Written evidence submitted by Defend Digital Me

This submission is made in my capacity as Director of Defend Digital Me. Defend Digital Me is a not-for-profit NGO and call to action to protect children’s rights to privacy founded in 2016. We are teachers and parents who campaign for safe, fair and transparent data processing in education, in England, and beyond. Between 2018 and 2020 I was an expert for the Council of Europe’s Data Protection Committee on Convention 108 to support the drafting of the Data Protection Guidelines for Educational Settings, adopted in 2020. I am currently a member of the Council of Europe’s Working Group on Education and Artificial Intelligence.

Data is of significant relevance to this enquiry to understand “the issue of persistent and severe absence in schools”. This response sets out evidence relating to (persistent) absence data at the Department for Education (“DfE”) under the six headings:

  1. Questions for the DfE on its new national attendance tracking programme
  2. Definitions of “absence” data and its measurement changes over time
  3. Changes to national attendance and absence data collection process in 2022
  4. DfE refusal to comply with an Information Commissioner request to stop the new national pupil attendance / absence data collection
  5. The impact on children’s data rights of the DfE reforms to attendance surveillance
  6. References and appendix tables of attendance /absence codes (pages 5-8)

1. Summary questions for the DfE on its new national attendance tracking practices

1.1 For what purpose the DfE is receiving and profiling the daily attendance data of every named school child (nearly 9 million) in England, at individual level, and not as statistics?

1.2 Since the responsibility for twice-daily pupil attendance and any interventions are already responsibilities at local level, and with broadly high attendance rates, why is it necessary and proportionate to collect the attendance data of every child twice-a-day at national level?

1.3 The detailed, named, personal data to be collected on every child includes ‘child-in-need and child protection’ indicators (“not in first phase”). What is the intention for any phase foreseen for this project beyond the already live first phase? (Ref: Appendix 1)

1.4 What measures has the DfE put in place in response to the March 2022 request to stop processing, criticism, and recommendations on the new real-time attendance data process received from the Office of the Information Commissioner?

1.5 What has the DfE done to ensure each child and/or parent/guardian can exercise their Right to Object among other rights, described in the DfE project Impact Assessment (DPIA)?


2. Definition of absence data and its measurement changes over time

2.1 Understanding the definition of persistent absence and that it has changed three times since 2010, are both critical to appreciate the numbers and data used in discussing this subject. Children are classified as persistently absent more quickly now than previously. The percentage of children who are defined as persistently or severely absent might appear significantly higher than in the past and therefore more alarming if it is believed to reflect a change over time when in fact the attendance and absence itself may be unchanged. [1]

        The persistent absence measure was introduced in 2005/06, defined as around 20% or more of sessions missed (based on a standard threshold).

        2010/11 to 2014/15 changed, based on around 15% or more of sessions missed.

        2015/16 onwards 10% or more of sessions missed (and using a new model based on a pupil’s exact possible sessions, no longer based on standard threshold).

2.2 The same children who are absent for the same period of time can appear more or less absent depending on how the statistic is measured and presented. Table 3 shows how the changes made in 2015/16 could be interpreted as suggesting a worse picture than 2014/15 despite the fact that the total time of absence for each child is identical.

Table source: Department for Education Guide (2019) page 15 [1b]

2.3 Since 2020, inaccurate and misleading claims have been frequently repeated in the media and in parliamentary debate about children-not-in-school as a result of the pandemic. For example suggestions by the Children’s Commissioner on BBC Woman’s Hour in January 2022 were later corrected in print online[1] and the Rt Hon Sir Iain Duncan Smith MP said in opening a CSJ event at Conservative Party Conference 2023, that 100,000 children have not returned to school, “as a result of all of this. Full Fact has sought to correct these errors and misrepresentation by individuals and institutions in the public domain several times. [2]

2.4 Suggesting Covid-19 as causation for 100,000 “ghost” children is wrong for two reasons. The first, is conflation with the number of children within that number who were out of school before the pandemic and reasons for that. The CSJ’s own report [3] published in 2021, said that, “In the autumn term of 2019, i.e pre-Covid 60,244 pupils were labelled as severely absent.” The second is that children at this scale are known to existing data systems and services and presenting them as “ghost” children is misleading and inaccurate. [4]

