PARLIAMENTARY WRITTEN QUESTION
Pupils: Personal Records (10 October 2017)

To ask the Secretary of State for Education, what audit processes her Department has implemented to ensure that third-party organisations which access the National Pupil Database store and process that data in compliance with their original agreements with the Government.

Asked by:
Darren Jones (Labour)

The National Pupil Database (NPD) is a longitudinal research database that provides evidence on educational performance to inform independent research, as well as studies commissioned by the Department.

The Department may legally share the NPD, or elements of it, with third parties, using powers set out in Section 537A of the Education Act 1997 and the Education (Individual Pupil Information) (Prescribed Persons) (England) Regulations 2009. Organisations requesting access under those powers must show how it will be used to promote pupils’ education, through evidence or research.

In addition to the provisions within the Education Act 1997, in line with the Data Protection Act 1998, where the police or Home Office have evidence that a child may be at risk or evidence of criminal activity, limited data including a pupil’s address and school details may be requested from the NPD. This data does not include nationality or country of birth information. It is right that we share this data if it helps to keep a child safe from harm or to disrupt a crime.

Anyone requesting data from the NPD must comply with strict confidentiality and security rules and be registered with the Information Commissioner’s Office for their request to be approved. Any access to sensitive data is strictly controlled and governed by legal experts and senior civil servants.

Access is subject to requestors complying with strict terms and conditions imposed under contractual arrangements. The requestor must demonstrate that they have the appropriate security arrangements in place to process the data and will keep the data only for the specified length of time. A security questionnaire provided with each application provides details of the organisation’s technical and physical security measures. The information provided in the security questionnaire is considered as part of the approvals process. Experience suggests organisations using NPD take these processes very seriously and comply with these conditions.

A data retention period is set for any extract of the NPD we provide to third parties and is usually between 6 months and 3 years, depending on the aims of the project. Data destruction is a vital part of data sharing agreements, and the Department follows up each permitted use to seek confirmation that data has been appropriately destroyed.

The process and guidelines for requesting access to extracts of the NPD, as well as a full list of requests received and processed by the Department, is available at: https://www.gov.uk/government/collections/national-pupil-database.

Answered by:
Nick Gibb (Conservative)
18 October 2017