Data Protection Concerns Surrounding Attendance Data

The Department for Education's (DfE) focus on improving school attendance includes conducting a trial which involves automatically collecting daily attendance data from schools that choose to provide it. The scheme appears to be essentially trialling proposals to create regulations which would require schools to keep electronic attendance registers and to change who can access those registers. The DfE is using a company called Wonde to collect the attendance data on its behalf.

The Information Commissioner's Office's Views

The children's privacy group, Defend Digital Me, made a Freedom of Information Act (FOIA) request to the Information Commissioner's Office (ICO) for certain information that it holds on the DfE's trial, including about the DfE's Data Protection Impact Assessment. The ICO's FOI response includes a letter from the ICO to the DfE with its comments. These include the following:

• The ICO states that it is not clear how the DfE's proposed retention period of 66 years is justified.
• The DfE's DPIA should have more detailed consideration regarding the risks around data security.
• The DfE had not documented which DPA condition it is relying on to process special category data.

Defend Digital Me states on its website that its legal team has written to the DfE to seek answers on its behalf.

Should Your School Take Part in the Scheme?

Ultimately, whether your school decides to take part or, if it is, should continue with it, will depend on how you weigh up the benefits of participating in the scheme, against the data protection risks.

The DfE states that the benefits to schools who participate include access to more up-to-date pupil level attendance data and daily attendance reports. In the DfE's view participation will help a school meet the new expectations set out in Working together to improve school attendance.

What are the Risks to Schools?

The risks include:

• Possible complaints from pupils and parents about the decision to take part in the scheme in light of the ICO's views and the action being taken by Defend Digital Me.
• Receipt of data subject rights requests (e.g. subject access requests, right to object requests). These could be used to seek information about what personal data has been shared with the DfE and to object to the sharing.
• Whilst the DfE is responsible for Wonde's compliance, your school is still obliged to consider information security. If your school chooses to take part your IT team should be involved in checking that there are appropriate measures in place to keep the information secure.
• There is also a risk of reputational damage to schools who choose to participate, especially if Defend Me Digital successfully challenges the DfE, or if the ICO takes enforcement action.

It is likely that the DfE will do more work on data protection compliance in light of the ICO's views. We recommend that your school monitors this if it chooses to participate.

If you would like to discuss this further, please contact Claire Hall in our Education team on 0117 314 5279, or complete the form below.