The Coombe Secondary Schools Academy Trust Incorporating Knollmead Primary School. Data Protection

Transcription

1 The Cmbe Secndary Schls Academy Trust Incrprating Knllmead Primary Schl Data Prtectin Plicy Equality Analysis Impact Title f Plicy: Data Prtectin Cnsidered at Gvernrs Cmmittee meeting: Strategy / FGB Date: Autumn 2016 Review: Autumn 2018 Is there relevance t equality? 1. Des the plicy have an adverse effect n emplyees, pupils r the wider cmmunity and therefre have a significant effect in terms f equality? If yes, then please answer questins 2 and 3. Yes/N 2. Des the plicy have an adverse effect upn a grup with prtected characteristics? (sex, race, religin r belief, disability, sexual rientatin, gender reassignment, pregnancy r maternity, age) Yes/N 3. Des the plicy affect ne r mre f the equality bjectives set by the schl? (Please refer t the Equality and Diversity Plicy) Yes/N If the answer t questin 2 r 3 is yes, a full equality analysis will need t be cmpleted by the SLT Lead befre the next cmmittee meeting. Please detail the bjective and explain the relevance f the plicy t the bjective and prtected characteristics belw

2 THE COOMBE SECONDARY SCHOOLS ACADEMY TRUST DATA PROTECTION POLICY 1. INTRODUCTION 1.1 Purpse This statutry plicy shuld be read in cnjunctin with the Data Prtectin Act 1998 (DPA), Independent Schl Standards Regulatins 2010 (these apply t academies) and the ICO (Infrmatin Cmmissiner s Office) Reprt n the data prtectin guidance we gave schls At ur schl, we acknwledge that t functin prperly we need t cllect and use certain types f infrmatin abut staff, students and ther individuals wh cme int cntact with the schl. We are als bliged t cllect and use data t fulfil ur bligatins t the Lcal Authrity/Educatin Department and ther bdies. We deal with infrmatin prperly in whatever way it is cllected, recrded and used n paper, electrnically r any ther way. We regard the lawful and crrect treatment f persnal infrmatin as very imprtant t successful peratins and t maintaining cnfidence between thse with whm we deal and urselves. We are cnscius that much f the data we hld is classified as sensitive persnal data and we are aware f the extra care this kind f infrmatin requires. We ensure that ur rganisatin treats all persnal infrmatin lawfully and crrectly. T this end, we fully endrse and adhere t the data prtectin principles as cntained in the Data Prtectin Act Summary f the bligatins under the Act The main bligatins under the Act relevant t staff are as fllws: Cmpliance with the eight data prtectin principles: The Act cntains eight data prtectin principles which set ut hw rganisatins shuld handle Persnal Data. Data is persnal data if it relates t an individual and the individual can be identified frm the data. They cver issues such as what infrmatin needs t be given t the individual, infrmatin security and using individuals' Persnal Data in a fair and lawful way. Subject access requests: The Act gives individuals a number f rights including a right t request a cpy f the Persnal Data we hld abut them. Sensitive Persnal Data: There are extra bligatins in relatin t Sensitive Persnal Data, held by us. Sensitive Persnal Data is infrmatin abut an individual's racial r ethnic rigin, plitical pinins, religius beliefs r ther beliefs f a similar nature, trade unin membership, physical r mental health r cnditin, sexual life and infrmatin relating t actual r alleged criminal activity. Infrming the individual: We must tell the individual hw their Persnal Data will be used (unless it is bvius). 2. DATA PROTECTION PRINCIPLES All members f staff emplyed in ur schl are required t adhere t the eight enfrceable data prtectin principles as set ut in the DPA. The day t day management f this is designated t the Headteacher r Head f Centre but all staff are respnsible fr ensuring that they read this plicy and cmply with it and the DPA.

