Question to the Department for Education:

To ask the Secretary of State for Education, whether her Department has (a) conducted or (b) plans to conduct a risk assessment on the implications of the new Clause 4 of the Children’s Wellbeing and Schools Bill for data security and the protection of sensitive family information.

An assessment of the potential impact on parental rights and informed consent is included in the Bill ECHR impact assessment, available here: https://bills.parliament.uk/publications/59867/documents/6253. Conditions for processing are a matter for local data controllers now, and that will remain the case under this new duty.

To clarify, clause 4 introduces an information sharing duty and makes provision for a consistent identifier to be used across organisations that have safeguarding and welfare functions to support record linkage. Its use has therefore been limited to safeguarding and welfare. Safeguards have been built into this provision, and data protection principles still apply meaning information may only be shared where it is necessary and proportionate. In addition, both measures are clear that any benefits of sharing must outweigh any potential detriment to the child.

As required under Article 36(4) of the UK General Data Protection Regulations, the department has formally consulted the Information Commissioner’s Office. A Data Protection Impact Assessment (DPIA) is not required by the department for the information sharing duty element of clause 4 because personal data will be processed locally. For the consistent identifier element of clause 4, it is currently the position that the department will not be a processor of personal data, so a DPIA is not required as it stands. We will keep this position under review and, should it ever be the case that the department will process personal data as part of either element of clause 4, we would conduct and publish a DPIA.

During the passage of the Bill, the department has committed to undertake public consultation, including with parents, and will comply with requirements for impact assessments.

Clause 4 will be commenced at a later date, rather than immediately upon Royal Assent, to allow for consultation on statutory guidance, further consideration of impact, as well as ongoing piloting and technical design of the consistent identifier. The department will only proceed when we are confident in the benefits, cost, security, and governance.