Governance of data for children’s learning in UK state schools

When I first introduced the Age Appropriate Design Code (AADC) into the Data Protection Bill in 2018, I had no idea that it may not apply to education settings. Now, a few years on, there is still some confusion. What happens if schools are working remotely: does the AADC suddenly apply? Or if a teacher uses an app or service in the classroom that they downloaded directly from the internet: does the AADC no longer apply? Why is there a difference between state and private schools, when surely all pupils need their data protected? Why is the burden disproportionately put on teachers and schools to understand the complex data processing terms set out in the terms and conditions of services that are hungry for data? And, perhaps most crucially of all, why are schools sharing intimate pupil data (wittingly and not) with commercial companies at all? This report, authored by Emma Day, starts the work of unravelling some of these questions, and in doing so identifies gaps in provision, gaps in clarity, gaps in understanding. As such, it is the first step to working out what good might look like when the education sector and schools are brought into an effective data protection regime.