The Department for Education (DfE) has refused to release the full report of a damning audit that found it broke the law in its handling of pupil data – claiming it “may distract” from plans to collate even more information on children.
In 2020, an audit by the Information Commissioner’s Office (ICO) found the DfE failed to meet several articles of the general data protection regulations (GDPR), which govern the management and use of data across Europe.
The investigation, prompted by concerns about the national pupil database and a revelation that gambling firms accessed children’s data, found that data protection “was not being prioritised” at the DfE.
However, the DfE has only ever published a summary of the report.
In 2021, the DfE refused a freedom of information request from Schools Week requesting the full report.
It argued it was “currently in the process of responding to the audit recommendations”, and said ministers and officials “need space in which to develop their thinking”.
The DfE also refused the request on the grounds that the information was “due to be published in the future”. But it never materialised.
In an update in June, the DfE said its information security action in response to the audit “will now be closed and future work will be undertaken as ‘business as usual’ and will be monitored accordingly”.
‘Disproportionate focus’ on ‘past failings’
The digital rights organisation Defend Digital Me requested the full report again in July, given the DfE’s work was complete.
But the DfE has again refused. The department said publishing the full report could now “lead to a disproportionate focus on past failings that have since been addressed to the satisfaction of the ICO”.
It added publication “may distract from the department’s current priorities, particularly the progression of the children’s wellbeing and schools bill”.
The bill will, among other things, create a national register of children not in school for the first time, adding even more data on children to the DfE’s vast information vaults.
Defend Digital Me director Jen Persson said: “The DfE already holds detailed statistics on every home-educated child local authorities track, but now wants their names and vast amounts more detail too – yet is refusing to be open about how well it handles the data it already has”.
She also questioned how “public access to a past audit about data protection policy [could] reasonably prejudice a new and unrelated law today.
“If it does, this underlines the importance of the contents being made public. And as it affects over 28 million people in England, how can it be in the public interest to keep secret indefinitely while the government is allowed to carry on ‘business as usual’?”
The DfE was approached for comment.
