Version |
1.6 |
Review Date |
September 2022 |
|
Review Cycle |
Annually |
Review Due |
September 2023 |
|
Author / Owner |
Shirley Levy / Steven Coates |
Table of Contents
Appendix 1: Personal Data Breach Procedure.............................................................................. 17
This document draws on content contained within the Bournemouth, Christchurch and Poole Council (BCP) Information Security policy and adds additional content as considered appropriate to Winchelsea School or to specify where the approach of the school may differ:
REFERENCE - Policies\CURRENT NON-STATUTORY POLICIES\Borough ICT Policies\Information
This school aims to ensure that all personal data collected about staff, pupils, parents, governors, visitors and other individuals is collected, stored and processed in accordance with the provisions of the Data Protection Act 2018 (DPA) and that the rights of individuals are appropriately protected. The school takes its responsibilities in regard to these matters with the utmost seriousness.
This policy applies to all personal data, regardless of whether it is held in paper or electronic format.
This policy and the school’s approach to these matters are designed to meet the requirements of the DPA, being the principal governing statute. It replaced the provisions of the Data Protection Act 1998 and represented an attempt to modernise Data Protection law and to incorporate the provisions of the General Data Protection Regulation (GDPR) which was directly applicable in each of the member states by virtue of Article 288 of the Treaty on the Functioning of the European Union, however, GDPR had to be supplemented by national legislation to ensure it functioned effectively, hence the enactment of consolidating primary legislation, namely the DPA.
With effect from 1 January 2021, the DPPEC (Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit)) Regulations 2019 amended the DPA and merged it with the requirements of the EU GDPR to form a new, UK-specific data protection regime that works in a UK context after our withdrawal from the European Union. This new regime is known as the ‘UK GDPR’.
UK organisations are now obliged to align their GDPR documentation with the requirements of the UK GDPR and reflect the UK’s independent jurisdiction and the specific scope and wording of the UK GDPR. As of the date of the renewal of this Policy, no significant variance has yet taken place.
Other relevant legislation exists. The most important amongst these are:
Education (Pupil Information) (England) Regulations 2005
Environmental Information Regulations 2004
Freedom of Information Act 2000
Human Rights Act 1998
Privacy and Electronic Communication Regulations 2003
Additional guidance is available from the Information Commissioner’s Office (ICO). The ICO is a non-departmental public body which reports directly to Parliament and is sponsored by the Department for Digital, Culture, Media and Sport (DCMS). It acts as the independent regulatory office in charge of upholding information rights in the interest of the public.
It is also borne in mind that English common law has traditionally protected an individual's right to expect that personal information about him or her will be kept confidential. Information will be protected if it has "the necessary quality of confidence about it" and has been imparted in circumstances where a clear obligation of confidence exists.
The duty of confidentiality is important but is not absolute and information can be disclosed in certain circumstances, for example where consent has been given, where disclosure is required by law or the wider public interest. Examples of such disclosures include:
Even excepting the existence of any Data Protection legislation, there is a requirement under the normal course of events for the school and its staff to honour the confidentiality of the personal data it holds.
Term |
Definition |
Personal Data |
Any information relating to an identified or identifiable individual.
This may include the individual’s:
It may also include factors specific to the individual’s physical, physiological, genetic, mental, economic, cultural or social identity. |
Special Categories of Personal Data |
Personal data which is more sensitive and so needs more protection, including information about an individual’s:
|
Processing |
Anything done to personal data, such as collecting, recording, organising, structuring, storing, adapting, altering, retrieving, using, disseminating, erasing or destroying. Processing can be automated or manual. |
Data Subject |
The identified or identifiable individual whose personal data is held or processed. |
Data Controller |
A person or organisation that determines the purposes and the means of processing of personal data. |
Data Processor |
A person or other body, other than an employee of the Data Controller, who processes personal data on behalf of the Data Controller. |
Personal Data Breach |
A breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data. |
Parent / Carer |
Includes any person having parental responsibility or care of a child as set out by S.576 Education Act 1996. |
This school processes personal data relating to parents, pupils, staff, governors, visitors and others, and therefore is a Data Controller.
The school is registered as a Data Controller with the ICO and renews this registration annually or as otherwise legally required.
The school’s Registration Reference is Z650678X.
The ICO has produced a very useful guide setting out the difference between Data Controllers and Data Processors: Data Controllers and Data Processors: what the difference is and what the governance implications are
Whilst this has yet to be updated by the ICO following the passing of the DPA, these changes will only be subtle.
Quoting briefly from S.10 of this guide: The definition of ‘processing’ suggests that a data processor’s activities must be limited to the more ‘technical’ aspects of an operation, such as data storage, retrieval or erasure. Activities such as interpretation, the exercise of professional judgement or significant decision-making in relation to personal data must be carried out by a data controller. This is not a hard and fast distinction and some aspects of ‘processing’, for example ‘holding’ personal data, could be common to the controller and the processor.
This policy applies to all staff employed by our school, and to external organisations or individuals working on our behalf. Staff who do not comply with this policy may face disciplinary action.
