AIMS

Downlands Community School aims to ensure that all data collected about staff, pupils, parents and visitors is collected, stored and processed in accordance with the Data Protection Act 1998.

This policy applies to all data, regardless of whether it is in paper or electronic format.

POLICY

Changes to data protection legislation (GDPR May 2018) shall be monitored and implemented in order to remain compliant with all requirements. The legal bases for processing data are as follows:

• Consent: the member of staff/student/parent has given clear consent for the school to process their personal data for a specific purpose.
• Contract: the processing is necessary for the member of staff’s employment contract or student placement contract.
• Legal obligation: the processing is necessary for the school to comply with the law (not including contractual obligations)

The members of staff responsible for data protection are mainly Mark Wignall (Headteacher), Jamie Chandler (Assistant Headteacher/Data Protection Officer). However, all staff must treat all student information in a confidential manner and follow the guidelines as set out in this document.

The school is also committed to ensuring that its staff are aware of data protection policies, legal requirements and that adequate training is provided.

The requirements of this policy are mandatory for all staff employed by the school and any third party contracted to provide services within the school.

LEGISLATION AND GUIDANCE

This policy meets the requirements of the Data Protection Act 1998 and is based on guidance published by the Information Commissioner’s Office and model privacy notices published by the Department for Education and West Sussex County Council.

It also takes into account the expected provisions of the General Data Protection Regulation, which is new legislation and came into force on 25^th May 2018.

In addition, this policy complies with regulation 5 of the Education (Pupil Information) (England) Regulations 2005, which gives parents the right of access to their child’s educational record.

 DEFINITIONS

Term	Definition
Personal Data	Data from which a person can be identified, including data that, when combined with other readily available information, leads to a person being identified
Sensitive personal data	Data such as: ·         Contact details ·         Racial or ethnic origin ·         Political opinions ·         Religious beliefs, or beliefs of a similar nature ·         Where a person is a member of a trade union ·         Physical and mental health ·         Sexual orientation ·         Whether a person has committed, or is alleged to have committed an offence ·         Criminal convictions
Processing	Obtaining, recording or holding of data
Data subject	The person whose personal data is held or processed
Data Controller	A person or organisation that determines the purposes for which, and the manner in which, personal data is processed
Data Processor	A person, other than an employee of the data controller, who processes the data on behalf of the data controller

  

THE DATA PROTECTION OFFICER

Our school processes personal information relating to its pupils, staff and visitors, and, therefore, is a data controller. Our school delegates the responsibility of Data Protection Officer to Mr Jamie Chandler, Assistant Headteacher.

The school is registered as a data controller with the Information Commissioner’s Office (ICO) and renews this registration annually (Reg. No. Z5495724).

DATA PROTECTION PRINCIPLES

The Data Protection Act 1998 is based on the following data protection principles, or rules for good data handling:

• Data shall be processed fairly and lawfully
• Personal data shall be obtained only for one or more specified and lawful purposes
• Personal data shall be relevant and not excessive in relation to the purpose(s) for which it is processed
• Personal data shall be accurate and, where necessary, kept up to date
• Personal data shall not be kept for longer than is necessary for the purpose(s) for which it is processed
• Personal data shall be processed in accordance with the rights of data subjects under the Data Protection Act 1998
• Appropriate technical and organisational measures shall be taken against unauthorised or unlawful processing of personal data, and against accidental loss or destruction of, or damage to, personal data
• Personal data shall not be transferred to a country or territory outside the European Economic Area unless the country or territory ensures an adequate level of protection for the rights and freedoms of data in relation to the processing of personal data.

ROLES AND RESPONSIBILITIES

The governing board has overall responsibility for ensuring that the school complies with its obligations under the Data Protection Act 1998.

Day-to day responsibilities rest with the headteacher, or the deputy headteacher in the headteacher’s absence. The headteacher will ensure that all staff are aware of their data protection obligations, and oversee any queries related to the storing or processing of personal data.