3. Changes to attendance and absence data collection process in 2022

3.1  On January 25, 2022 the DfE announced a “new daily attendance data collection trial”, collecting personal data from each and every named school child in state education in England, twice a day, through the contracted company Wonde. [5]

3.2  However there is a lack of full and transparent information being provided to schools, parents and children about the data collection and its purposes. [6] The DfE misled schools in its introductory communications. The Department had written to schools, saying that it had worked with the Information Commissioner’s Office (“ICO”) on its Data Protection Impact Assessment (DPIA), but it had not in fact done so (communication that the ICO subsequently asked the DfE to edit / retract). Nor had the DfE completed and signed off any Data Protection Impact Assessment (“DPIA”) before processing began, as required by law.

3.3 Geoff Barton, the general secretary of the ASCL school leaders’ union, demanded a “full explanation about what went wrong and the concerns raised”. “From the DfE email schools would have formed the impression that the data protection impact assessment had been sorted with the ICO, when the ICO had not actually seen the impact assessment at that stage. “This is completely unacceptable and if schools had known that an important part of the process for safeguarding data had not actually been completed, it is unlikely they would have signed up to the trial.” [7]

3.4 The DfE has confirmed to us that the daily attendance data is likely to be used to support legal interventions, including issuing fixed penalty notices and prosecuting parents. The DfE’s response also leaves open questions, regarding how daily pupil data could be used in future phases of the project and who it could be shared with beyond “Phase 1”.

3.5 The data was already collected twice daily by the local setting, can already be made available to Local Authorities by educational settings, and attendance intervention and penalty assessment are a local not a national responsibility. It remains unclear how and why this purpose necessitates data collection by the national DfE daily replacing termly collection at pupil level, and retention for 66 years.

3.6  As of September 1st, 2022, we are told 65% of schools were following the new process in addition to the termly census, 14,443 schools out of 22,060 that have agreed to Wonde’s new automated data extraction process.The data is stored and processed within Microsoft Azure cloud hosting which is based in the Republic of lreland and the Netherlands for which the DfE documentation states, “DfE has received the required Offshoring Approval for using Microsoft Azure”.

3.7 The Consultation[2] and accompanying document: Modernising school attendance and admission registers and setting national thresholds for legal intervention (July 2022) [8] was published after the trial had already begun, but it is misleading about the pupil data extraction underway when it states, “DfE has been working to establish a better, more timely flow of suitably anonymised pupil level attendance data across schools, trusts, local authorities, and DfE.” (page 6) The extracted data is identifying data, at named pupil level (see Appendix 1).

3.8 The Consultation is also out of date, since the legislation that it references for changes to its legal basis in the Schools Bill, is no longer progressing in parliament.

4. DfE refusal to comply with an ICO request to stop data collection

4.1 The ICO asked the DfE to pause the high risk data collection, and carry out the risk assessment which the DfE had claimed was complete, and with ICO cooperation, but had in fact not been done and the ICO had not been involved. The DfE declined to pause. [9]

4.2 The ICO found wide ranging and serious failings in this new daily attendance data collection from every school child, and set them out in writing to the DfE in March 2022. [9b] Many of these repeated issues identified in the DfE ICO 2020 audit around the law, failure to inform children and families of their rights, and retention. [10]

4.3 At the time of writing, the DfE does not appear to have made any substantive changes to address the ICO’s long list of concerns, including being unable to demonstrate that the DfE has met its lawful obligations. The DfE appears to be carrying on unchanged, 10-months after those ICO findings on this ‘trial’, much in the same way as after its 2020 ICO audit. [11]

5. The impact on children’s data rights of the DfE reforms to attendance surveillance

5.1 The DfE has failed its obligation to inform children and parent/guardians of the additional processing and of their rights in relation to it, including (as specified in the DPIA) that the data subject also has the right to object (DPIA 16), or that they can inform the DfE of any errors (DPIA 19), or to request the restriction of processing (DPIA 21) or of any routes to do so, so that it is impossible for them to know that they can exercise their rights.

