The General Data Protection Regulation from 25 May 2018, the rules around data protection are changing. The ‘General Data Protection Regulation’ (GDPR) will change how we can use personal data and keep it safe, and will also strengthen your rights over your and your child’s data. The purpose of the regulation is to make sure that sensitive or private information about yourselves and your children stays safe. Whilst the new arrangements are similar to the current Data Protection Act in many ways, there are a few differences, so we need to make some changes at the school in order to ensure we remain compliant.
The celebration of our pupil’s success is very important to us at Stonehouse Park Infant School and we enjoy using wonderful photographs of our pupils in action in the classroom and in the many extra-curricular activities which they participate in during the school year. We recorded your consent to capture and use visual images when you signed our parental agreement on our Admissions Form.
The process of becoming fully GDPR compliant will be a long one because it affects all aspects of the School. We do already have strong Data Protection policies and protections but these now all need to be updated in line with GDPR. Furthermore the BIG change with GDPR is that we now have to produce a lot of documentation to prove our compliance. This is what is going to take us a long time! But rest assured, we are working on it to make sure that GDPR will be central to our day-to-day culture. We already highly value and protect all of our student, parent and staff data and will continue to do so in the presence of GDPR.
As a parent/carer you may receive some letters from us regarding GDPR. Some of those may be about consent and some about updating your information with us. Please do read and send back everything you receive.
Privacy Notice (How we use your information)
A new data privacy law was introduced in the UK on 25 May 2018. As a result, we’re publishing a new Privacy Notice to make it easier for you to find out how we use and protect your information. We won’t be changing the ways we use your personal information, but the new notice will provide you with additional details.
Collecting personal information
Whilst the majority of personal information you provide to us is mandatory, some of it is provided to us on a voluntary basis. In order to comply with the General Data Protection Regulation, we will inform you whether you are required to provide certain personal information to us or if you have a choice in this.
Why we collect and use your information?
We will process your personal data for the following purposes:
- For the purpose to which you provided the information, e.g. processing information given on enquiry form so as to process that enquiry, and to monitor our performance in responding to your request.
- To allow us to be able to communicate and provide services
- To ensure that we meet our legal requirements
- Where the school is legally obliged to undertake such processing.
- Where the processing is necessary for the school to comply with its legal obligations, e.g. the prevention and/or detection of crime
- To process financial transactions including payments and benefits involving the school, or where the school is acting on behalf of other government bodies, e.g. the Local Authority and Department for Work and Pensions.
- Where you have consented to the processing
- Where necessary to protect individuals from harm or injury
- Where otherwise permitted under the Data Protection Act 2018, e.g. disclosure to comply with legal obligations.
In deciding what personal data to collect, hold and use, we are committed to ensuring that it will:
- Recognise that any personal data handled by us is held on behalf of that person and that we ensure we respect that responsibility.
- Adopt and maintain high standards in respect of the handling and use of that personal data.
- Only collect, hold and use personal data where it is necessary and proportionate to do so.
- Securely delete any personal data when no longer needed.
- Keep your personal data secure and safe.
- Not unnecessarily and without good reason, infringe the privacy of individuals.
- Consider and address the privacy risks first when planning to use or hold personal information in new ways, such as when introducing new systems.
- Be open with individuals about how we use their information and who we give it to.
- Make it easy for individuals to access and correct their personal information.
- Ensure that there are effective safeguards and systems in place to make sure personal information is kept securely and does not fall into the wrong hands.
- Provide training to staff who handle personal information and treat it as a disciplinary matter if they misuse or don’t look after personal information properly.
The school may disclose personal data to third parties, but only where it is necessary, either to comply with a legal obligation, or where permitted under the Data Protection Act, e.g. where the disclosure is necessary for the purposes of the prevention and/or detection of crime, or where it is necessary to allow a third party working for or on behalf of the school.
We will ensure that any personal data in our care will be kept safe and that where your information is disclosed to a third party, we will seek to ensure that the third party has sufficient systems and procedures in place to prevent the loss of personal data.
Where we seek to disclose sensitive personal data, such as medical details, to third parties, we will do so only with your prior consent or where we are legally required to do so.
We will process your personal data for the above purposes for no longer than necessary
Your rights are set out in in Articles 13 to 22 of the General Data Protection Regulation 2016/679 (GDPR) and include:
- The right to access your personal information, to request rectification or erasure of certain personal information and to object to processing in certain circumstances.
- The right to withdraw any consent you may have given to process your personal information.
- The right to complain to the Information Commissioner if you feel we are processing your personal information unlawfully.
- The right to restrict processing activity in certain circumstances.
- The right to object to certain types of processing activity.
While the school tries to ensure that any personal data it holds about you is correct, there may be situations where the information it holds is no longer accurate. If you find that this is the case, please contact Mrs Susan Brown, Office Manager, so that any errors can be investigated and corrected, or your details updated.
You have the right to request that the school cease processing your personal data in relation to any of our services. Where possible, the school will seek to comply with your request; however, ceasing to process your information may cause delays or hinder the school’s ability to provide services to you. There may be some situations where it will not be able to do this, e.g. where the school is required to hold or process information to comply with a legal requirement or obligation.
The school will not use your personal data for third party marketing purposes without your prior express consent.
The school will not sell or rent your personally identifiable information to anyone, or use the data for any other purpose incompatible with the purpose for which it was originally collected.
