To quote the late Aaron Swartz: “It’s not OK to not understand the internet, anymore.”
Parents and guardians are trying their best.We leave work early and hurry to attend meetings on internet safety. We get told how vital it is that children not give away their name, age or address to strangers on social media. We read the magazines that come home in book bags about sharing their identity with players in interactive games. We may sign school policies to opt out of permission for sharing photos from school performances on the school website.
And yet most guardians appear unaware that our children’s confidential, sensitive and basic personal data are being handed out to third parties by the Department of Education, without our knowledge or clear and accessible public accountability.
Data are extracted by the Department for Education [DfE] from schools, stored in a National Pupil Database [NPD], and onwardly shared.
Fine you may say. That makes sense, it’s the Department for Education.
But did you expect that the Ministry of Defence or Schools comparison websites may request or get given access to our children’s individual records, the data [detailed in the ‘NPD data tables’] that we provide to schools for routine administration?
School heads, governors, and every parent I have spoken with in my area, are totally unaware that data extracted by the Department of Education are used in this way.
All are surprised.
Some are shocked at the extent of data sharing at such an identifiable and sensitive level, without school and parental knowledge.
The DfE manages the NPD and holds responsibility to ensure we know all about it. But they’re not ensuring that pupils and parents are told before the data extraction, who else gets access to it and for what purposes. That fails to process data fairly which is a requirement to make its use lawful.
There’s no way to opt out, to check its accuracy or recourse for anything incorrect.
As our lives involve the ever more advanced connectivity of devices, systems, and services, that’s simply not good enough. It’s not a system fit for the 21st century or our children’s digital future.
While the majority of requestors seem to access data for bona fide research in the public interest, some use it for bench marking, others are commercial users.
Is that what pupils and parents expect their data are used for?
And what happens in future when, not if, the Department chooses to change who uses it and why.
How will we know about that? Because it has done so already.
When school census data first began, it extracted no names. That changed. Every pupil’s name is now recorded along with a growing range of information.
Where it began with schools, it is now extended to nursery schools; childminders, private nurseries and playgroups.
Where it was once used only for state administrative purposes, since 2012 it has been given to third parties.
What’s next?
Data should be used in the public interest and must be shared to adequately administer, best serve, understand, and sometimes protect our children.
I want to see our children’s use of technology, and their data created in schools used well in research that will enable inclusive, measurable benefits in education and well being.
However this can only be done with proper application of law, future-proofed security, and respectful recognition of public opinion.
The next academic year must bring these systems into the 21st century to safeguard both our children and the benefits that using data wisely can bring.
Out of sight, out of date, out of touch?
The data sharing is made possible through a so-called ‘legal gateway’, law that gives permission to the Secretary of State for Education to require data from schools.
In this case, it is founded on legislation almost twenty years old.
Law founded in the 1996 Education Act and other later regulations changed in 2009 give information-sharing powers to the Secretary of State and to public bodies through law pre-dating wide use of the Internet, social media, and the machine learning and computer processing power of today.
Current law and policies have not kept pace with modern technology. 2015 is a world away even from 2009 when Pluto was still a planet.
Our children’s data is valuable, and gives insights into society that researchers should of course use to learn from and make policy recommendations. That has widespread public support in the public interest. But it has to be done in an appropriate and secure way, and as soon as it’s for commercial use. there are more concerns and questions to ask.
As an example why NPD doesn’t do this as I feel it should, the data are still given away to users in their own offices rather than properly and securely accessed in a safe-setting, as bona fide accredited researchers at the Office of National Statistics do.
In addition to leaving our children’s personal data vulnerable to cybersecurity threats, it actively invites greater exposure to human error.
Remember those HMRC child benefit discs lost in the post with personal and bank data of 25 million individuals?
Harder to do if you only access sensitive data in a safe setting where you can walk out with your research but not raw files.
When biometrics data are already widely used in schools and are quite literally, our children’s passport to the world, poor data management approaches from government in health and education are simply not good enough anymore.
It’s not OK anymore.
Our children’s personal data is too valuable to lose control of as their digital footprint will become not an add-on, but integral to everything they do in future.
Guardians do their best to bring up children as digitally responsible citizens and that must be supported, not undermined by state practices.
Children will see the divide between online and ‘real’-life activities blend ever more seamlessly.
We cannot predict how their digital identity will become used in their adult lives.
If people don’t know users have data about them, how can we be sure they are using it properly for only the right reasons or try and repair damage when they have not?
People decide to withhold identities or data online if they don’t trust how they will be used, and who will use it well.
Research, reports and decision making are flawed if data quality is poor. That is not in the public interest.
The government must at least take responsibility for current policies to ensure our children’s rights are met in practice.
People who say data privacy does not matter, seem to lack any vision of its value.