PRIVACY NOTICE

The Legal Basis for Processing Personal Data

In order to carry out its ordinary duties to students and parents, the School may process a wide range of personal data about individuals (including current, past and prospective students or parents) as part of its daily operation.

The main reason that the school processes personal data is because it is necessary in order to comply with the school’s legal obligations and to enable it to perform tasks carried out in the public interest.

The school expects that the following uses may fall within the category of ‘public interest’:

• For the purposes of student selection (and to confirm the identity of prospective students and parents);
• To provide education services, including musical education, physical training or spiritual development, career services, and extra-curricular activities to students and monitoring student’ progress and educational needs;
• Maintaining relationships with alumnae and the school community, including direct marketing or fundraising activity
• For the purposes of management planning and forecasting, research and statistical analysis, including that imposed or provided for by law
• To enable relevant authorities to monitor the school’s performance and to intervene or assist with incidents as appropriate
• To give and receive information and references about past, current and prospective students, including relating to outstanding debts or payment history, to/from any educational institution that the pupil attended or where it is proposed they attend; and to provide references to potential employers of past students;
• To enable students to take part in national or other assessments, and to publish the results of public examinations or other achievements of students of the school;
• To safeguard students’ welfare and provide appropriate pastoral care
• To fulfil our contractual and legal obligations
• To monitor (as appropriate) use of the school’s IT and communications systems in accordance with the school’s ‘2019 Digital Acceptable Use Policy’;
• To make use of photographic images of students in school publications, on the school website and (where appropriate) on the school’s social media channels in accordance with the school’s policy on Social Media
• For security purposes, including CCTV in accordance with the school’s CCTV policy;

and

• Where otherwise reasonable necessary for the school’s purposes, including to obtain appropriate professional advice and insurance for the school

In addition, the school may need to process special category personal data (concerning health, ethnicity, religion or sexual life) in accordance with the school’s public interests, rights or duties imposed on it by law, including as regards safeguarding and employment, or from time to time by explicit consent where required.

These reasons may include:

• To safeguard students’ welfare and provide appropriate pastoral (and where necessary, medical) care, and to take appropriate action in the event of an emergency, incident or accident, including by disclosing details of an individual’s medical condition where it is in the individual’s interests to do so: for example, for medical advice, social services, insurance purposes or to organisers of school trips;
• To provide educational services in the context of any special educational needs of a pupil;
• To provide spiritual education in the context of any religious beliefs;
• For legal and regulatory purposes (for example child protection, diversity monitoring and health and safety) and to comply with its legal obligations and duties of care.

The school may also process personal data if at least one of the following applies;

• In order to protect the vital interests of an individual
• There is explicit consent
• To comply with the school’s legal obligations in the field of employment and social security and social protection law
• For the establishment, exercise or defence of legal claims or whenever courts are acting in their judicial capacity
• For reasons of public interest in the area of public health
• For reasons of substantial public interest, based on law, which is proportionate in the circumstances and which has provide measures to safeguard the fundamental rights and the interests of the data subject

The categories of pupil information that we collect, hold and share include:

• Personal information (such as name, date of birth, unique pupil number, telephone number, email addresses, address and other contact details)
• Contact details for pupils’ next of kin
• Characteristics (such as ethnicity, language, nationality, country of birth, religion and free school meal eligibility)
• Attendance information (such as sessions attended, number of absences and absence reasons)
• Assessment information (such as exam results, target grades, predicted grades and pupil reports)
• Medical information
• Special educational needs information
• Exclusion information
• Conduct information (such as behaviour and achievements)
• Bank details and other financial information, e.g about parents who pay School Fund by direct debit
• Images of students engaging in school activities and images captured by the school’s CCTV system

For students in Year 8 and above the Learning Records Service will give us the unique learner number (ULN) and may also give us details about their learning or qualifications.

National exam results are published on the school’s social media accounts as well as in local newspapers.

