Ministers failed to properly assess the data protection risks of their new live attendance tracker before its launch and misled schools about the involvement of the information watchdog. Documents seen by Schools Week show the (ICO) raised numerous concerns about the 鈥渉igh-risk鈥 pilot. Officials questioned its legal basis and its plans to hold the data for 66 years. The Department for Education has collected daily attendance data direct from 14,000 school registers since February through a partnership with the edtech firm Wonde. Data collected includes pupils鈥 sex, ethnicity, free school meals eligibility and special educational needs status. Ministers plan to use the model to replace the termly school census. It forms part of what the government calls a 鈥渮ero tolerance approach to absenteeism鈥. Important safeguarding checks not completed Organisations are required by law to carry out a data protection impact assessment (DPIA) for collections that are likely to result in a 鈥渉igh risk鈥 to individuals. The DfE assessed the risk of the pilot as low, but the ICO said it was 鈥渃learly in the high risk category鈥. In documents obtained by under the freedom of information act, the ICO said the DfE 鈥渄id not complete鈥 a DPIA before the collection began on February 7. Data processing 鈥渃ommenced one week prior to final sign-off鈥, it said. The department claimed when approached that it did conduct a DPIA 鈥渁s part of the preparation for the pilot鈥, but was unable to provide proof. Instead, it shared the first version of the DPIA, which was dated February 15. The dossier shows how ICO officials scrambled to find out more after the scheme鈥檚 launch. It even asked the DfE to pause the pilot until a full risk assessment could be done, but the department said this was 鈥渘ot possible鈥. 鈥楽chools wouldn鈥檛 have signed up if they knew鈥 The law also requires organisations to consult the ICO about 鈥渉igh risk鈥 collections. In an email to schools on February 8, the DfE claimed it had been 鈥渨orking closely鈥 with the ICO on the impact assessment. But the ICO ordered the DfE to correct this “inaccuracy”, as the DPIA was only shared a week after the collection began. Geoff Barton, the general secretary of the ASCL school leaders鈥 union, demanded a 鈥渇ull explanation about what went wrong and the concerns raised”. 鈥淔rom the DfE email schools would have formed the impression that the data protection impact assessment had been sorted with the ICO, when the ICO had not actually seen the impact assessment at that stage. 鈥淭his is completely unacceptable and if schools had known that an important part of the process for safeguarding data had not actually been completed, it is unlikely they would have signed up to the trial.” Attendance tracker data will be held for 66 years The ICO raised a host of other concerns, warning the DfE had not been clear about the 鈥渟pecific legislation鈥 underpinning the collection. The watchdog also warned the department鈥檚 鈥渓imited鈥 impact assessment did not 鈥渁dequately explain鈥 the need to hold the data for 66 years. A DfE spokesperson said data protection 鈥渉as been a central consideration throughout our attendance data collection pilot鈥. 鈥淲e have taken all action required under data protection laws in relation to the pilot, and voluntarily engaged with the ICO to understand the position and take any action to address the limited areas where concerns were raised.鈥 An ICO spokesperson said: 鈥淭he DfE informally engaged with us regarding its strategic data collection and we provided advice.鈥 Jen Persson The regulator refused to answer detailed questions about the DfE鈥檚 claims, nor confirm whether concerns had been addressed. It is not the first time the government has faced criticism for its handling of pupil data. In 2016, ministers were forced to admit they planned to share nationality data with the Home Office for immigration control. The controversial collection ended in 2018 after it was boycotted by schools. A damning audit by the ICO in 2020 found the department had broken data protection laws in the way it handled pupil information. Defend Digital Me has questioned the rationale for the new collection, which comes as ministers are preparing harsher penalties for school absence. Jen Persson, its director, said: 鈥淭he volume of sensitive data to be sent to the DfE for 66 years is vast. “The department suggests that it鈥檚 no different from what was collected before, just more often. But if so, then why change it?鈥