Data Protection Changes 2018
(Posted on 25/05/18)
As you may be aware, the world of Data Protection changes on May 25th 2018, with the introduction of General Data Protection Regulations (GDPR). This means that the way in which organisations handle the data of its own people and external contacts changes.
As a school, the vast majority of data we hold on our students and their parents or guardians is required for either legal reasons or in the vital interests of your child or in the public interest in our role as a school.
Notwithstanding that, and acting in line with the current DFE guidelines, we have created a new Privacy Notice for students, parents, guardians and carers. This has been published on the school’s website and can be found under Policies and Documents. This forms the basis of the way in which we handle data within our school.
We take the use of personal data very seriously and I personally assure you that we will continue to manage both the data we hold on your child and yourselves very carefully and in line with the latest advice.
Please find below a copy of our privacy notice:
PRIVACY NOTICE FOR STUDENT/PARENT INFORMATION
- What is the purpose of this document?
1.1. Christleton Learning Trust (“the Trust”) is committed to protecting the privacy and security of its students’ and parents’ personal information. This privacy notice describes how we collect and use personal information about students during and after their time at the Trust, in accordance with the General Data Protection Regulation (GDPR), together with associated data of their parents/guardians.
1.2. The Trust is a "data controller". This means that we are responsible for deciding how we hold and use personal information about students. We are required under data protection legislation to notify data subjects of the information contained in this privacy notice.
1.3. This notice applies to current and former students. Where necessary and appropriate, it is provided to parents and guardians, instead of or as well as to students directly. We may update this notice at any time.
1.4. It is important that you read this notice, together with any other privacy notice we may provide on specific occasions when we are collecting or processing personal information about you, so that you are aware of how and why we are using such information.
- Data protection principles
2.1. We will comply with data protection law. This says that the personal information we hold about you must be:
2.1.1. Used lawfully, fairly and in a transparent way.
2.1.2. Collected only for valid purposes that we have clearly explained to you and not used in any way that is incompatible with those purposes.
2.1.3. Relevant to the purposes we have told you about and limited only to those purposes.
2.1.4. Accurate and kept up to date.
2.1.5. Kept only as long as necessary for the purposes we have told you about.
2.1.6. Kept securely.
- The kind of information we hold about you
3.1. Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data).
3.2. There are "special categories" of more sensitive personal data which require a higher level of protection.
3.3. The categories of student information that we collect, hold and share include:
3.3.1. Personal information (including but not limited to name, unique student number, photo and address).
3.3.2. Characteristics (including but not limited to ethnicity, language, nationality, country of birth, free school meal eligibility or student finance status).
3.3.3. Relevant contact details (including but not limited to email, phone number (home and mobile) and emergency contact details).
3.3.4. Attendance information (including but not limited to sessions attended, number of absences and absence reasons).
3.3.5. Internal and external assessment and exam information.
3.3.6. Education history and future (including but not limited to school attendance and records).
3.3.7. Relevant medical information.
3.3.8. Special educational needs information.
3.3.9. Exclusions / behavioural information.
3.3.10. Post 16 learning information.
3.3.11. Safeguarding and welfare information.
3.3.12. Information related to school trips and activities at school (including but not limited to parental consents, dietary requirements and travel information).
3.3.13. Personal identification (such as passport, driving licence and birth certificate).
3.3.14. CCTV footage and other information obtained through electronic means (such as swipe cards/fobs for access doors).
- Why we collect and use this information
4.1. We use the student/parent data:
4.1.1. To support student learning.
4.1.2. To monitor and report on student progress and attainment.
4.1.3. To provide appropriate pastoral care.
4.1.4. To assess the quality of our services.
4.1.5. To comply with the law regarding data sharing.
4.1.6. To access enrichment and extra-curricular activities.
4.1.7. To facilitate systems used in schools (such as cashless catering, sales and school communication systems).
4.1.8. To record student financial eligibility.
4.1.9. To safeguard students and ensure their welfare.
4.1.10. To publicise the school and related achievements.
- The lawful basis on which we use this information
5.1. We will only use your personal information when the law allows us to. Most commonly, we will use your personal information in the following circumstances:
5.1.1. Where processing is necessary for compliance with a legal obligation;
5.1.2. Where processing is necessary for the performance of a task carried out in the public interest;
5.1.3. Where processing is necessary in order to protect the vital interests of a data subject or another person.
5.2. We may also use your personal information in the following situations, which are likely to be rare:
5.2.1. Where you have given consent to process personal data (if the processing is not covered under 5.1 above).
5.2.2. Where necessary to perform a contract with you.
5.3. "Special categories" of particularly sensitive personal information require higher levels of protection. We need to have further justification for collecting, storing and using this type of personal information. We may process special categories of personal information in the following circumstances:
5.3.1. In limited circumstances, with explicit written consent.
5.3.2. Where we need to carry out our legal obligations and in line with our data protection policy.
5.3.3. Where it is needed in the public interest, such as for equal opportunities monitoring or to support education, and in line with our data protection policy.
5.3.4. Where it is needed to assess the student’s health, subject to appropriate confidentiality safeguards.
5.4. Less commonly, we may process this type of information where it is needed in relation to legal claims or where it is needed to protect your interests (or someone else's interests) and you are not capable of giving your consent, or where you have already made the information public.
