
with the [4]Data Protection Act 1998. There is specific legislation which
allows the department to share individual pupil data from the NPD with
persons named in the [5]Education (Individual Pupil Information)
(Prescribed Persons) (England) Regulations 2009 (Amended).  This includes
schools, local authorities, other government departments and agencies.
These regulations also allow the department to disclose individual pupil
data, subject to the [6]Data Protection Act 1998, to persons who, for the
purpose of promoting the education or well-being of children in England
are:

·         Conducting research or analysis;

·         Producing statistics; or

·         Providing information, advice or guidance.

The [7]Education (Individual Pupil Information) (Prescribed Persons)
(England) Regulations 2009 (Amended) legislation was amended in [8]2010
and again in [9]2013. Specifically, Section 3(6)(d) was amended in 2013.
Originally Section 3(6)(d) read as follows:

 

persons conducting research into the educational achievements of pupils
and who require individual pupil information for that purpose;

 

However, this was amended in 2013 to read:

 

persons who, for the purpose of promoting the education or well-being of
children in England are—

(i) conducting research or analysis,

(ii) producing statistics, or

(iii) providing information, advice or guidance,

and who require individual pupil information for that purpose.

 

For the purposes of these Regulations, ‘well-being’ has the meaning
referred to in sections 332E and 507B of the Education Act 1996 in
relation to those sections. Section 332E was inserted by section 1 of the
Special Educational Needs (Information) Act [10]2008 (c.11) and section
507B was inserted by section 6(1) of the Education and Inspections
Act [11]2006 (c.40).

 

The information supplied to you continues to be protected by copyright.
You are free to use it for your own purposes, including for private study
and non-commercial research, and for any other purpose authorised by an
exception in current copyright law. Documents (except photographs) can be
also used in the UK without requiring permission for the purposes of news
reporting. Any other re-use, for example commercial publication, would
require the permission of the copyright holder.

Most documents produced by a government department or agency will be
protected by Crown Copyright. Most Crown copyright information can be
re-used under the Open Government Licence
([12]http://www.nationalarchives.gov.uk/doc/o...). For
information about the OGL and about re-using Crown Copyright information
please see The National Archives website
-[13]http://www.nationalarchives.gov.uk/infor...
.

Copyright in other documents may rest with a third party. For information
about obtaining permission from a third party see the Intellectual
Property Office’s website at [14]www.ipo.gov.uk.

If you are unhappy with the way your request has been handled, you should
make a complaint to the Department by writing to me within two calendar
months of the date of this letter.  Your complaint will be considered by
an independent review panel, who were not involved in the original
consideration of your request.  

If you are not content with the outcome of your complaint to the
Department, you may then contact the Information Commissioner’s Office.

Yours sincerely,

Martin Johnson

 

[15]cid:image001.png@01CF42B9.584566C0

 

 

show quoted sections

Communications via the GSi may be automatically logged, monitored and/or
recorded for legal purposes.

References

Visible links
1. http://www.legislation.gov.uk/ukpga/2005...
2. http://www.legislation.gov.uk/ukpga/1996...
3. http://www.legislation.gov.uk/ukpga/1989...
4. http://www.legislation.gov.uk/ukpga/1998...
5. http://www.legislation.gov.uk/uksi/2009/...
6. http://www.legislation.gov.uk/ukpga/1998...
7. http://www.legislation.gov.uk/uksi/2009/...
8. http://www.legislation.gov.uk/uksi/2010/...
9. http://www.legislation.gov.uk/uksi/2013/...
10. Go to item of legislation
http://www.legislation.gov.uk/id/ukpga/2...
11. Go to item of legislation
http://www.legislation.gov.uk/id/ukpga/2...
12. http://www.nationalarchives.gov.uk/doc/o... blocked::http://www.nationalarchives.gov.uk/doc/o...
http://www.nationalarchives.gov.uk/doc/o...
13. http://www.nationalarchives.gov.uk/infor... blocked::http://www.nationalarchives.gov.uk/infor...
http://www.nationalarchives.gov.uk/infor...
14. http://www.ipo.gov.uk/ blocked::http://www.ipo.gov.uk/
http://www.ipo.gov.uk/

Dear Department for Education FOI Officer / Mr. Johnson,

thank you for the clarifications of this request. The links you provided to the legislation are useful.

Your layout in the reply with explanations broken into sections, and not in large blocks of text, was very helpful and appreciated.

Yours faithfully,
Jen Persson