How we use information

The school holds personal information relating to students and those involved in their care which generally, has been received from the parent. This may be via a form, or simply in the ordinary course of interaction or communication (such as email or written assessments). We also receive information from third parties (for example another school, local authority, Department for Education (DfE) or other professionals or authorities working with that individual.

We use this personal data:

• To support pupils’ teaching and learning
• To support pupils’ welfare
• To monitor and report on pupil progress
• To provide appropriate pastoral care
• To assess the quality of our services
• To process any complaints
• To protect vulnerable individuals
• To support a young person in their transition to a post-16 provider of education or training
• To prevent and detect crime

Who we share data with

We may pass data to:

• The local authority
• Schools that a pupil attends after leaving this school
• The Department for Education (DfE)
• NHS
• Third-party organisations, as allowed by law
• Agencies that provide services on our behalf
• Agencies with whom we have a duty to co-operate

For further information about who we share with and why please see Appendix A.

Retention Periods

Personal data will not be retained by the school for longer than necessary in relation to the purposes for which they were collated.

Information will be held in accordance with the Information and Records Management Society Tool Kit for Schools – https://irms.site-ym.com/page/SchoolsToolkit

Photographs

The school may take photographs, videos or webcam recordings of students for official use, monitoring and for educational purposes. Photographs may also be taken of those attending a ceremony which may appear in the newspaper. On joining the school, parents are asked to sign a publicity/photograph/filming consent for their child. Consent can be withdrawn at any time be emailing office@downlands.w-sussex.sch.uk. Please also refer to ‘2019 Digital Images Video Policy’ and ‘2019 Social Media

CCTV

The school operates CCTV on the school site as it is considered necessary to protect pupils’ safety and/or the school property.

Biometrics

The school operates biometric recognition systems to purchase food from the canteen. All data collected will be processed in accordance with the GDPR data Protection Principles and the Protection of Freedoms Act 2012.

The written consent of at least one parent will be obtained before biometric data is taken and used. If one parent objects in writing, then the school will not take or use a child’s biometric data.

For more information about biometric data please refer to the ICO guidance at the link below:

https://www.gov.uk/government/publications/protection-of-biometic-information-of-children-in-schools

There is also a separate policy called “Biometric Data Policy” which details the processing of biometric data.

Your Rights

Under the GDPR you have the right to:

1. Be informed of data processing (which is covered by this Privacy Notice)
2. Access information (also known as a Subject Access Request)
3. Have inaccuracies corrected
4. Have information erased
5. Restrict processing
6. Data portability – (unlikely to be relevant to the school)
7. Intervention in respect of automated decision making – (automated decision making is rarely operated within the school)
8. Withdraw consent (see below)
9. Complain to the Information Commissioner’s Office (ICO)

To exercise any of these rights please contact the Data Protection Officer Mr J. Chandler jchandler@downlands.org

Subject Access Requests

Individuals have a right to request access to information the school holds about them. This is known as a subject access request. Personal data about a child belongs to that child, and not the child’s parents. This is the case even where a child is too young to understand the implications of subject access rights. For a parent to make a subject access request, the child must either be unable to understand their rights and the implications of a subject access request, or have given consent.

The Information Commissioner’s Office, the organisation that upholds information rights, generally regards children aged 12 and above as mature enough to understand their rights and the implications of a subject access request. Therefore, most subject access requests from parents of pupils at our school may not be granted without the express permission of the pupil.

If parents ask for copies of information, they will be required to pay the cost of making the copies.

Subject access requests must be submitted in writing, either by letter, email or fax. Requests should include:

• The pupil’s name
• A correspondence address
• A contact number and email address
• Details about the information requested

The school will endeavour to respond to any such written requests as soon as is reasonably practicable and, in any event within statutory time-limits, which is one month in the case of requests for access to information. The school will be better able to respond quickly to smaller, targeted requests for information. If the request is manifestly excessive or similar to previous requests, the school may ask you to reconsider or charge a proportionate fee, but only where Data Protection Law allows it.

