Information commissioner acts after complaint that data is used for immigration enforcement.
The UK’s privacy regulator has criticised the Department for Education (DfE) for secretly sharing children’s personal data with the Home Office, triggering fears it could be used for immigration enforcement as part of the government’s hostile environment policy.
Acting on a complaint by the campaigning organisation, Against Borders for Children (ABC), the Information Commissioner’s Office (ICO) ruled that the DfE had failed to comply fully with its data protection obligations and may face further regulatory action.
Pupil data is routinely collected by schools, according to the human rights organisation Liberty, representing the complainant, but teachers and parents were unaware in this case that the children’s information could be shared with immigration enforcement and result in their families being deported.
In a letter to Liberty, seen by the Guardian, the ICO says its investigations team is now considering whether to take further action against the DfE for “wide ranging and serious concerns” highlighted in this case and in response to further concerns raised by “a number of other sources”.
The ICO only upheld part of the complaint, but its letter said concerns raised had “highlighted deficiencies in the processing of pupil personal data by the DfE”, adding: “Our view is that the DfE is failing to comply fully with its data protection obligations, primarily in the areas of transparency and accountability, where there are far reaching issues, impacting a huge number of individuals in a variety of ways.”
According to Liberty, the complaint arose out of events which followed the signing of a memorandum of understanding in June 2015, by which the DfE agreed to pass the personal details of up to 1,500 school children to the Home Office each month as part of a policy to create a hostile environment for migrants.
Parents and campaigners became concerned the following year when the DfE asked schools to start collecting data on children’s nationality and country of birth. This resulted in a mass boycott by families who were worried it might be used for immigration enforcement.
Following legal action brought in April 2018 by ABC, again represented by Liberty, the DfE announced it would no longer ask schools to collect nationality and country of birth data but, according to Liberty, the DfE’s actions left many parents afraid to send their children to school.
Liberty lawyer Lara ten Caten said: “Data sharing is just one part of the government’s discredited hostile environment which has left people too afraid to do things like send their children to school, report crime or seek medical help. It’s time to redesign our immigration system so it respects people’s rights and treats everyone with dignity.”
Liberty called on the DfE to delete children’s nationality and country of birth data that had been collected and urged all political parties to make manifesto commitments to introduce a data firewall which separated public services from immigration enforcement.
The ABC’s Kojo Kyerewaa said: “The ICO decision has shown that the DfE cannot be trusted with children’s personal data. Without public debate or clear notification, schools have been covertly incorporated as part of Home Office immigration enforcement. These checks have put vulnerable children in further danger as parents are taken away via immigration detention and forced removals.”
The DfE, unable to respond because of general election purdah constraints, referred to answers to earlier parliamentary questions, which said the department collected data on the nationality and country of birth of pupils via the school census between autumn 2016 and summer 2018.
“The Home Office can only request information from the Department for Education for immigration enforcement purposes in circumstances where they have clear evidence a child may be at risk or there is evidence of illegal activity, including illegal immigration,” it said.
An ICO spokesperson said: “As a non-departmental government body, the ICO has to consider its responsibilities during the pre-election period. Our regulatory work continues as usual but we will not be commenting publicly on every issue raised during the general election. We will, however, be closely monitoring how personal data is being used during political campaigning and making sure that all parties and campaigns are aware of their responsibilities under data protection and direct marketing laws.”