5.5. We may also collect and process personal data as required by the Education Act 1996, including related to censuses.
- Collecting student information
6.1. Whilst the majority of student information you provide to us is mandatory, some of it is provided to us on a voluntary basis. In order to comply with the General Data Protection Regulation, we will inform you whether you are required to provide certain student information to us or if you have a choice in this.
- Storing student data
7.1. We hold student data for no longer than necessary for the purpose for which it was obtained. The Trust is required to share certain information, such as providing information to schools/universities. It also maintains student records in accordance with national guidelines.
- Who we share student information with
8.1. We routinely share student information with:
8.1.1. Schools that students attend after leaving us.
8.1.2. Our local authority.
8.1.3. The Department for Education (DfE).
8.1.4. Other schools within Christleton Learning Trust’s multi-academy trust.
8.1.5. Awarding bodies and exam boards.
8.1.6. Tour companies providing school trips.
8.1.7. Social services and linked agencies for health and welfare.
8.1.9. School photography companies.
8.1.10. Third party learning providers (including virtual learning environments).
- Why we share student information
9.1. We do not share information about our students with anyone without consent unless the law and our policies allow us to do so.
9.2. We share student data with the Department for Education (DfE) on a statutory basis. This data sharing underpins school funding and educational attainment policy and monitoring.
9.3. We are required to share information about our students with the DfE under regulation 5 of The Education (Information About Individual Students) (England) Regulations 2013.
- Data collection requirements
10.1. To find out more about the data collection requirements placed on us by the Department for Education (for example; via the school census) go to https://www.gov.uk/education/data-collection-and-censuses-for-schools.
- Youth support services
11.1. Students aged 13+:
11.1.1. Once our students reach the age of 13, we also pass student information to our local authority and/or providers of youth support services as they have responsibilities in relation to the education or training of 13-19 year olds under section 507B of the Education Act 1996.
11.1.2. This enables them to provide services as follows:
220.127.116.11. Youth support services.
18.104.22.168. Careers advisers.
11.1.3. A parent or guardian can request that only their child’s name, address and date of birth is passed to their local authority or provider of youth support services by informing us. This right is transferred to the student once he/she reaches the age 16.
11.2. Students aged 16+:
11.2.1. We will also share certain information about students aged 16+ with our local authority and/or providers of youth support services as they have responsibilities in relation to the education or training of 13-19 year olds under section 507B of the Education Act 1996.
11.2.2. This enables them to provide services as follows:
22.214.171.124. Post-16 education and training providers.
126.96.36.199. Youth support services.
188.8.131.52. Careers advisers.
11.2.3. For more information about services for young people, please visit our local authority website.
- The National Student Database (NPD)
12.1. The NPD is owned and managed by the Department for Education and contains information about students in schools in England. It provides invaluable evidence on educational performance to inform independent research, as well as studies commissioned by the Department. It is held in electronic format for statistical purposes. This information is securely collected from a range of sources including schools, local authorities and awarding bodies.
12.2. We are required by law, to provide information about our students to the DfE as part of statutory data collections such as the school census and early years’ census. Some of this information is then stored in the NPD. The law that allows this is the Education (Information About Individual Students) (England) Regulations 2013.
12.3. To find out more about the NPD, go to https://www.gov.uk/government/publications/national-student-database-user-guide-and-supporting-information.
12.4. The department may share information about our students from the NPD with third parties who promote the education or well-being of children in England by:
12.4.1. Conducting research or analysis.
12.4.2. Producing statistics.
12.4.3. Providing information, advice or guidance.
12.5. The Department has robust processes in place to ensure the confidentiality of our data is maintained and there are stringent controls in place regarding access and use of the data. Decisions on whether DfE releases data to third parties are subject to a strict approval process and based on a detailed assessment of:
12.5.1. Who is requesting the data.
12.5.2. The purpose for which it is required.
12.5.3. The level and sensitivity of data requested.
12.5.4. The arrangements in place to store and handle the data .
12.6. To be granted access to student information, organisations must comply with strict terms and conditions covering the confidentiality and handling of the data, security arrangements and retention and use of the data.
12.7. For more information about the department’s data sharing process, please visit: https://www.gov.uk/data-protection-how-we-collect-and-share-research-data
12.8. For information about which organisations the department has provided student information, (and for which project), please visit the following website: https://www.gov.uk/government/publications/national-student-database-requests-received
12.9. To contact DfE: https://www.gov.uk/contact-dfe
- Requesting access to your personal data
13.1. Under data protection legislation, parents and students have the right to request access to information about them that we hold. To make a request for your personal information, or be given access to your child’s educational record, contact the Data Protection Officer.
13.2. You also have the right to:
13.2.1. Object to processing of personal data that is likely to cause, or is causing, damage or distress.
13.2.2. Prevent processing for the purpose of direct marketing.
13.2.3. Object to decisions being taken by automated means.
13.2.4. In certain circumstances, have inaccurate personal data rectified, blocked, erased or destroyed.
13.2.5. Claim compensation for damages caused by a breach of the Data Protection regulations.
13.3. If you have a concern about the way we are collecting or using your personal data, we request that you raise your concern with us in the first instance. Alternatively, you can contact the Information Commissioner’s Office at https://ico.org.uk/concerns/
14.1. If you would like to discuss anything in this privacy notice, please contact: the Data Protection Officer.