3 The Cmbe Secndary Schls Academy Trust s schls are a Data Cntrller fr the purpses f the Act and the Trust is registered with the Infrmatin Cmmissiner s Office as a Public Authrity. Persnal Infrmatin is prcessed t: prvide educatin and training prvide welfare and educatinal supprt services t administer schl prperty maintain ur wn accunts and recrds undertake fundraising supprt and manage ur emplyees Data shall be prcessed fairly and lawfully and in particular shall nt be prcessed unless specific cnditins are met. Persnal data shall be btained / prcessed nly fr ne r mre specified and lawful purpse and shall nt be further prcessed in any manner incmpatible with that purpse r thse purpses. Persnal data shall be adequate, relevant and nt excessive in relatin t the purpse r purpses fr which they are prcessed. Persnal data shall be accurate and where necessary, kept up-t-date. Persnal data shall nt be kept fr lnger than is necessary fr that purpse r thse purpses. Persnal data shall be prcessed in accrdance with the rights f data subjects under the 1998 DPA. Apprpriate technical and rganisatinal measures shall be taken against unauthrised r unlawful prcessing f persnal data and against accidental lss r destructin f, r damage t, persnal data. Persnal data shall nt be transferred t a cuntry r territry utside the Eurpean Ecnmic Area, unless that cuntry r territry ensures an adequate level f prtectin fr the rights and freedms f data subjects in relatin t the prcessing f persnal data. 3. SCHOOL PRACTICE Within schl we will strictly apply the fllwing criteria and cntrls. These are t: Ntify the ICO that we prcess persnal data and re-ntify if prcedures change r are amended. Observe fully the cnditins regarding the fair cllectin and use f infrmatin. T achieve this we have in place and use a privacy ntice, smetimes called a fair prcessing ntice see appendix 2. Meet ur legal bligatins t specify the purpses fr which infrmatin is used. Cllect and prcess apprpriate infrmatin and nly t the extent that it is needed t fulfil peratinal needs r t cmply with any legal requirements. Ensure the quality f infrmatin used.

4 Apply strict checks t determine the length f time infrmatin is held. Ensure that the rights f the persns abut whm infrmatin is held can be fully exercised under the Act. These include the right t be infrmed that prcessing is being undertaken, the right t access t ne s persnal infrmatin, the right t prevent prcessing in certain circumstances and the right t crrect, rectify, blck r erase infrmatin which is regarded as wrng infrmatin. Take apprpriate technical and rganisatinal security measures t safeguard persnal infrmatin. We will review the physical security f buildings and strage systems as well as access t them. All prtable electrnic devices must be kept as securely as pssible n and ff schl premises. Ensure that all Disclsure and Barring Service recrds (recruitment and vetting checks) are kept in a safe central place and that n unnecessary certificatin infrmatin is kept lnger than six mnths. Ensure that persnal infrmatin in nt transferred abrad withut suitable safeguards. Treat peple justly and fairly whatever their age, religin, disability, gender, sexual rientatin r ethnicity when dealing with requests fr infrmatin. Set ut clear prcedures fr respnding t requests fr infrmatin see appendix 1. Have in place secure methds fr safely dispsing f all electrnic and paper recrds. Be sure that phtgraphs f pupils are nt included in any schl publicatin r n the schl website withut specific cnsent. Take care that CCTV that captures r prcesses images f identifiable individuals is dne in line with the data prtectin principles. Ensure apprpriate use f phtgraphs f children in ur publicatins (we will nt publish the name f the pupil alngside the pht withut cnsent). Ensure that when staff r pupil infrmatin (electrnic r therwise) is taken ff site that it is kept secure at all times. We shall als ensure that: There is a named persn with specific respnsibility fr data prtectin within the schl. All persns managing and handling persnal infrmatin understand that they are cntractually respnsible fr fllwing gd data prtectin practice. All persns managing and handling persnal infrmatin are trained t d s. Anyne wanting t make enquiries abut handling persnal infrmatin knws what t d. Anyne managing and handling persnal infrmatin is apprpriately supervised. Queries abut handling persnal infrmatin are prperly and curteusly dealt with. Methds f handling persnal infrmatin are clearly described.

