St IgnatiusCatholicPrimarySchoolDataProtectionPolicy.

Policy number / STIG005
Adopted by the St Ignatius Board of Governors / Spring2015
Review schedule / Termly,One,Two/Three Yearly
Review date / Autumn 2015
Designated Lead(s) / Headteacher
Signed on behalf of the Board of Governors

1.IntroductionandScope

TheDataProtectionAct1998isthelawthatprotectspersonalprivacyandappliestoanyschoolwhichprocessesorhasaccesstopeople’spersonaldata.TheActhelpsensurethatthemanagementofdataheldelectronicallyand/orandinpaper-basedsystemsisprocessedcorrectly.Section7oftheActgivesrightstothepeopleabout whothedatarelates.

StIgnatiusPrimarySchoolhasalegalresponsibilitytocomplywiththeDataProtectionActandtheschool,asacorporatebody,isnamedasthe‘DataController’undertheAct.Datacontrollersarepeople/organisationswhoholdandprocesspersonaldataandhaveadutytoestablishworkplacepracticesandpoliciesthatareinlinewiththeAct.

2.Personal data

Personaldataisanyinformationwhichrelatestoalivingindividualwhocanbeidentifiedfromthatdataeitherbyitselforalongsideanyotherinformationwehold(forexample,name,address,dateofbirth,NationalInsurancenumber,bankaccountdetailsetc).Italsoincludesanyexpressionofopinionaboutthatindividualandanyindicationofanyintentionswehaveinrespectofthatindividualanditalsoappliestopersonaldataheldvisuallyinphotographsorvideoclips(includingCCTV)orassoundrecordings.

Personaldatacanalsobe'sensitive'asdefinedbytheAct.Thisisinformationaboutyourracialorethnicorigin,politicalopinions,religiousbeliefs,tradeunionmembership,physicalormentalhealthorcondition,sexuallife,criminaloffences,proceedingsandconvictions.Wecanonlycollectandholdthisinformationforspecificpurposes(forexampleequalopportunitiesmonitoring).

WeareobligatedtonotifytheInformationCommissioner,whoregulatestheDataProtectionAct,thatinformationaboutindividualsisbeingcollected,processedandheld.WearealsoobligatedtofollowtheeightprinciplessetoutintheAct.Theprinciplesstatethatallpersonalinformation,ordata,aboutindividualsshouldbe:

i.Processedfairlyandlawfully

Eitherconsentisrequiredorthereisanoverridingnecessitytoprocessdatahoweverinanyevent,individualsshouldbemadefullyawareofwhywearecollectingtheirinformation,whatweintendusingitfor,andwhoelsewemay

besharingitwith.

ii.Processedforlimitedpurposes

Wewillonlyprocesstheinformationwe'vecollectedforthepurposeswesaidwewouldwhenitwascollected.

St Ignatius Catholic Primary Sch.

iii.Adequate,relevantandnotexcessive

Wewillonlycollectandprocesstheinformationweneedasopposedtoanyadditionalinformationthatmaybeuseful inthefutureforanotherpurpose.

iv.Accurateanduptodate

Wewillregularlyreviewtheinformationweholdtoensurethatpersonaldataiskeptuptodate.

v.Keptnolongerthanisnecessary

Dependingontheoverridingneedofanylegislation,statutoryorlegalrequirement,datawillnotbekeptlongerthanisrequiredforthepurposesofprocessing.

vi.Processedin linewiththe individual’s rights

TheDataProtectionActcreatesrightsforthoseindividualswhohavetheirdataprocessedandresponsibilitiesforourschoolwhichprocessesandrecordsthatdata.

vii.Secure

Wemustensurethatappropriatemeasureshavebeentakentoensureyourinformationissafe,secureandcannotbeaccessedbyanyonethatisn'tauthorizedtodoso.

viii.Not transferred to other countries that don’t have suitable dataprotection controls.

Wewillnotsendpersonalinformation outside of the EuropeanEconomicArea

unless the individual whom it is about has consentedoradequateprotectionisinplace.

3.Information disclosure

Personalinformationcannotusuallybereleasedtoanyoneelsewithoutyourconsentorknowledge.Thereare,however,certaincircumstanceswhenathirdparty(suchasagovernmentagencyorlawenforcementagency)canrequestinformationaboutyouandwemaybeobligedtodiscloseittothem(forexamplewherethedisclosureisrequiredbylaworby a courtorder).

Ifyouaskforinformationaboutapersonotherthanyourself,yourrequestwilllikelyberefusedunlessthepersonyouareaskingabouthasgiventheirwrittenconsentallowingustodisclosetheirpersonalinformationtoyou.

4.RequestingPersonalData

Torequestaccesstopersonaldatathattheschoolmayholdaboutyou,aSubjectAccessFormcanbecompletedandpostedtous.

Thepersonwhothepersonaldataisaboutisknownasthedatasubjectandthepersonwhoismakingtherequestisknownastheapplicant.Thesecanofcoursebethesamepersondependingonthepersonaldatasought.Acommonexampleofthisrelationshipwouldbewhenaparent(applicant)isseekingpersonalinformationabouttheirchild(datasubject).

