The new draft home education guidance encourages information gathering on a far greater scale than any previous guidance yet has virtually nothing to say about GDPR or the statutory responsibilities of being a data controller plus there is no mention of the need for Privacy Notices or complying with Subject Access Requests.
The new guidance is not ready to be used. It is still at the draft stage. The consultation closed 18.1.24. The current guidance remains in force until such time as a final new version is published. The current guidance can be found here https://www.gov.uk/government/publications/elective-home-education
The new draft home education guidance suggests that local authorities might want to ask home educating parents for a great deal of personal information about their children in order for the LA to conduct an assessment to judge whether the child is demonstrating age-appropriate skills taking account of any particular aptitudes and allowing for special educational needs.
For local authorities acting as data controller, ignorance is no defence when it comes to GDPR or General Data Protection Regulations. There is no advice in the new draft for LAs about Subject Access Requests where an individual has a right to be told how their personal information is stored and can ask for a copy of all the information held.
The only reference to being a data controller in the draft appears in a footnote dealing with “examples of a child’s work” which just says “Each local authority is the data controller for the personal data it collects and holds and it is their responsibility to ensure compliance with data protection legislation.” Privacy Notices are not even mentioned.
Having glossed over data collection in a footnote, the draft guidance does have more to say about information sharing. The draft tells local authorities that the sharing of “relevant information” should comply with “relevant data protection legislation” in case they might have thought otherwise.