5 A regular review and audit is made f the way persnal infrmatin is held, managed and used. Methds f handling persnal infrmatin are regularly assessed and evaluated. Perfrmance with handling persnal infrmatin is regularly assessed and evaluated. A breach f the rules and prcedures identified in this plicy may lead t disciplinary actin being taken against the members f staff cncerned. On ccasins when infrmatin is authrised fr dispsal, it is dne apprpriately. 4. Authrised Disclsures Persnal data will nly be disclsed t third parties in tw circumstances: Where the data subject has given cnsent (r in the case f a child withut capacity under the DPA - rdinarily thse under 12 years f age - their parent r guardian) Where the Schl is required r permitted by law t disclse it. There are sme situatins when we are allwed t withhld infrmatin, e.g. if the infrmatin is abut The preventin, detectin r investigatin f a crime Natinal security r the armed frces The assessment r cllectin f tax Judicial r ministerial appintments Recruitment It will be necessary fr the schl t cllect infrmatin frm candidates applying fr a psitin within the schl. The applicatin frm will ask fr infrmatin relevant t the psitin applied fr and the applicant s explicit cnsent btained, bth fr the data revealed by them and fr any request which will be submitted t a third party fr persnal data abut the applicant. The applicant will be infrmed f: Why the schl cllects the infrmatin Hw lng it will be kept The security in place t prtect the infrmatin Hw the applicatin will be prcessed Hw the infrmatin given will be verified Make a cmplaint If yu think that yur data has been misused r that it hasn t been kept it secure, yu shuld cntact the individual schl within the trust t tell them. If yu are unhappy with the respnse r if yu need advice yu shuld cntact the Infrmatin Cmmissiner s Office ( ICO ).

6 ICO helpline Telephne ; The ICO can investigate yur claim and take actin against anyne wh s missed persnal data. Yu can als visit the ICO website fr infrmatin n hw t make a prcedure cmplaint. This plicy will be reviewed by the Gverning Bdy and Headteacher at least every tw years. Reviewed: September 2016 Ratified:

7 Appendix 1 Dealing with a subject access request Requests fr persnal data held abut a pupil by the schl must be made in writing (which includes the use f ) and be addressed t the Headteacher. If the initial request des nt clearly specify the infrmatin required, then the schl will make further enquiries. The Headteacher must be cnfident f the identity f the individual making the request. Checks will be carried ut regarding prf f relatinship t the child. In additin, evidence f identity will be established by requesting prductin f: Passprt Driving licence Utility bills with the current address Birth/marriage certificate P45/P60 Credit card r mrtgage statement (this list is nt exhaustive) As stated abve, any individual has the right f access t infrmatin held abut them. Hwever, in the case f children this is dependent upn their capacity t understand (nrmally age 12 r abve) and the nature f the request. The Headteacher shuld discuss the request with the child and take their views int accunt when making a decisin. A child with cmpetency t understand can refuse t cnsent t the request fr their recrds. Where the child is nt deemed t be cmpetent, an individual with parental respnsibility r guardian shall make the decisin n behalf f the child. The schl may make a charge fr the prvisin f infrmatin, depending n the fllwing: N charge can be made if the requester simply wants t view the educatinal recrd f a child. Shuld the infrmatin requested require a cpy f the educatinal recrd, then the amunt charged will be dependent upn the number f pages prvided and the request will be cnsidered under the DPA. This type f recrd is available t all parents until the child becmes an adult with r withut the cnsent f the child. Number f pages Maximum fee

