National Pupil Database engorged to 20 million individual kids' records
Massive population-wide pupil data slurp also available to private sector
The UK Department for Eduction has enlarged its mega database containing sensitive personal pupil information to nearly 20 million individual records, according to a Freedom of Information response.
The National Pupil Database contains a range of sensitive information dating from the year 2000, including name, postcode, ethnicity, records on absence, reasons for exclusion, types of disability, and whether the pupil is a recipient of free school meals.
Back in 2014, the government waved through legislation that would allow researchers and private sector parties to extract anonymised records from the database.
The Register first reported on the proposals to allow the private sector companies access to the info in order to create "innovative tools and services" in 2012.
Jen Persson, co-ordinator at privacy group Defend Digital Me, said the department had informed her in October 2015 that the database holds 8 million records. However, that figure has now proved to be incorrect.
"Why is there now a national database of 20 million people in England, their records created as children, and over half of whom are now adults, and no one knows it exists. Who is using their personal data and for what purposes?"
She questioned why the government had created a fully identifiable database containing personal information to be kept indefinitely.
"If the government decides to further change the scope of who they give it to or why, how will children and parents ever know? History shows population-wide databases are a very bad idea without transparency and clear independent oversight."
In its Freedom of Information response, the department said: "Initially, the data is used both for operational purposes (for example, to allocate funding or to enable effective operations in schools) and analytical purposes, after which it is retained over a longer timeframe for historical, statistical or research purposes."
It noted the Data Protection Act contains an exemption that "allows us to keep the data indefinitely for historical, statistical or research purposes."
It said the retention period is set "for any extract of the NPD we provide to third parties" and is usually between six months to three years depending on the aims of the project.
A Department for Education spokesperson said: “In our use of the National Pupil Database (NPD) we need to balance the huge and vital gains to education standards that data analysis, transparency and sharing can provide, with protecting individual privacy. We do this by ensuring requestors comply with strict terms and conditions covering the confidentiality and handling of data, security arrangements, and retention and use of the data. We only disclose pupils’ and/or children’s information where legislation allows us to and in line with the Data Protection Act.” ®
Sponsored: Becoming a Pragmatic Security Leader