Who knows what about me?

The average member of the public in England visits the GP five times per year. Children and older people have the highest consultation rates. Each time someone visits the GP their medical records are updated.

There is a trend towards increased sharing of data in health – e.g. between NHS organisations (such as GP surgeries) and companies that work with them.

This might help improve the experiences of patients, including children – but it also means that patient data is passed between more organisations.

All new parents are given a paper booklet called the Red Book (or Personal Child Health Record). In this they record any illnesses, accidents or medication their child receives. GPs and Health Visitors also use it to record the child’s height and weight, vaccinations and other important health information.

A new digital version of the Red Book is being developed and trialled. The aim is to ensure that health professionals have all the information they need to make the right decisions for children.

For the first time, health professionals will be able to see the Red Book without asking parents to show it to them.

For years, supermarkets and high street shops have collected data about their customers through loyalty schemes. People signing up to these schemes may give out information about themselves or their family (including their children).

Boots Advantage Card is an example of a loyalty scheme. Card holders who are expecting a baby can join the Parenting Club. Parents give the due date for their child and are then sent vouchers and gifts tailored towards their child’s age, until the child is three and their membership ends. However Boots continues to use the information about the child to send offers to the parent.

School databases contain lots of personal information in named records, including progress reports, exam results, details of any special educational needs and any absences or exclusions. 80% of schools in the UK use a system provided by one organisation, CAPITA SIMS, to log this data. Some information is also shared with the Department for Education and included in the National Pupil Database.

The Oxford Internet Institute note that on its website, CAPITA lists 96 partners. The company reports that their partners must have the same data security procedures and values as them, but there is little information available about what data any of its partners are able to see when they achieve partner status.

Biometric data is data related to features of a person’s body, e.g. fingerprints. In 2012-13, four in ten secondary schools were collecting biometric data – it’s likely that even more collect it now.

Schools use biometric data to register pupils, record books being borrowed from the library and in canteens with cashless catering.

Some experts have expressed concerns that biometric data collected in schools could in theory be combined with biometric data from other sources to create a sophisticated data record.

There are lots of apps which teachers can use to help their students learn and manage their behaviour. For example, ClassDojo allows teachers to award positive or negative Dojo points in response to good or bad behaviour. It has been used by more than 70% of schools in the UK.

ClassDojo’s privacy policy is more than 12,000 words long. Data is shared with 31 other organisations, each of which have their own privacy policies too.

Location tracking watches are aimed at children who aren’t old enough to have their own phone. They allow parents to track their children’s location and are sold as safety devices. Like connected toys, they are becoming increasingly popular.

Research by the Norwegian Consumer Council into four location tracking watches found that none of them allowed users to delete their accounts. This means that the child’s data (which would normally include name, location history and more) is kept stored even after the watch is no longer used. Some don’t even let users delete data from the watch itself, meaning that it can be seen by others if it is resold.

Travel passes, such as Zip Oyster cards in London, are used by children to access free or discounted travel. A range of personal information is collected when signing up to or using these schemes, including personal details such as name, address and date of birth, as well as journey details.

Transport for London keep the data about an individual journey made using a Zip card in a child’s records for eight weeks. After that point the journey data is removed from the child’s account so the journey can’t be linked to the person who made it.

This process is called “pseudonymisation” – sometimes it is irreversible and the data can never be linked back to the person it is about, but sometimes it can be reversed.