5.1 Governing Body
The Governing Body has overall responsibility for ensuring that the school complies with all relevant Data Protection obligations.
5.2 Data Protection Officer
The Data Protection officer (DPO) is responsible for overseeing the implementation of this policy, monitoring our compliance with Data Protection law, and with developing related policies, procedures and guidelines where applicable. The DPO will also appropriately document the school’s approach and undertake periodic data audits as applicable.
The DPO is also the first point of contact for individuals whose data the school processes, and for the ICO.
Our DPO is Mr S Coates and is contactable: [email protected].
5.3 Headteacher
The Headteacher is the named Data Controller on a day-to-day basis for the purposes of the ICO.
5.4 All Staff
All staff are responsible for:
The GDPR is based on Data Protection principles with which the school must comply. The principles state that personal data must be:
Additionally, the school is required to take responsibility for compliance with the principles, and to have appropriate processes and records in place to demonstrate appropriate compliance.
This policy sets out how the school aims to comply with these principles.
7.1 Lawfulness, Fairness and Transparency
The school will only process personal data where one of 6 ‘lawful bases’ (legal reasons) to do so under Data Protection law exists:
For special categories of personal data, the school will also meet one of the special category conditions for processing which are set out in the DPA.
Should the school offer online services to pupils, such as classroom apps, and intend to rely on consent as a basis for processing, parental consent will be obtained (except for online counselling and preventive services).
Whenever personal data is collected directly from individuals, they will be provided with the relevant information required by Data Protection law.
7.2 Limitation, Minimisation and Accuracy
The school will only collect personal data for specified, explicit and legitimate reasons and will explain these reasons to the individuals when their data is first collected.
If personal data is to be used for reasons other than those given when it was first obtained, the school will inform the individuals concerned prior to doing so, and seek consent where necessary.
Personal data will only be processed where it is necessary for school staff to properly undertake the responsibilities of their roles. Data held will be as accurate and up to date as is reasonably possible. If a data subject informs the school of a change of circumstances their computer record will be updated as soon as is practicable.
Data held about people will be adequate, relevant and not excessive in relation to the purpose for which the data is being held.
Data will not be kept for longer than necessary. Where personal data is no longer needed it will be either deleted or anonymized, having due regard for appropriate retention periods.
The school will follow the retention guidelines set out in the Information and Records Management Society’s toolkit for schools. Where no retention period for certain classes of documents has been set out, the school will follow a process of common sense and document its decision.
The school will not normally share personal data with anyone else, but may do so where:
The school will also share personal data with law enforcement and government bodies where legally required to do so, including for:
The school may also share personal data with emergency services and Local Authorities (LAs) to help them to respond to an emergency situation affecting any of our pupils or staff.
Where we transfer personal data to a country or territory outside the UK, we will do so in accordance with Data Protection law.
9.1 Subject Access Requests
The DPA extends to all data subjects a right of access to their personal data. Individuals are required to make a Subject Access Request (SAR) to gain access to personal information that the school holds about them. This includes:
SARs must be submitted on a formal basis in writing, either by letter, email or fax to the DPO. They should include:
If staff receive a subject access request they must immediately forward it to the DPO.
9.2 Children and Subject Access Requests
Personal data about a child belongs to that child, and not the child's parents or carers. For a parent or carer to make a subject access request with respect to their child, the child must either be unable to understand their rights and the implications of an SAR, or have given their consent.
Children below the age of 12 are generally not regarded to be mature enough to understand their rights and the implications of a subject access request, particularly in an educational setting catering to pupils with Special Educational Needs. As such, in the case of Subject Access Requests from parents or carers for pupils at this school, a presumption will be made in favour of those with parental / carer responsibility and these will be granted without the express permission of the pupil.
Children aged 12 and above are generally regarded to be mature enough to understand their rights and the implications of an SAR but again appropriate consideration must be given to the ability of the particular child to fully understand their rights. SARs for such children will always be judged on a case-by-case basis.
9.3 Responding to Subject Access Requests
When responding to requests, we:
We will not disclose information if it:
If the request is unfounded or excessive, we may refuse to act on it, or charge a reasonable fee which takes into account administrative costs.
A request will be deemed to be unfounded or excessive if it is repetitive, or asks for further copies of the same information.
When we refuse a request, we will tell the individual why, and advise them they have the right to complain to the ICO.
9.4 Other Data Protection Rights of the Individual
In addition to the right to make an SAR (see above), and to receive information when collecting their data about how the school uses and processes it (see section 7), individuals also have the right to:
Individuals should submit any request to exercise these rights to the DPO. If staff receive such a request, they must immediately forward it to the DPO.
The DPO will maintain a log of SARs detailing the school’s response to each request.
Parents, or those with parental responsibility, have a legal right to free access to their child’s educational record (which includes most information about a pupil) within 15 school days of receipt of a written request.
As far is possible, this information will be provided free of charge.
It should be borne in mind that if the school ever becomes an Academy that there is no equivalent legal right of access to information. The school would need to formulate an appropriate policy.
The school uses CCTV around the school site to ensure it remains safe.
