The government could face legal action over the way it handles pupil data as pressure grows to publish a full audit of its practices. The has issued a letter before claim to the Department for Education over its handling of 鈥渆xtremely sensitive information鈥 about children, warning that it will seek a judicial review if it does not receive a 鈥渟atisfactory response鈥. The organisation said the department has 鈥渞epeatedly鈥 failed to provide details of steps it has taken to ensure it meets data protection law, and has not properly informed parents about what is done with their children鈥檚 data. A damning audit by the Information Commissioner鈥檚 Office (ICO) in 2020 found the DfE broke data protection laws in how it handled pupil data. The audit was prompted by complaints about the national pupil database (NPD), which holds information on millions of past and present school pupils. A summary of the report warned that data protection 鈥渨as not being prioritised鈥, which had 鈥渟everely impacted the DfE鈥檚 ability to comply with the UK鈥檚 data protection laws鈥. The watchdog issued 139 recommendations for improvement, with more than 60 per cent classified as 鈥渦rgent or high priority鈥. The DfE said it had reviewed 鈥渁ll processes for the use of personal data鈥. ‘No sense of urgency’ But the government has not published an update on its work to address the ICO鈥檚 concerns since January 2021. The full report, which the DfE promised to publish, is also still under wraps more than two years later. DefendDigitalMe鈥檚 director, Jen Persson, said there seemed to be 鈥渘o sense of urgency鈥. Jen Persson 鈥淸There is] no commitment to even recognising they have a serious problem, when there is no mechanism in place to automatically indicate a child at risk should have a sealed record protected from distribution. 鈥淲hen you ask ordinary pupils and teachers, they are shocked to know more than statistics leave the school and are given away to an unlimited number of businesses.鈥 Her organisation wants a response detailing how the DfE is now complying with data protection law. The department told Schools Week that while it was under 鈥渘o obligation鈥 to publish the full report, it had 鈥渃ommitted in the future to publish the full report once we have concluded the work to the ICO鈥檚 satisfaction鈥. As part of its investigation, the ICO looked into how the NPD, learning records service and 鈥渋nternally held databases鈥 at the DfE were managed. DfE faces questions over sharing of pupil data The sharing of data from the NPD with external organisations has been a subject of controversy for some years, and children鈥檚 rights鈥 groups have called for it to be halted. This came to a head in 2016 when the government began collecting data on pupils鈥 nationality and country of birth, eventually admitting it had planned to share the data with the Home Office for immigration control. The collection was cancelled in 2018. The DfE releases anonymised sections of the NPD to organisations 鈥 including private companies – that request them. However, the ICO found the reasons for doing so were not always justified. But access to pupil data is important for academics and research organisations, such as the National Foundation for Educational Research. Its director of research, Lesley Duff, said analysis of important data sources played a 鈥渃ritical role in creating new evidence for teachers and other practitioners about what works in the education system鈥. It could also provide 鈥渋mportant insights that help the government develop new policies to improve educational outcomes鈥. However, she warned it was 鈥渋mperative that any data is handled and managed extremely sensitively, in compliance with GDPR principles, and is only shared with accredited academics and researchers who have been trained to use the data in a safe and secure manner鈥.