The school will not reveal the following information in response to subject access requests:

• Information that might cause serious harm to the physical or mental health of the pupil or another individual
• Information that would reveal that the child is at risk of abuse, where disclosure of that information would not be in the child’s best interests
• Information contained in adoption and parental order records
• Certain information given to a court in proceedings concerning the child

Data Accuracy and security

The school will endeavour to ensure that all personal data held in relation to an individual is as up to date and accurate as possible. Individuals must notify the school at least on an annual basis of any changes to information held about them. Responsibility for changes in information relating to students rests with the parent.

An individual has the right to request that any inaccurate or out-of-date information about them is erased or corrected (subject to certain exemptions and limitations under the Act).

Withdrawal of Consent

The lawful basis upon which the school process personal data is that it is necessary in order to comply with the schools legal obligations and to enable it to perform tasks carried out in the public interest.

Where the school processes personal data solely on the basis that you have consented to the processing, you have the right to withdraw that consent.

STORAGE OF RECORDS

Paper based records and portable electronic devices, such as laptops and hard drives that contain personal information are kept under lock and key when not in use.

Papers containing confidential personal information should not be left on office and classroom desks, on staffroom tables or pinned to noticeboards where there is general access.

Where personal information needs to be taken off site (in paper or electronic form) staff must sign it in and out from the school office.

Passwords that are at least 8 characters long containing letters and numbers are used to access school computers, laptops and other electronic devise. Staff and pupils are reminded to change their passwords at regular intervals.

Encryptions software is used to protect all portable devices and removable media, such as laptops and USB devices.

Staff, pupils and governors who store personal information on their personal devices are expected to follow the same security procedures for school-owned equipment.

DISPOSAL OF RECORDS

Personal information that is no longer needed or has become inaccurate or out of date, is disposed of securely.

For example, we shred or incinerate paper-based records and overwrite electronic files. We may also use an outside company to safely dispose of electronic records.

TRAINING

Our staff and governors are provided with data protection training as part of their induction process.

Data protection will also form part of continuing professional development, where changes to legislation or the school’s processes make it necessary.

 THE GENERAL DATA PROTECTION REGULATION

We acknowledge that the law is changing on the rights of data subjects and that the General Data Protection Regulation came into force in May 2018.

We will review working practices when this new legislation takes effect and provide training to members of staff and governors where appropriate.

 MONITORING ARRANGEMENTS

Mr Jamie Chandler is responsible for monitoring and reviewing this policy.

This document will be reviewed when the General Data Protection Regulation comes into force, and then every 2 years.

At every review, the policy will be shared with the governing board.

 LINKS WITH OTHER POLICIES

This Data Protection Policy and Privacy Notice is linked to the freedom of information publication scheme.

QUERIES AND COMPLAINTS

Any comments or queries on this policy and privacy notice should be directed to the Data Protection Officer Mr J. Chandler using the email address: jchandler@downlands.org

If an individual believes that the school has not complied with the privacy notice or acted otherwise than in accordance with Data Protection Law, they should utilise the school complaints or grievance procedure and the Data Protection Officer. The school can also make a referral to, or lodge a complaint with the Information Commissioner’s Office (ICO) although the ICO recommends that steps are taken to resolve the matter with the school before involving the regulator.

The Information Commissioner can be contacted at:

The Information Commissioner’s Office

Wycliffe House

Water Lane

Wilmslow

Cheshire

SK9 5AF

Appendix A

Who we share data with and why

We do not share information about pupils with anyone without consent unless the law and our policies allow us to do so.

We share pupils’ data with the Department for Education (DfE) on a statutory basis. This data sharing underpins school funding and educational attainment policy and monitoring.

We are required to share information about our pupils with our local authority (LA) and the Department for Education (DfE) under section 3 of the Education (Information About Individual Pupils) (England) Regulations 2013.