Parentscangenerallyrequestpersonaldataabouttheirchildwithouttheirconsent,howeveritshouldbenotedthattheDataProtectionActrequiresadatacontrollertoassessthematurityandcompetencyofadatasubjectwhichisnotrestrictedtoage.Thereforeinsomecases,consentofthechildmaystillberequired.Theremayalsobeoccasionswheresomeoneislegallyallowedtoactonbehalfofsomeoneelse(forexamplepowerofattorney).

Aformtoassistyoumakingarequestisavailablefromourwebsiteorthe schooloffice.

Toprotectyourpersonaldatawhenprocessingarequest,wewillalsorequirecopiesoftwoformsofidentification.Theseshouldbe:

  • onepieceofphotographicidentification,suchasavalidpassport,validdrivinglicenceor a validEUnationalidentitycard.
  • onepieceofidentificationconfirmingyouraddressanddatedwithinthelastthreemonthssuchas a utilitybill,council tax statement orbank statement.

Ifyoudonotwanttopostyourapplication,youmaybookanappointmentwiththeSchoolSenior Administration Officer,whowillacceptyourapplicationandvalidateyouridentification.Whilstwemaybeabletoconfirmyouridentificationinperson,shouldyourequireanypersonaldatabepostedtoyou,wewillalwaysrequireproofofaddresstoensurethatanydatathatwereleaseissentsecurelyandtothecorrectaddress.

Rememberthatifyouareapplyingonsomeoneelse'sbehalf,youmustalsoencloseeithertheirsigned,writtenconsent,orproofthatyouarelegallyentitledto act on their behalf.

Thereisalsoa processingfee.

Followingreceiptofyourwrittenrequest,identificationandfee,youwillreceivearesponsewithin40days.Howeverifwedonothaveenoughinformationrequiredtoperformasearchwewillcontactyouandaskformoredetails(The

40 day period of response will begin from the day we receive sufficientinformationtoenable a search).

TheunlawfulobtainingordisclosureofpersonaldatawithoutconsentoftheDataControllerisanoffenceunderSection55oftheDataProtectionAct1998.

St Ignatius Catholic Primary Sch.

5.Disclosinginformation

Theinformationthatyoucanexpecttoreceivefromuswillusuallybeacopyinwhatever format we hold it in.

Dependingonwhatinformationhasbeenrequestedwewillexplainanyjargonorabbreviations,provideasummarysheetdetailingwhatwehaveusedtheinformationfor,andwhatinformationwehavewithheldandwhy(ifapplicable).

AspertheDataProtectionAct1998,therearesomeinstanceswherewemaynotbeabletoreleasesomeoftheinformationweholdaboutyoutoyousuchas:

  • personalinformationaboutotherpeople(includingfamilymembers),unlesswereceivetheirconsent
  • examinationmarksaheadofnationalreleaseorexaminerscomments
  • informationprovidedbyanotherperson,suchasahealthvisitororthepolice,unlesswereceivetheirpermissiontodoso
  • informationcontainedinadoptionandparentalorderrecords
  • legaladviceprovidedbya legalprofessional
  • informationthatwouldprejudicetheprevention / detectionofcrime

Insomeexceptionalcircumstanceswe may also withhold information about youifwethinkthatitmightcauseyouseriousharmorseveredistress.

Occasionallyyourrecordsmaycontainelementsthatitwouldnotbeappropriateforyoutosee(forexamplepersonalinformationaboutotherindividuals).Ratherthanwithholdthewholerecordordocument,wewillredactorremovethosesections,ifwe can, to make them anonymous

Ifyoufindincorrectinformationheldaboutyouthenpleasewriteandtelluswhatiswrongandhowyouthinkitshouldbecorrected.Anassessmentwillbemadeandtheinformationmaybeupdated.Sometimesitmaynotbepossibletoamendhistoricinformationifitwere keytodecisionmakingatthetime.

6.EducationRecords

Aparenthasrightstotheirchild’seducationalrecordundertheEducation(PupilInformation)(England)Regulations2005.

Aneducationrecordwillprimarilyconsistofinformationthatcomesfromateacherorotheremployeeofalocalauthorityorschool,thepupilortheirparents(suchasdetailsofachievementandattainment).However,itmayalsoincludeinformationfromthechildandtheirparents(suchasinformationaboutthehealthofthechildorcorrespondencefromaneducationalpsychologist).

Informationkeptbyateachersolelyfortheirownusedoesnotformpartoftheofficial educational record.

Aneducationrecordwillprimarilyconsistofinformationthatcomesfromateacherorotheremployeeofalocalauthorityorschool,thepupilortheirparents(suchasdetailsofachievementandattainment).However,itmayalsoincludeinformationfromthechildandtheirparents(suchasinformationaboutthehealthofthechildorcorrespondencefromaneducationalpsychologist).

Toaccessyourchild'sschoolrecords,youshouldsubmityour request inwritingtotheheadteacher.

Whilstsimplyviewinganeducationalrecordisfreeofcharge,ifwereceivearequestfromaparentwhowantscopyoftheirchild’seducationalrecordthenafeemaybechargedatourdiscretion.

AdditionallyitmaynotbepossibleforaparenttosimplyviewtherecordifpersonaldatasubjecttotheDataProtectionAct1998iscontainedwithin.Ifthisisthecase,thisinformationwillbedisclosedwithregardstotheprinciplesandrequirementsoftheDataProtectionAct1998andinlinewiththosetimescalesasoutlinedinsection 1 – 5 above.

St Ignatius Catholic Primary Sch.