5.2 The Information Commissioner’s Office observed in its March 2022 communications with the DfE that the lawful basis of the data processing is unclear. The necessity of the processing is brought into question in the context of the data retention period for 66 years. The DPIA does not adequately explain why such a long retention period is required, nor why, if, as is stated, this is for the purpose of long-term analysis, the options of anonymisation (which is mentioned in the context of archiving) or pseudonymisation are not explored.

5.3 The Information Commissioner’s Office also found that, “The DPIA also states that the controller will be able to monitor the impact of Covid ‘into employment’. The DPIA does not make clear why such monitoring is necessary for such a long period of time.” We further point out to the Committee that there has been no mention in the DPIA or any communication to schools or families about any data linkage with further identifying pupil-level data sets which would appear necessary in order to meet this aim.

5.4 If the purpose of assessing attendance is to monitor the impact of Covid, it is unclear why the Department stopped collecting the absence code (see Appendix 2 for full list) for Covid-related illness at the end of the 2021/2022 academic year. “Schools no longer need to record pupils who do not attend for reasons related to COVID-19, using Code X.” [12]

5.5 The DPIA also omits risks that should have been assessed as the data controller initiating the new process, and that the consultation mentions, such as “Local authority access”, “Secretary of State access” and the further retention and processing “into employment”. It also omits any mention of assessing the use of data distribution at Local Authority level from the “extracts” that this new process enables and may be retained.

5.6 The DPIA (p6) (p25/94 in the bundle) infers that Child in Need and Child Protection data will be added later to this collection since it is listed as data to be collected but also as “(not in first phase)”. The entirety of the project aims and scope must be published with urgency.


6. References

[1] DfE Guide to absence statistics (2019) recently removed from the DfE website but permanently archived at https://web.archive.org/web/20230131191059/https://dera.ioe.ac.uk/33072/1/Guide_to_absence_statistics_21032019.pdf

[2] Full Fact (2021) Pandemic school attendance: fact checked (June 2021) https://fullfact.org/education/school-pupils-return-classroom-covid/ and October 2021 https://fullfact.org/education/135000-children-missing-school-autumn-2021/

[3] Centre for Social Justice (2021) Pupils are persistent absentees if they miss 10% of sessions or more, and severe absentees if they miss 50%. https://web.archive.org/web/20220425051541/https://www.centreforsocialjustice.org.uk/wp-content/uploads/2021/06/Cant_Catch_Up_FULL-REPORT.pdf

[4] Persson, J. (2022) The Children of Covid: Where are they now? #CPC22 https://jenpersson.com/the-children-of-covid-where-are-they-now-cpc22/ The very idea of “ghost children” who simply ‘disappear’ from school without anything known about them anywhere at all, is a fictitious and misleading presentation. Absence data is poorly represented in the media or understood

[5] DfE Press Release January 25, 2022: New measures to increase school attendance https://web.archive.org/web/20230131185057/https://www.gov.uk/government/news/new-measures-to-increase-school-attendance

[6] Defend Digital Me (2022) Challenging the DfE on excessive pupil data collection: A chronology of the daily real-time attendance data expansion https://defenddigitalme.org/2022/09/16/news-challenging-the-department-for-education-on-excessive-pupil-data-collection/  

 

[7] Schools Week (2022) “Information watchdog sounds alarm over live school attendance tracker: DfE failed to properly assess risk of collection of pupil data now used by 14,000 schools nationwide, says ICO”

https://schoolsweek.co.uk/information-watchdog-sounds-alarm-over-live-school-attendance-tracker/

[8] The consultation guidance is inaccurate to suggest the pupil level data extracted are “suitably anonymised” when attendance data is named and identifying and joined up with more identifying data across a child’s lifetime educational record https://web.archive.org/web/20220627120045/https://consult.education.gov.uk/school-attendance-policy-and-strategy-team/school-registers-and-national-thresholds-for-legal/supporting_documents/Consultation%20Document_Pupil%20Registration%20Regulations_Thresholds%20Legal%20Intervention.pdf

