An investigation has been launched after betting companies were “wrongly provided access” to an education database containing the information of 28 million children.
The massive breach was revealed through a Sunday Times investigation which found the Learning Records Service had been accessed by data intelligence firm GB Group – whose clients include 32Red and Betfair among other gambling companies.
The data contains names, ages and addresses of children aged 14 and over in schools and colleges across England, Wales and Northern Ireland.
The Department for Education (DfE) has referred the breach to data regulators the Information Commissioner’s Office and disabled the database.
An ICO spokesperson said: “We have received a report from the Department for Education and we will be making enquiries.”
Education secretary Gavin Williamson reportedly told the department to “leave no stone unturned” during its investigation.
A DfE spokesperson said: “We have not shared any data with GBG.
“An education training provider wrongly provided access to this data and broke their agreement with us. This was completely unacceptable and we have immediately stopped the firm’s access and ended our agreement with them. We will be taking the strongest possible action.”
The Education and Skills Funding Agency has since begun a full investigation of access to the data “to make sure this doesn’t happen again”.
The spokesperson said any provider found to be in breach of their contracts will “have their agreements terminated”.
According to the Sunday Times report GB Group had a confidential contract through another company to access the database.
The group then used this information for age and identity verification services for its clients.
The Sunday Times reported the government had provided access to the Learning Records Service to employment screening company Trust Systems Software (UK) – which trades as Trustopia.
It is now investigating whether this firm provided access to GB Group.
Steven Hewitt, a management information system expert, explained the LRG is primarily a data checking tool “for colleges to work out what GCSE grades people are turning up with”.
He said: “It’s clearly personal information and information collected for an entirely different purpose than that for which it is being used.
“This is definitely something the ICO should be investigating.”
Trustopia has denied providing the GB Group with access to the database and founder Ronan Smith said it “placed the highest possible premium” on the lawful handing of data.
A GB Group spokesperson said: “We can confirm that we use the Learning Records Service dataset via a third party. We take claims of this nature very seriously and, depending on the results of our review, we will take appropriate action.”
A 32Red spokesperson said: “Allegations that 32Red, among other betting companies, has access to the Learning Records Service database are untrue and unfounded.
“As a responsible betting operator we have zero tolerance on under-age gambling. We are legally required to verify a number of criteria, including the age of people who wish to enjoy our services to ensure that they are over the age of 18.
“The only information 32Red has access to is confirmation or rejection that the person requesting to open an account with us is over the age of 18, and not specific details about that person.”