Schools monitoring student internet use

A recent story in the Sunday Times highlighted that a number of schools now use sophisticated monitoring services, provided by the commercial company e-Safe Systems Ltd, to monitor the online activities of the pupils at their schools. The monitoring extends to all use of school resources, including when pupils, or staff, log on to school networks from home using their own devices, or use school-owned devices at home. The purpose of the monitoring is to safeguard children. But the immediate concern raised by the newspaper article was whether students and their parents were aware that this monitoring was taking place; it was suggested that some schools had inadequate systems in place to inform those affected, and that there was a lack of transparency about this oversight.

Oral evidence given by e-Safe’s Managing Director to the House of Lords’ recent inquiry into children and the internet described how the company’s system will scrutinise the material coming to a device’s screen linked to a school network, or a school-owned device even when offline, reviewing images, words and phrases. When the technology detects material thought to be inappropriate or which matches terms in the company’s extensive 'threat libraries’, its specialist staff receive a screenshot of what the user was looking at on the screen. This can then be reviewed by staff and may trigger an alert or a report, sent to the relevant contact at the school. The Director gave extensive evidence of the range of threats which have been identified, and of the specialist analysis and support offered.

It should surprise no-one that schools have filtration systems in place, blocking access to extremist or harmful sites. In fact it would be surprising if those systems were absent. By contrast, the use of monitoring systems might not be readily anticipated by parents and their children. However, the Department of Education’s statutory guidance 'Keeping Children Safe in Education’ (September 2016), states that 'As schools and colleges increasingly work online, it is essential that children are safeguarded from potentially harmful and inappropriate online material. As such, governing bodies and proprietors should ensure appropriate filters and appropriate monitoring systems are in place.' The ‘appropriateness’ of any filters and monitoring systems are regarded as matters for individual schools and colleges, and the DfE does not define ‘appropriate’; but there is further guidance available from the UK Safer Internet Centre. Whilst direct supervision of screens might work for young pupils using computers in a teacher-led class, more sophisticated systems of raising alerts may be needed as pupils develop their use of the internet.

From the perspective of the Data Protection Act 1998, students and parents, as well as staff, always need to be properly informed about any monitoring that takes place. The guidance from the UK Safer Internet Centre requires schools to ask themselves: 'How are all users made aware that their online access is being monitored? How are expectations of appropriate use communicated and agreed? Does the technology provider offer any advice or guidance?' So schools must have clear policies on the appropriate use of school networks, internet and emails, which should state not only merely that monitoring takes place, but its purpose and its scope: if it covers, for example, not only the use of school computers, but also any device making use of the school’s network, and with whom information will be shared. And to be transparent, policies must not only exist, but written in straightforward terms and properly publicised.

After hearing the evidence summarised above, and much more, the House of Lords’ report 'Growing Up with the Internet’ (21 March 2017) concluded that: ‘We caution that internet safety systems should not undermine children’s rights to privacy, to learn about the world and to express themselves. The Government should require schools to obtain the informed consent of parents and students, and they should have the opportunity to opt out.’ (paragraph 332).

But ‘informed consent’ as the basis for lawful monitoring is difficult, as is the right to opt out. School policies may well ask that parents and their children sign their ‘safe use of technology’ policy to indicate not merely that they have read it, but that they ‘consent’ to the monitoring activities that have been outlined. But asking for consent implies that it can be withheld, and there are very real difficulties in managing any rights to ‘say no’ or to opt out. From the perspective of a school, parents and their children are likely to be asked to agree to monitoring as the ‘price’ of accessing an essential part of school life. Schools may take the view that no-one would be able to refuse consent to this activity and yet remain a part of the school community; or that it would be unworkable and unsafe to have one section of that community’s activities monitored, whilst others had opted out.

In those circumstances, perhaps the true justification for lawful monitoring derives less from the consent of the data subject (or their ‘explicit consent’, given that there is potential for some material monitored to consist of ‘sensitive’ personal data, i.e., to reveal information about issues such as political or religious beliefs), than some of the alternative bases for ‘lawful processing’ currently contained in Schedules 2 and 3 of the Data Protection Act 1998. These are justifications based on the duties owed by a school, and the public interest in preventing unlawful acts.

All of these issues will soon require reconsideration in the light of the new General Data Protection Regulation (the GDPR), European legislation that is due to come into force in May 2018. This will introduce further requirements for schools to consider. The contents of information rights notices have been broadened, the concept of ‘informed consent’ has been better defined, and the conditions for lawful processing have, at least for ‘public authorities’, been narrowed.

Time to take stock, and review best practice, in partnership with parents, pupils and staff.

Eleanor Grey QC, 39 Essex Chambers