Last month the Department for Education revealed it is working with the Department for Work and Pensions (DWP) and HMRC to match pupil education data with information about parents’ employment, earnings and benefits.

The government aims to understand how pupils’ attainment varies with household income and thereby potentially identify “challenges faced by those pupils in families which are not currently identified as disadvantaged”.

For school leaders, this may raise some queries around the specifics of what is being collected and why. Here are the key insights from the DfE’s privacy notice on the programme.

What data is being collected?

The DfE’s privacy notice says several key pieces of personal data will be used to link the data for the research project: name, date of birth, gender, postcode and national insurance number.

The DfE states it is using information about students in the state sector from 2010-11 academic year onwards and the information will be updated annually. This suggests that the data of pupils currently at school will be used, although it is not clear when the linking of data will take place.

Will schools be involved in this research?

There is no indication in the privacy notice that schools will be directly involved in the research.

The notice states that the education information will be obtained from the DfE.

It is possible though that the data held by the DfE on pupils was originally collected from schools via statutory data collections.  

Will the research lead to decisions being made about individual students?

No. The privacy notice states that when the data has been matched, all personal identifiers will be removed and that the relevant legal powers only allow the information to be used to make education and training policy from summary information.

Who will the linked data be shared with?

The notice states that the DfE may in the future share the linked data (without personal identifiers) to third parties for specific research purposes, however, no particular third parties are named.

The DfE should update the privacy notice with more information on this point when it knows what type of organisations will receive the data.

What should schools do if parents or pupils ask about this use of their data?

The government departments involved are responsible for the use of this data rather than schools. If parents and pupils have any questions, they should contact the DfE, for example, by using the contact form linked in the privacy notice.

As such, schools should not be answering questions on the DfE’s behalf about this. It’s not schools’ responsibility and schools do not have the necessary information to do so.

Under which data protection laws is this covered?

The DfE has published a privacy notice about this because, under UK GDPR, privacy notices must be provided to individuals telling them how and why their personal data will be used.

In addition, privacy notices must include other information, such as the lawful basis relied on and what rights individuals have in their data.

The DfE states that its lawful basis is “public task”. This is one of six lawful bases under UK GDPR and it is often relied on by public authorities (including schools) to use personal data.

When special category data (eg, information about health or ethnicity) is used, an additional condition is required under UK GDPR. The DfE is relying on the condition relevant to research and statistical purposes.

Claire Hall is a senior associate at law firm VWV