The school adheres to the ICO’s Code of Practice for the use of CCTV.
The school does not need to ask individuals’ permission to use CCTV. Security cameras are clearly visible and accompanied by prominent signs explaining that CCTV is in use and for which purposes.
As part of the school activities, photographs may be taken and record images recorded of individuals within our school.
Written consent will be obtained from parents/carers for photographs and videos to be taken of their child for communication, marketing and promotional materials. The school will clearly explain how the photograph and/or video will be used to both the parent/carer and pupil.
Uses may include:
Consent can be refused or withdrawn at any time. If consent is withdrawn, the photograph or video will be deleted and not distributed further.
Use of photographs and videos in this way will not be accompanied with any other personal information about the child, to ensure they cannot be identified.
Further information can be found in the school’s Child Protection and Safeguarding Policy for more information on the use of photographs and videos.
Measures are in place to show that the school has integrated Data Protection into all of our data processing activities, including:
The school undertakes to protect personal data and keep it safe from unauthorised or unlawful access, alteration, processing or disclosure, and against accidental or unlawful loss, destruction or damage.
In particular:
Personal data that is no longer needed will be disposed of securely. Personal data that has become inaccurate or out of date will also be disposed of securely, where we cannot or do not need to rectify or update it.
For example, paper-based records will be shredded or incinerated. Electronic records will either be overwritten or deleted. Should the school use a third party to safely dispose of records on the school’s behalf, it will require the third party to provide sufficient guarantees that it complies with Data Protection law.
Any obsolete devices such as computers containing sensitive data are disposed of having due regard for an aim to recycle such items in an ‘environmentally friendly’ manner ensuring at the same time that all data is safely and appropriately destroyed.
All such devices will be recycled under articles set down in Environment Act (1995), Environment Protection (Duty of Care) Regulations 1991, EU Directive 2006/96/EC and Amendment EU Directive 2003/108/EC on Waste Electrical and Electronic Equipment (WEEE).
Electronic data will be disposed of by an approved contractor able to supply a Certificate of Data Destruction (CODD) and ensures that where any hard disk fails data wiping, cannot be accessed or is found to be faulty, that it is removed from the device, degaussed, then physically destroyed ensuring complete data security. As the school has invested a considerable amount in upgrading the hard drives in its computers, many of these will be reused rather than recycled.
The school will make all reasonable endeavours to ensure that there are no personal data breaches.
In the unlikely event of a suspected data breach, the procedure set out in Appendix 1 will be followed.
When appropriate, the data breach will be reported to the ICO within 72 hours. Such breaches in a school context may include, but are not limited to:
All staff and governors are provided with Data Protection training as part of their induction process.
Data Protection will form part of annual continuing professional development. Periodic reminders will be issued to staff covering changes to legislation, guidance or the school’s processes.
The DPO is responsible for monitoring and reviewing this policy. This policy will be reviewed annually and ratified by the Governing Body.
The DPO will also monitor and review ongoing practice, suggesting and implementing improvements as deemed necessary.
The DPO maintains a record of those bodies which process data on behalf of the school and maintains a record of data processing agreements as well as arranging for all data processors to complete a data security questionnaire to ensure our suppliers follow recommended practice. The results of these questionnaires are maintained and summarized.
REFERENCE - F:\GDPR\Data Audit\Supplier Data Security Assessments Overview.docx
The DPO also maintains a Procedure manual detailing the school’s approach to various aspects of Data Protection.
This Data Protection policy is linked to the following additional policies:
Information about the school’s Data Protection Policy is available from the school office or the DPO depending upon the nature of the enquiry. General information about GDPR and the DPA can be obtained from the Data Protection Commissioner, Tel No: 01625 545 745. The ICO Website https://ico.org.uk/ includes a number of useful reference guides.
The unprecedented challenges which have faced the school as a result of the Coronavirus (COVID-19) pandemic are viewed sympathetically by the ICO which recognises a potential need to continue to share information quickly or adapt the way we work.
The ICO expects the actions taken by the school to be proportionate. Their view is that if something feels excessive from the public’s point of view, then it quite probably is. The ICO’s six data protection steps for organisations set out the key principles organisations need to consider around the use of personal information. The six steps are:
The school considers that the steps it has taken to meet these guiding principles as they are based upon voluntary rather than obligatory compliance.
This procedure is based on guidance on personal data breaches produced by the ICO.
If it’s likely that there will be a risk to people’s rights and freedoms, the DPO must notify the ICO.
Records of all breaches will be stored in the following file: F:/GDPR/Breach
The DPO and Headteacher will meet, as soon as reasonably possible, to review what happened and how a recurrence can be prevented.
Actions to Minimise Impact of Data Breaches
We will take the actions set out below to mitigate the impact of different types of data breach, focusing especially on breaches involving high risk or sensitive information. We will review the effectiveness of these actions and amend them as necessary after any data breach.
Disclosure of Sensitive Information via E-Mail
Other possible types of breach might include:
The DPO will maintain a record of data breaches and will ensure follow-up actions are taken to implement all relevant learning points.