My Lords, Amendment 67 tabled by the noble Lord, Lord Storey, but skilfully presented by the noble Baroness, Lady Garden, seeks to place a duty on the Information Commissioner to prepare a code of practice in relation to the sharing of personal data by organisations that collect such data for post-16 educational purposes.
I thank both the noble Lord, Lord Storey, and the noble Baroness, Lady Kidron, for bringing this issue to my attention. The Government agree that this is an issue that needs addressing, and we share both noble Lords’ aims for increasing assurances around the processing and sharing of personal data for learners and students in post-16 settings.
The department’s response to this issue is to set up an education sector certification scheme, with the support of the ICO, that would allow the department to set standards in a wide range of areas. This would cover the data protection needs of the whole education sector, not just the 16 to 19 age group covered by the Bill. We feel that a certification scheme, rather than a code, gives us flexibility to deliver elements when they are ready. We will not have to wait until all elements are complete, which allows us to be flexible when responding to priority needs. In addition, as technology and the law change, we are able to update specific standards without having to update a full code, allowing us to remain flexible to future changes.
As the noble Baroness, Lady Garden, mentioned, I have written to both the noble Lord, Lord Storey, and the noble Baroness, Lady Kidron, detailing the department’s ambition and next steps in tackling this issue, which will include writing both to the ICO and to the ed-tech companies by the end of the year.
I am amused at the definition of “a little question” from the noble Baroness, Lady Sherlock; it was at least three little questions. If I may, I will write to her on the detailed points. Broadly, the thrust of her questions is that student data should be protected. The department continually keeps its processes and practices under review to ensure that we are taking all necessary steps to protect data, including updates to access controls, audit trails of data usage and reviewing risk as part of our data protection impact assessment. In relation specifically to this amendment, the proposed data certification scheme would formalise these controls across the sector. If I may, I will respond in writing to her other points.
I therefore hope that the noble Baroness, Lady Garden, on behalf of the noble Lord, Lord Storey, will consider withdrawing his amendment. I again place on record my thanks to him and the noble Baroness, Lady Kidron, for bringing this to my attention.