Department for Education flouted rules when it secretly shared pupil data with Home Office, says watchdog

The Department for Education (DfE) flouted data protection obligations when it shared information about children with the Home Office for immigration enforcement purposes, a watchdog had said.

It had failed to comply with data protection laws when it began collecting information on pupil’s nationality and country of birth in 2016, the Information Commissioner’s Office (ICO) said

The watchdog said in a letter to to human rights organisation Liberty, that it was now considering whether to take further action against the DfE after identifying “wide ranging and serious concerns”.

It came in response to a complaint by Against Borders for Children (ABC) - represented by Liberty – which argued the DfE had made schools complicit in the hostile environment by sharing children’s addresses with immigration enforcement.

Calling for the practice to be brought to "immediate end", the ICO warned many parents were afraid to send their children to school and argued that the practices violated children’s fundamental human right to privacy.

It has now ​upheld ABC's complaint that the DfE breached data protection laws because parents and children did not know what would be done with their data when it was collected.

“Many parents and pupils are either entirely unaware of the school census and the inclusion of that information in the National Pupil Database (NPD), or are not aware of the nuances within the data collection, such as which data is compulsory and which is optional,” Elizabeth Denham, the information commissioner, wrote.

“This has raised concerns about the adequacy DfE’s privacy notices and their accountability for the provision of such information to individuals regarding the processing of personal data for which they are ultimately data controllers.”

The letter adds that the DfE is “failing to comply fully” with the General Data Protection Regulation (GDPR).

There were “clear deficiencies in the processing of pupil personal data by the DfE […] primarily in the areas of transparency and accountability, where there are far reaching issues, impacting a huge number of individuals in a variety of ways”, it says, adding that the “wide ranging and serious concerns” would be formally considered for further action.

Under a memorandum of understanding signed in June 2015, the DfE agreed to give the personal details of up to 1,500 schoolchildren to the Home Office each month to “create a hostile environment” for migrants.

In 2016 the DfE required schools to start collecting children’s nationality and country of birth data.

This resulted in a mass boycott by parents who refused to provide the data amid concerns it might be used for immigration enforcement.

In April 2018, following legal action brought by ABC and a boycott in which 200,000 families took part, the DfE announced it would no longer ask schools to collect nationality and country of birth data through the school census.

But Liberty said the department had refused to delete nationality and country of birth information that has been collected on millions of children since September 2016 and that it continued to share children’s addresses with the Home Office for immigration enforcement purposes without the informed consent of their parents or pupils.​

The group called for firewalls across all public services to ensure they are “permanently separated” from immigration enforcement and it urged the DfE to delete all children’s nationality and country of birth data collected “immediately”.

Lara ten Caten, lawyer at Liberty, accused the DfE of making schools “unknowingly and unwittingly complicit in the government’s hostile environment”.

She said it was “shameful” that children’s data was being used to aide attempts to deport their parents.

She added: “Public services must be permanently separated from immigration enforcement, which is why Liberty is demanding firewalls across not just the education system, but across all essential public services. The DfE must also delete all children’s nationality and country of birth data collected immediately.”

Kojo Kyerewaa, Against Borders for Children co-ordinator, said schools had been "covertly incorporated" as part of Home Office immigration enforcement "without public debate or clear notification".

He added: “These checks have put vulnerable children in further danger as parents are taken away via immigration detention and forced removals. The DfE should be ensuring every child access to education - not implementing policy to deter access to some of society's most vulnerable children."

The DfE said they were unable to respond because of general election purdah constraints, but referred to answers to earlier parliamentary questions which said the department collected data on the nationality and country of birth of pupils via the school census between autumn 2016 and summer 2018.