National Pupil Database Update

Ed Humpherson, Director General for Regulation, Office for Statistics Regulation, to Jen Persson.

Dear Jen,

We wrote to you in March 2018 in response to your concerns about the Department for Education’s (DfE) handling of the National Pupil Database. Here we set out our assessment of DfE’s progress on our recommendations (as we committed to publish in our letter). In the last six months the Department for Education (DfE) has made some major changes to how they safeguard data, as indicated below. We welcome these developments, but would like to see more prominent communication of this work. We understand from conversations with DfE that they share that aspiration.

We are also aware that the new Data Sharing Approval Panel is overseeing all external requests for personal data held by DfE. The panel includes external members. DfE are still seeking a third panel member, but are currently working with the two they have recruited to establish how best to utilise the external scrutiny role.

To support our commitment to proactively monitor progress on these recommendations I met with DfE’s Permanent Secretary in May. I was reassured that the Department’s commitment to transform their approach to data safeguarding had senior-level support and I reiterated our message that these plans must be transparent. We continue to have regular meetings with DfE and receive progress updates about their data modernisation work. I understand that you have also met with DfE staff and have been consulted about these developments. I welcome this open engagement.

Yours sincerely,

Ed Humpherson

Communication and Transparency

We asked for	Progress to date	What we want to see next
A prominent and widely publicised statement outlining progress on DfE’s modernising data access work, with details of expected next steps and timeframes for key milestones.	The key milestone in this work was achieved on 25th September when access to NPD data for research was made available via the ONS Secure Research Service (SRS). Guidance for users has been published which also contains outlines of plans for future developments. DfE have told us they are committed to driving significant amounts of users towards the SRS.	More publicising of the new data sharing arrangements once they have had time to be established.
	To support the new data access provisions, 400 places have been made available for 1-day approved researcher training, and significant effort is going into supporting the education research community to access the ONS SRS remotely	Better information on the ONS SRS website about the DfE data that it now holds, and about remote access provisions.Better information on the ONS SRS website about the DfE data that it now holds, and about remote access provisions.
	Following on from the data ethics round table held in February 2018 involving external data users and other organisations, there was a larger and more detailed ‘show and tell’ session to challenge DfE’s thinking (which you attended).	Timelines for the future planned developments outlined in the Guidance
		A hyperlink in the Guidance to the document: Data protection: how we share pupil and workforce data
Information about all onward data sharing to be made public.	Details of data shares involving onward sharing with third parties are now included in the summary information published by DfE in the transparency publication . The most recent of these contained all NPD data shares, as well as oversight of all regular data sharing underpinned by Data Sharing Agreements or SLAs.	Recommendation met - no further steps required.
	In May, DFE put in place a new governance board – the Data Sharing and Approval Panel (DSAP) - which is aiming to cover all pupil data held by DfE. All data shares overseen by DSAP will be included in DfE’s next transparency publication, currently timetabled for December.	Recommendation met - no further steps required.
Incorporation of the identifiability spectrum, and its suggested terms for different levels of data, into materials about NPD, and other relevant materials about data.	DfE plan to publish this alongside the December transparency publication mentioned above.	No further steps required – subject to publication in December.
A “public guide to data identifiability and the NPD” drawing on the identifiability spectrum framework developed by the Wellcome Trust’s Understanding Patient Data programme.	This is in development. DfE plan to publish it alongside the December transparency publication mentioned above.	No further steps required – subject to publication in December.

Data safeguarding and legal compliance

We asked for	Progress to date	What we want to see next
All relevant NPD outputs to be aligned with the Five Safes framework	The Five Safes are now the structure for the process of applying for (and governing) requests to use NPD data.	The Five Safes included in any documents replacing those that have been withdrawn.
	The guidance document Data protection: how we share pupil and workforce data now contains a statement about DfE’s adherence to the Fives Safes.
	The NPD user guide & data flows and sharing documents have been withdrawn.
Details outlining how the National Pupil Census and NPD will be GDPR compliant	The latest update to the Data Protection Toolkit for Schools reflects the new GDPR requirements for schools.	Publication of the main messages and lessons learnt from conducting the DPIA
	Specific details of the NPC, NPD and GDPR will be included in the Data Protection Impact Assessment (see below).
A Data Protection Impact Assessment (DPIA) of the NPD.	This is in development, with input from ICO. In time this will cover the NPD itself, the sharing of NPD (including the SRS) and the data within the Alternative Provision Census. ICO are engaged and happy with the approach DfE is taking.	Publication of the main messages and lessons learnt from conducting the DPIA
Proactive involvement of the ICO in all major decisions covered by their remit for data processing and privacy safeguarding related to the pupil census and NPD.	The Office for Statistics Regulation (OSR) has worked with the Department for Education (DfE) and the Information Commissioner’s Office (ICO) to establish a Department for Education (DfE) Personal Level Data Sharing Regulatory Review Group. The role of the group is for OSR and the ICO to provide support, advice and challenge to DfE as they rollout plans to improve handling and sharing of personal level data within the DfE, with a specific focus on the pupil census and the National Pupil Database. This met in May and September and will next meet in November.	No further steps required.

Engagement with pupils asnd parents

We asked for	Progress to date	What we want to see next
Exploration of options for pupil and parent panels.	So far, DfE has not formalised any plans for this – but has been working with organisations such as Involve to understand ethical frameworks associated with data sharing that have parent/pupil panels.	This recommendation will be kept under review.
User-testing of privacy notices with parents and pupils.	User testing of privacy notices was carried out in Spring 2018. DfE informed us that a number of changes to language and content were made to improve readability.	Continued commitment to conduct user testing where substantial changes to documents are proposed.