The school will not pass any personal data on to third parties, other than those who either process information on our behalf or because of a legal requirement, and it will only do so, where possible, after we have ensured that sufficient steps have been taken to protect the personal data by the recipient. We will only send personally identifiable information about you to other companies when we have your consent, or have a legal reason to do so. We will only hold your information for as long as necessary for these purposes.
If you have a concern about the way we are collecting or using your personal data, you should raise your concern with us in the first instance or directly to the Information Commissioner’s Office at https://ico.org.uk/concerns/
You are also legally entitled to request access to any personal information held by us about you and/or your child by making a Subject Access Request under Article 15 of the General Data Protection Regulation. Please note you can only obtain information which is about yourself (or your child/ren if under the age of 13, after which they may have capacity to apply in their own right). Again, we will seek to comply with your request but there may be some situations where it may not be able to do this in full, e.g. where information held was given in confidence, and to do so will disclose the source, contrary to a third party’s privacy rights.
If you wish to make any such application, please write to: Mrs Susan Brown, Office Manager.
Please be as specific as you can about the information you seek as this helps us to find it as quickly as possible.
Before providing you with your personal information, we will need to see evidence to confirm your identity (this can be by scan or photocopy of a passport or driving licence or birth certificate) and address (similarly by scan/copy of a utility bill or official letter header). Your identity evidence will not be retained after it has been examined.
If you are seeking information from your child(ren)’s records, in addition we will need to see something to prove parental responsibility such as copies of the child(ren)’s birth certificates.
If you would like to discuss anything in this privacy notice, please contact:
- Stonehouse Park Infant School, Mrs Susan Brown, Office Manager
If you require general information about the Data Protection Act 2018 and General Data Protection Regulation, information is available from the Information Commissioner.
Information Commissioner’s Office
Tel: 0303 123 1113 (local rate) or 01625 545 745 if you prefer to use a national rate number.
(How we use School Workforce Information)
A new data privacy law is being introduced in the UK from 25 May 2018. As a result, we’re publishing a new Privacy Notice to make it easier for you to find out how we use and protect your information. We won’t be changing the ways we use your personal information, but the new notice will provide you with additional details.
The categories of school workforce information that we collect, process, hold and share include:
- personal information (such as name, employee or teacher number, national insurance number)
- special categories of data including characteristics information such as gender, age, ethnic group
- contract information (such as start dates, hours worked, post, roles and salary information)
- work absence information (such as number of absences and reasons)
- qualifications (and, where relevant, subjects taught)
Why we collect and use this information
We use school workforce data to:
- enable the development of a comprehensive picture of the workforce and how it is deployed
- inform the development of recruitment and retention policies
- enable individuals to be paid
The lawful basis on which we process this information
We process this information under the Education Act 1996 and the EU General Data Protection Regulation 2016/679 including Article 6 ‘Lawfulness of processing’ and Article 9 ‘Processing of special categories of personal data’
Collecting this information
Whilst the majority of information you provide to us is mandatory, some of it is provided to us on a voluntary basis. In order to comply with data protection legislation, we will inform you whether you are required to provide certain school workforce information to us or if you have a choice in this.
Storing this information
We hold school workforce data for the time specified in the school’s data retention policy.
Who we share this information with
We routinely share this information with:
- our local authority
- the Department for Education (DfE)
Why we share school workforce information
We do not share information about workforce members with anyone without consent unless the law and our policies allow us to do so.
We are required to share information about our workforce members with our local authority (LA) under section 5 of the Education (Supply of Information about the School Workforce) (England) Regulations 2007 and amendments.
Department for Education (DfE)
We share personal data with the Department for Education (DfE) on a statutory basis. This data sharing underpins workforce policy monitoring, evaluation, and links to school funding / expenditure and the assessment of educational attainment.
We are required to share information about our school employees with our local authority (LA) and the Department for Education (DfE) under section 5 of the Education (Supply of Information about the School Workforce) (England) Regulations 2007 and amendments.
Data collection requirements
The department may share information about school employees with third parties who promote the education or well-being of children or the effective deployment of school staff in England by:
- conducting research or analysis
- producing statistics
- providing information, advice or guidance
The department has robust processes in place to ensure that the confidentiality of personal data is maintained and there are stringent controls in place regarding access to it and its use. Decisions on whether DfE releases personal data to third parties are subject to a strict approval process and based on a detailed assessment of:
- who is requesting the data
- the purpose for which it is required
- the level and sensitivity of data requested; and
- the arrangements in place to securely store and handle the data
To be granted access to school workforce information, organisations must comply with its strict terms and conditions covering the confidentiality and handling of the data, security arrangements and retention and use of the data.
For more information about the department’s data sharing process, please visit:
To contact the department: https://www.gov.uk/contact-dfe
Requesting access to your personal data
Under data protection legislation, you have the right to request access to information about you that we hold. To make a request for your personal information, contact Mrs Susan Brown, Office Manager.
You also have the right to:
- object to processing of personal data that is likely to cause, or is causing, damage or distress
- prevent processing for the purpose of direct marketing
- object to decisions being taken by automated means
- in certain circumstances, have inaccurate personal data rectified, blocked, erased or destroyed; and
- claim compensation for damages caused by a breach of the Data Protection regulations
If you have a concern about the way we are collecting or using your personal data, we ask that you raise your concern with us in the first instance. Alternatively, you can contact the Information Commissioner’s Office at https://ico.org.uk/concerns/
If you would like to discuss anything in this privacy notice, please contact:
Mrs Susan Brown, Office Manager, 01453 823052