Higher Education and Research Act 2017 (Cooperation and Information Sharing) Regulations 2018 — House of Lords, 2018-07-24
Topic: Education
Michael Goodall Watson (Labour, Centre-left): My Lords, I welcome the opportunity to draw the regulations to the attention of the House, although it is unfortunate, to say the least, that this debate is taking place five weeks after they came into force. However, there is greater cause for concern because, without consultation or public announcement, this negative statutory instrument was laid on 23 May, less than three weeks before coming into effect, with one of those weeks being taken up by the Whitsun Recess. Perhaps the noble Viscount can explain why such timing was employed by the Government, rather than exposing the regulations to proper scrutiny both in Parliament and more widely The regulations have caused considerable concern in respect of the significant powers that they create for the Office for Students to grant access to students’ confidential data to a single commercial provider. Further, it has to be said that the Explanatory Memorandum does not do what it says on the tin, because the purposes for which the data may be used remain open and vague We have a number of concerns, not least that, as I said, there has been no parliamentary debate or public consultation. It almost beggars belief that students and universities, those directly involved, were excluded from the decision to create these invasive powers. Last month, in a Written Question, my Front Bench colleague Gordon Marsden MP asked whether the Department for Education had consulted universities, student bodies or UCAS on the powers relating to confidential data conferred under the regulations. He did not receive a suitable answer, so he tried again when the regulations were debated in another place three weeks ago. This time, the Minister, Mr Gyimah, admitted: "No specific contact was made with UCAS and the NUS", adding vaguely, "but the OFS regulatory framework consultation asked the sector for views on the principles of how the OFS engages with other bodies".—[Official Report, Commons, First Delegated Legislation Committee, 2/7/18; col. 10.] Of 37,000 students who responded to a UCAS survey in 2015, 90% said that they did not want their data to be handed to commercial companies without their consent, yet the Government ignored that decisive view. The Minister will recall that significant concern was raised during the passage of the Higher Education and Research Bill in another place. Indeed, Mr Marsden warned of the risk, stating that the proposal, "would give the state access to all university applicants’ full data in perpetuity for users who would only be defined as ‘researchers’ and without ‘research’ being defined at all.—[Official Report, Commons, 2/7/18; col. 4.] UCAS also raised the risks and concerns in evidence at that time. The then universities Minister, Jo Johnson MP, responded: "Only named and approved individual researchers within Government and from approved bodies will have access to the data. All data will be de-identified before being received by these accredited researchers".—[Official Report, Commons, 13/10/16; col. 457.] I can say with some certainty that neither Members of both Houses nor the general public would have inferred from that comment by the Minister that the commercial company, Pearson, would fall into the category of accredited researchers. Yet, it is specifically named in the regulations and indeed, it provides powers for the data to be passed to an unlimited number of persons not named and approved individual researchers As the campaign group Defenddigitalme has argued in submissions to noble Lords and MPs, the power to shape the education sector and course content derived from the knowledge that this kind of data holds about students’ personal backgrounds, their own and their parents’ income, courses, attainment and ongoing activity, will give the holder unprecedented influence In January 2017, during a debate in your Lordships’ House on the Higher Education and Research Bill, the noble Lord, Lord Kerslake, highlighted his concern at the fact that, "the Bill allows the Secretary of State to frame the guidance given to the OfS by reference to particular courses. As this House will know, that contrasts sharply with the current legislation—the 1992 Act—in which the Secretary of State is specifically forbidden from setting guidance to HEFCE in this way".—[Official Report, 9/1/17; col. 1802.] It is unclear in the Explanatory Memorandum why Pearson was the most prominent of the designated receiving bodies, although the debate in another place on 2 July revealed that the company was included because it awards HNC and HND qualifications. That hardly makes it unique, and there is no transparency regarding the detailed purposes for which this data will be passed to Pearson, HMRC, the Student Loans Company or indeed others There is no clear limitation of purpose or restriction on how the data may be used or distributed further after being handed over to Pearson. Risks include Pearson selling the data directly or as part of a company asset, as that company has done in the past in the USA, with the data of 15 million students. The knowledge gained from the data must give any single company—in this case, Pearson Ltd—a sizeable and some would say unfair commercial competitive advantage over others in the sector. Can the Minister say whether Pearson, or indeed other commercial organisations, will be allowed to sell on the student data that they are given under these regulations? I hope the answer will be in the negative, but if it is not then will the Minister explain to noble Lords why he thinks such action would be appropriate The General Data Protection Regulation recognises that any data that is not anonymous, including de-identified or pseudonymous data, is still personal data and falls under its obligations. But there is no assurance that no historical data would be handed over, collected without explanation to the applicants or students, or that personal data would be given to Pearson and the other new bodies in future. Such processing of historical personal data could therefore be without a lawful basis, given the failure to fairly process it during its original collection During the passage of the Higher Education and Research Bill, noble Lords and MPs raised concerns about the powers in the regulatory function of the Office for Students and questions of institutional autonomy. Legitimate questions arise as to the powers that these regulations confer on the relationship between the OfS and Pearson, given the former’s regulatory function. The appointment of Sir Michael Barber as the chair of the OfS was widely welcomed and there is no intention to impugn his reputation in any way. However, there exists at least the potential for a perceived conflict of interest, given that prior to taking up his new post, Sir Michael had been chief education adviser at Pearson for more than five years We believe that it is a significant weakness in the preparations for these regulations that the DfE has not carried out any privacy impact or human rights assessments. The department will not be accountable for the consequent impact on privacy, but the Explanatory Memorandum states that the OfS has the responsibility for any privacy impact assessment. This presumably refers to the privacy impact of individual instances of information-sharing, and that is both perfectly understandable and reasonable But I am referring to the bigger picture, to the whole system of data sharing. It is surely irresponsible for a government department to create powers and bring them into operation before fully understanding their likely effects. Creating rights of access to the entire student population’s personal confidential data for Pearson Ltd, as well as other listed third parties, is an act of national significance with potential long-term implications for individuals and the sector as a whole. Once personal data has been transferred to commercial bodies such as Pearson, the state and civil society lose oversight and transparency, together with the right to question policy and practice over its processing, yet the DfE does not believe it should be questioning these implications. Perhaps the Minister can explain why not This motion calls on the Government to carry out a privacy impact assessment of these regulations. If the Government believe that it is for the OfS to carry out such an assessment, so be it, but they must ensure that the OfS does so because, despite these regulations being in force for more than a month, there are too many unanswered questions surrounding them, and that is not acceptable. I beg to move.