From time to time you will need to share personal data or sensitive personal data with other schools or public authorities. The school, as a data controller, must ensure that it only shares data responsibly and only when necessary.
[4.1] Local Authority Disclosures
The County Council will be the authority that you disclose data to on a regular basis. Both the school and the County Council will have legal obligations to disclose data to one another in order to perform its statutory duties.
If you are ever unsure about whether you should disclose data to the local authority then you should clarify the school’s legal basis for disclosing either by conferring with your legal adviser or the information governance team.
[4.2] Central Government/Regulatory Bodies Disclosures
The school will also be required by law to disclose certain information to government departments and/or regulatory bodies, most notably the department of education and OFSTED. Both the school and central government will have a legal duty to disclose data to one another in order to perform statutory duties. Quite often this will be statistical information in order to assess the performance of schemes and projects but on other occasions you will be required to disclose personal data.
If you are ever unsure about whether you should disclose data to central government or a regulatory body then you should clarify the school’s legal basis for disclosing either by conferring with your legal adviser or the information governance team.
[4.3] Police and/or Counter Fraud Disclosures
From time to time the Police, an anti fraud team, HMRC, or other similar bodies may need to request information from your school in order to detect or prevent a crime from taking place. In order to do so the requesting authority must rely on Section 29(3) of the Data Protection Act.
If you receive such a request you must ensure the following:
-
The request is authentic and where possible (but not an absolute necessity) countersigned by a senior officer
-
The requesting authority have stated how disclosing the requested information will help their enquiry
-
The requesting authority have stated how not disclosing would prejudice their investigation
-
The disclosure is needed for the following reasons:
-
The prevention and detection of crime
-
The apprehension of prosecution of offenders
-
The assessment or collection of any tax
It is not a requirement of the law for an authority to fill in a specific form to make a request. However, locally in North Yorkshire the police force prefers that their officers submit a specific ‘Section 29 form’. Even if you disclose without such a form, for example in an emergency situation, you must have a paper trail which details that the above criteria has been considered. The Police do not have an absolute right to the information but in most circumstances it will be appropriate and proper to assist with investigations by disclosing information in a controlled way.
It is advised that a relatively senior member of staff, such as the SIRO, makes this decision and records their decision accordingly.
[4.4] NHS Disclosures
Data is customarily supplied to NHS colleagues for two purposes. The first is to ensure continuity of health care when pupils move from one school to another or change home address. The second is to facilitate the National Child Measurement Programme (NCMP). Guidance on both is available for download.
The sharing of data when pupils change school or address is notified to data subjects via the issuing of FPNs.
The National Child Measurement Programme (NCMP) is an annual programme to measure the height and weight of all children in Reception and Year 6. The NCMP information is used to help the NHS and local authorities plan and provide better health services for children. The latest Department of Health guidance for schools, together with further information on the NCMP, may be found on the Department of Health website.Schools ICT Services have produced a report that will extract the required data from SIMS. This may be downloaded from the SIMs Support Page of the Schools ICT website or by entering the search term 'NCMP' in the 'Search Schools ICT' box at the top right of any SICTS web page.
Schools should note that a wider range of data is required for the NCMP. Section 1.26 of the DoH guidance says "Schools may need to provide PCT staff with class lists containing the school name and unique reference number, pupil names, sex, dates of birth, ethnicity codes, home postcodes and home addresses when results are to be sent to parents for all pupils in Reception Year and Year 6". Also, section 1.31 explains that the collection and processing of information is governed by legal provisions in regulations under the NHS Act 2006.
-
Useful Documents
Data Protection Act 1998, Section 29 Form- NY Police Request