Did you think that a social media site would ever try to control its users emotions and influence their decision-making based on the data they entered or read? It just did.
Did you foresee five years ago that a fingerprint could unlock your phone? It just did.
Did you believe 5 months ago the same fingerprint accessible phone would become an accepted payment card in England? It just did.
There is often a correlation between verification of identity and payment.
Fingerprinting for payment and library management has become common in UK schools and many parents do not know that parental consent is a legal requirement.
In reality, it’s not always enacted by schools.
Guardians can find non-participation is discouraged and worry their child will be stigmatised as the exception.
Yet no one would seriously consider asking guardians to give canteens their bank card PIN.
The broad points of use where data are created and shared about our children mean parents can often not know who knows what about them.
What will that mean for them as adults much of whose lives will be digital?
What free choice remains for people who want to be cautious with their digital identities?
Many systems increasingly require registration, some including biometric data, sometimes from vulnerable people, and the service on offer is otherwise denied.
Is that OK anymore? Or is denial-of-service a form of coercion?
The current model of state data sharing often totally ignores that the children and young people whose personal data are held in these systems are not asked, informed or consulted about changes.
While Ministers talk about wanting our children to become digital leaders of tomorrow, policies of today promote future adults ill-educated in their own internet safety and personal data sharing practices.
But it’s not OK not to understand the internet anymore.
Where is the voice of our young people talking about who shares their information, how it is used online, and why?
When shall we stop to ask collectively, how personal is too personal?
Is analysing the exact onscreen eye movement of a child appropriate or invasive?
These deeply personal uses of our young people’s information raise ethical questions about others’ influence over their decision making.
Where do we draw the line?
Where will we say, it’s not OK anymore?
Do we trust that all uses are for bona fide reasons and not ask to find out why?
Using our children’s data across a range of practices in education seem a free for all to commercially exploit, with too little oversight and no visibility of decision making processes for the public,whose personal data they profit from.
Who has oversight for the ethical use of listening software tools in classrooms, especially if used to support government initiatives like Channel in ‘Prevent’?
What corrective action is taken if our children’s data are exposed through software brought into school over which parents have no control?
The policies and tools used to manage our children’s data in and outside schools seem often out of step with current best-in-class data protection and security practices.
Pupils and parents find it hard to track who has their personal data and why.
While the Department for Education says what it expects of others, it appears less committed to meeting its own responsibilities: “We have been clear that schools are expected to ensure that sensitive pupil information is held securely. The Data Protection Act of 1998 is clear what standards schools are expected to adhere to and we provide guidance on this.”
A post on a webpage is hardly guidance fit to future proof the data and digital identities of a whole generation.
I believe we should encourage greater use of this administrative data for bona fide research. Promoting broader use of aggregated and open data could also be beneficial. In order to do both, key things should happen that will make researchers less risk averse in its use, and put data at reduced risk of accidental or deliberate misuse by other third parties. Parents and pupils could become more confident that their data is used for all the right reasons.
The frameworks of fair processing, physical data security, of transparent governance and publicly accountable oversight need redesigned and strengthened.
Not only for data collection, but its central management, especially on a scale as large as the National Pupil Database.
“It’s not OK not to understand the internet anymore.”
In fact, it never was.
The next academic year must bring these systems into the 21st century to safeguard both our children and the benefits that using data wisely can bring.
The Department for Education “must try harder” and must start now.
********
If you have questions or concerns about the National Pupil Database or your own experience, or your child’s data used in schools, please feel free to get in touch, and let’s see if we can make this better. [Email me as listed above right.]
1. An overview: an end of year report on our Children’s School Records
2. The National Pupil Database end of year report: an F in fair processing
3. The National Pupil Database end of year report: a D in transparency, C- in security
********
References:
[1] The National Pupil Database user guide: https://www.gov.uk/government/uploads/system/uploads/attachment_data/file/261189/NPD_User_Guide.pdf
[2] Data tables to see the individual level data items stored and shared (by tabs on the bottom of the file) https://www.gov.uk/government/publications/national-pupil-database-user-guide-andsupporting-information
[3] The table to show who has applied for and received data and for what purpose https://www.gov.uk/government/publications/national-pupil-database-requests-received
[4] Data Trust Deficit – from the RSS: http://www.statslife.org.uk/news/1672-new-rss-research-finds-data-trust-deficit-with-lessons-for-policymakers
[5] Talk by Phil Booth and Terri Dowty: http://www.infiniteideasmachine.com/2013/04/terris-and-my-talk-on-the-national-pupil-database-at-the-open-data-institute/
[6] On 1 September 2013 sections 26 and 27 of the Protection of Freedoms Act 2012 came into force, requiring schools to seek parental consent before collecting biometric data, such as fingerprints.