8 Shuld the infrmatin requested be persnal infrmatin that is nt an educatinal recrd, schls can charge up t 10 t prvide it. The respnse time fr subject access requests is 40 days frm receipt (this refers t calendar days irrespective f schl hliday perids). The DPA allws exemptins as t the prvisin f sme infrmatin; therefre all infrmatin will be reviewed prir t disclsure. Third party infrmatin is infrmatin that has been prvided by anther persn such as the lcal authrity, the plice, a health care prfessinal r anther schl. It is gd practice t seek the cnsent f the third party befre disclsing infrmatin. Even if the third party des nt cnsent, r cnsent is explicitly nt given, the data may be disclsed. (There is n need in the case f third party requests t adhere t the 40-day statutry timescale.) Any infrmatin that culd cause serius harm t the physical, emtinal r mental health f a pupil r anther persn may nt be disclsed, nr shuld infrmatin that wuld reveal that the child is at risk f abuse. The same stricture applies t infrmatin relating t curt prceedings. If there are cncerns abut the disclsure f infrmatin, then additinal advice shuld be sught, usually frm the Infrmatin Cmmissiner s Office. When redactin (blacking ut r bscuring f data) has taken place, then a full cpy f the infrmatin prvided will be retained in rder t establish, if a cmplaint is made, what was redacted and why. Infrmatin can be prvided at the schl with a member f staff n hand t assist if requested, r prvided at face-t-face handver. The views f the applicant will be taken int accunt when cnsidering the methd f delivery. If pstal systems have t be used, then registered r recrded mail will be used. Cmplaints will be dealt with in accrdance with the schl cmplaints prcedure, which is available n-line r frm the schl ffice. Shuld the cmplainant wish t take the matter further, it may be referred t the Infrmatin Cmmissiner

9 Appendix 2 Privacy Ntice The ntice belw is sent t all parents by the Schl n admissin and a schl specific versin will be included in student diaries fr the secndary schls frm September 2015: Fair Prcessing Ntice: DATA Prtectin Act Schls have been asked t issue the attached DATA prtectin infrmatin t all parents. Please tick the admissins frm if yu d nt wish the LA r DfE t pass infrmatin ther than name and address fr purpses f careers advice. Cmbe Girls Schl (CGS)/Cmbe Bys Schl (CBS)/Knllmead Primary Schl(KPS) prcesses persnal data abut its pupils and is a data cntrller in respect f this fr the purpses f the Data Prtectin Act It prcesses this data t: supprt its pupils teaching and learning; mnitr and reprt n their prgress; prvide apprpriate pastral care; and assess hw well the schl as a whle is ding. This data includes cntact details, natinal curriculum assessment results, attendance infrmatin, characteristics such as ethnic grup, special educatinal needs and any relevant medical infrmatin. In additin, as a staff, we recrd pupils behaviur held n a secure, web based prgramme called Behaviur Watch/PARS/Management Infrmatin System which is retained and accessible nly t apprpriate staff. If yu are enrlling fr pst 14 qualificatins we will be prvided with yur unique learner number (ULN) by the Learning Recrds Service and may als btain frm them details f any learning r qualificatins yu have undertaken. We will nt give infrmatin abut yu t anyne utside the schl withut yur cnsent unless the law and ur rules allw us t. This data may nly be used r passed n fr specific purpses allwed by law. Frm time t time the schl is required t pass n sme f this data t lcal authrities, the Department fr Educatin (DfE), and t agencies that are prescribed by law, such as the Qualificatins and Develpment Agency (QCDA), Ofsted, the Educatin Funding Agency, the Department f Health (DH), Primary Care Trusts (PCT) and Yuth Supprt Services. All these are data cntrllers in respect f the data they receive, and are subject t the same legal cnstraints in hw they deal with the data. Pupils, as data subjects, have certain rights under the Data Prtectin Act, including a general right t be given access t persnal data held abut them by any data cntrller. The presumptin is that by the age f 12 a child has sufficient maturity t understand their rights and t make an access request themselves if they wish. A parent wuld nrmally be expected t make a request n a child s behalf if the child is yunger. If yu wish t access yur persnal data, r that f yur child, then please cntact the schl in writing. Details f these rganisatins can be fund n the fllwing website r fr thse pupils/parents where this is nt practical, a hard cpy can be btained frm Cmbe Girls Schl/Cmbe Bys Schl/Knllmead Primary Schl.

10 Appendix 3 Data Prtectin Checklist The fllwing table can be used by staff handling data as a guide t ensuring DP cmpliance