To find out more about the data collection requirements placed on us by the Department for Education (for example; via the school census) go to:

https://www.gov.uk/education/data-collection-and-censuses-for-schools

Once pupils reach the age of 13, the law requires us to pass pupil information to the local authority and/or the provider of Youth Support Services in the area as they have responsibilities in relation to the education or training of 13-19 year olds under section 507B of the Education Act 1996.

This enables them to provide services as follows:

• Youth support services
• Careers advisers

A parent or guardian can request that only their child’s name, address and date of birth is passed to their local authority or provider of youth support services by informing us. This right is transferred to the child/pupil once he/she reaches the age 16.

 The National Pupil Database (NPD)

The NPD is owned and managed by the Department for Education and contains information about pupils in schools in England. It provides invaluable evidence on educational performance to inform independent research, as well as studies commissioned by the Department. It is held in electronic format for statistical purposes. This information is securely collected from a range of sources including schools, local authorities and awarding bodies.

We are required by law, to provide information about our pupils to the DfE as part of statutory data collections such as the school census and early years’ census. Some of this information is then stored in the NPD. The law that allows this is the Education (Information About Individual Pupils) (England) Regulations 2013.

To find out more about the NPD, go to:

https://www.gov.uk/government/publications/national-pupil-database-user-guide-and-supporting-information

The department may share information about our pupils from the NPD with third parties who promote the education or well-being of children in England by:

• Conducting research or analysis
• Producing statistics
• Providing information, advice or guidance

The Department has robust processes in place to ensure the confidentiality of our data is maintained and there are stringent controls in place regarding access and use of the data. Decisions on whether the DfE releases data to third parties are subject to a strict approval process and based on a detailed assessment of:

• Who is requesting the data
• The purpose for which it is required
• The level and sensitivity of data requested: and
• The arrangements in place to store and handle the data

To be granted access to pupil information, organisations must comply with strict terms and conditions covering the confidentiality and handling of the data, security arrangements and retention and use of the data.

For more information about the department’s data sharing process, please visit:

https://www.gov.uk/data-protection-how-we-collect-and-share-research-data

For information about which organisations the department has provided pupil information, (and for which project), please visit the following website:

https://www.gov.uk/government/publications/national-pupil-database-requests-received

To contact the DfE: https://www.gov.uk/contact-dfe

Primary Care Trusts (PCT’s)

We are required, by law, to pass certain information about our pupils to PCT’s.

PCT’s use information about pupils for research and statistical purposes, to develop, monitor and evaluate the performance of local health services. These statistics will not identify individual pupils. It is necessary for certain health information about children (for example, such as their height and weight) to be retained for a certain period of time (designated by the Department of Health) and requires these PCT’s to maintain children’s names and addresses for this purpose. PCT’s may also provide individual schools and Local Authorities (Las) with aggregated health information which will not identify individual children.

Local Authority – Education and Training

We are required, by law, to pass certain information about our pupils to local authorities.

The LA holds information about young people living in its area, including about their education and training history. This is to support the provision of their education up to the age of 20 (and beyond this age for those with a special educational need or disability). Education institutions and other public bodies (including the DfE, police, probation and health services) may pass information to the LA to help them do this.

The LA shares some of the information it collects with the DfE to enable them to; produce statistics, assess performance, determine the destinations of young people after they have left school or college and to evaluate Government funded programmes.

The LA may also share information with post-16 education and training providers to secure appropriate support for them. They may also share data with education establishments which shows what their pupils go on to do after the age of 16.

If you want to see a copy of the information about you that the LA holds, please contact the Data Protection Officer: FOI@westsussex.gov.uk

Local Authority – Social Services

In order to comply with our statutory safeguarding duties we are required, by law, to pass certain information about our pupils to local authorities. Information will only be shared where it is fair and lawful to do so.

Police, Fire and Rescue Service, Ambulance Service and other emergency or enforcement agencies

In order to comply with our duty of care to pupils, our statutory safeguarding duties and our obligations in respect of the prevention and detection of crime, we may also share personal data with other statutory and partnership agencies.