DfE Refuses to Publish Full Findings of Data Handling Audit

The Department for Education (DfE) has again refused to publish the full findings of a critical audit into its handling of pupil data, arguing that disclosure could “distract” from its plans to gather even more information on children through a proposed national pupil register.

An audit carried out by the Information Commissioner’s Office (ICO) in 2020 found the DfE had breached several provisions of the General Data Protection Regulation (GDPR), which governs how personal data is collected, stored and used. The investigation was launched following serious concerns about the National Pupil Database, including revelations that children’s data had been accessed by gambling companies.

The ICO concluded that data protection was “not being prioritised” within the department. Despite the significance of the findings, the DfE has never released the full audit report, publishing only a brief summary.

Repeated Refusals to Publish

In 2021, the DfE rejected a freedom of information (FOI) request from Schools Week for the full report. At the time, the department claimed it was still responding to the audit’s recommendations and that ministers and officials needed “space in which to develop their thinking”. It also argued that the report was due to be published at a later date. That publication never occurred.

Earlier this year, the DfE said that its information security action plan in response to the ICO audit had been completed and that future work would be treated as “business as usual” and monitored accordingly.

Following this update, digital rights campaign group Defend Digital Me submitted a fresh FOI request in July, arguing that there was no longer any justification for withholding the full report. The department again refused.

In its latest response, the DfE said releasing the report could lead to a “disproportionate focus on past failings that have since been addressed to the satisfaction of the ICO”. It also claimed publication “may distract from the department’s current priorities”, in particular the progress of the forthcoming children’s wellbeing and schools bill.

Concerns Over Expanding Data Collection

The proposed bill includes plans to establish, for the first time, a national register of children not in school. This would significantly expand the volume and sensitivity of data held by the DfE, adding to what critics already describe as one of the largest collections of children’s personal data in the country.

Jen Persson, director of Defend Digital Me, questioned the department’s refusal to be open about its past performance on data protection while seeking to collect more information.

“The DfE already holds detailed statistics on every home-educated child that local authorities track, but now wants their names and vast amounts of additional detail,” she said. “At the same time, it is refusing to be transparent about how well it handles the data it already has.”

Persson also challenged the department’s argument that publication of the audit could undermine current policy priorities.

“How can public access to a past audit about data protection policy reasonably prejudice a new and unrelated law today?” she said. “If it does, that only underlines why the contents should be made public. This affects over 28 million people in England, yet the report is being kept secret indefinitely while the department continues with ‘business as usual’.”

Ongoing Questions About Accountability

Campaigners and data protection experts have long argued that transparency is essential to rebuilding trust in how pupil data is handled, particularly given the sensitivity of the information involved and the scale at which it is collected and shared.

The DfE was approached by Schools Week for comment on its refusal to publish the full audit report and on concerns surrounding the proposed national pupil register