This page contains information about Data Protection Fair Processing: Privacy Notices in schools
Privacy Notices should be provided to new learners and their parents. Good practice is to check at least annually that pupil data is accurate. Secondary schools should ensure that after Privacy Notices have been issued, the "Youth Support Service Agreement" (formerly Connexions Assent) field in the school MIS is correctly completed. "Unsought" should be replaced with "Sought, No Response" or whatever response is made, and any opt-outs communicated in writing to the LA.
The Data Protection Act 1998 put in place numerous safeguards regarding the use of personal data by organisations, including the Department for Education, local authorities and schools. This area of law is complex. The Act gives rights to those about whom data is held, known as data subjects. This includes:
- the right to know the types of data being held
- why it is being held, and
- to whom it may be communicated.
Privacy Notices are designed to meet those needs of the Act and should be brought to the attention of all pupils for whom data is being submitted in the School Census.
The process of issuing Privacy Notices was revised in 2009, with a single, short and easily understandable Privacy Notice which includes web addresses for further details of how data is used and shared. So Notices do not need reissuing when there have been only minor changes to the text.
The notice applies to all category of school including early year's settings and Pupil Referral Units and there is a new link to a web page for information about children and young peoples' services. Please note: the DfE advises there is no requirement for Notices to be re-issued to existing pupils and children on an annual basis provided that any changes are updated on the school's website or any other accessible communication medium.
Privacy Notices must be issued for all new learners at a school, to the parents of younger children, and to pupils aged 12 or more themselves. Notices can be issued at the same time as other communications. The DfE advises that, for example, a learner might receive the Privacy Notice as part of a school brochure, or induction pack, or in a school diary, and/or it could be posted on the school notice board.
The Privacy Notice refers the recipients to the county council website to see how the local authority will store and use the data. That www.northyorks.gov.uk/schoolrecords web page includes details of local bodies with which NYCC shares data. Likewise, the Notice also refers recipients to the DfE's website to see how the Department will store and use the data and similarly includes details of organisations with whom data will be shared. As previously, hard copies of information on web pages should be provided on request for parents without internet access.
In order to ensure that the data held about the pupil is correct, the DfE anticipates that schools will continue to issue a data sheet setting out what data is held and any additional data required.
The red text in the model Privacy Notices indicates where the issuing school should add information to meet local circumstances (for example the school's address or website URL). Now that the Privacy Notice is a simpler document, one model Notice is provided for nursery, primary, special, secondary schools, and pupil referral units with two paragraphs for secondary schools that nursery and primary schools should omit. Special schools will need to use the version(s) appropriate to the age of their pupils.
It is anticipated that young people who have the maturity to understand the nature and the implications of the request they are making, and who have a general understanding of their rights under the Data Protection Act, should generally be able to request to see their personal information themselves under the Subject Access Provisions (S.7) of the Data Protection Act. For children under 12, their parents will generally act on their behalf. In every case, it will be for the school, as data controller, to assess whether the child is capable of understanding their rights under the Act, and the implications of their actions and so decide whether the parent needs to make the request on the child's behalf.
If schools intend to share data outside the parameters of the fair processing Privacy Notice they should ensure that they have the sanction of their own legal advisers to do so, that such sharing complies with the Data Protection Act 1998 and that they include the organisations they will be sharing with in the Privacy Notice.
A paragraph for secondary pupils covers the rights of parents or pupils, under the Learning and Skills Act 2000, to opt out from the provision of information to the local Youth Support Services (formerly the 'Connexions' service).
It is expected that by age 16 pupils themselves will have the capacity to exercise this right. Accordingly NYCC advises that it is good practice for schools to re-issue the Notice to pupils attaining that age to enable them to exercise this right if desired. Schools should inform Alison.firstname.lastname@example.org or Stuart.email@example.com in writing of any such opt-outs.
North Yorkshire County Council
Schools should also continue to notify health colleagues of pupils changing school or address. Guidance on the sharing of data with health colleagues regarding the NCMP and pupils moving school or address is available below.