[9] Communications between the Department for Education and Information Commissioner’s Office (February-March 2022, released via FOI in May 2022) Request to pause, page 3. Pages 85-94 contain concerns and recommendations made by the regulator to the DfE. Pages 20-43 the Data Protection Impact Assessment (DPIA) https://defenddigitalme.org/wp-content/uploads/2023/02/22-07-2022-Bundle-reduced.pdf

[10] The executive summary of the ICO Audit of the Department for Education (2020) https://defenddigitalme.org/wp-content/uploads/2021/10/department-for-education-audit-executive-summary-marked-up-by-DDM-Jan-2021.pdf (highlighted version at defend digital me)

[11] Defend Digital Me (2021) The ICO audit of the Department for Education: one year on https://defenddigitalme.org/2021/10/07/the-ico-audit-of-the-department-for-education-one-year-on/ Findings included 139 recommendations for improvement and >60% classified as urgent or high priority (Feb 2020).

[12] Department for Education attendance Guidance (May 2022) https://defenddigitalme.org/wp-content/uploads/2023/02/School_attendance_guidance_May-2022.pdf since withdrawn https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/1105095/WITHDRAWN-School_attendance_guidance_May-2022.pdf

 








Appendix 1: copy of an extract from the Data Protection Impact Assessment obtained by the ICO after the processing had already begun, that lists the children’s personal data to be collected, including Child in Need and Child Protection “(not in first phase)”. (Note that these data are also already collected by the DfE in the CIN census and Looked After Children Census and linked on a named basis in the National Pupil Database.)



 

Appendix 2: DfE attendance / absence codes collected twice daily (as referred to “all attendance codes” but not listed broken out above in Appendix 1)

CODE

DESCRIPTION

MEANING

/

Present (AM)

Present

\

Present (PM)

Present

B

Educated off site (NOT Dual registration)

Approved Education Activity

C

Other Authorised Circumstances (not covered by another appropriate code/description)

Authorised absence

E

Excluded (no alternative provision made)

Authorised absence

G

Family holiday (NOT agreed or days in excess of agreement)

Unauthorised absence

H

Family holiday (agreed)

Authorised absence

I

Illness (NOT medical or dental etc. appointments)

Authorised absence

J

Interview

Approved Education Activity

L

Late (before registers closed)

Present

M

Medical/Dental appointments

Authorised absence

N

No reason yet provided for absence

Unauthorised absence

O

Unauthorised absence (not covered by any other code/description)

Unauthorised absence

P

Approved sporting activity

Approved Education Activity

R

Religious observance

Authorised absence

S

Study leave

Authorised absence

T

Traveller absence

Authorised absence

U

Late (after registers closed)

Unauthorised absence

V

Educational visit or trip

Approved Education Activity

W

Work experience

Approved Education Activity

D

Dual registration (i.e. pupil attending other establishment)

Not counted in possible attendances

X

Untimetabled sessions for non-compulsory school-age pupils

Not counted in possible attendances (NB Between June 2020 and July 2022 this was used to also record absence “for reasons related to COVID-19”  (other than direct pupil illness ‘I’).

Y

Enforced and partial enforced closure

Not counted in possible attendances

Z

Pupil not yet on roll

Not counted in possible attendances

#

School closed to pupils

Not counted in possible attendances

February 2023
 

             

                                                                                    8/8


[1] The Children's Commissioner Dame Rachel de Souza told BBC Woman's Hour that between 80,000 and 100,000 children were not on any school rolls at all. The Office of the Children's Commissioner for England subsequently confirmed that Dame Rachel misspoke and that this figure actually relates to the number of children who were persistently absent from school in autumn 2020. https://www.bbc.co.uk/news/education-60054253

[2] Attendance consultation: School registers and national thresholds for legal intervention (July 2022)

https://web.archive.org/web/20220617190014/https://consult.education.gov.uk/school-attendance-policy-and-strategy-team/school-registers-and-national-thresholds-for-legal/