Data and Privacy Notice
(How we use pupil information)
Gisburn Road Community Primary School holds the legal right to collect and use personal data relating to pupils and their families, and we may also receive information regarding them from their previous school, LA and/or the DfE.
We collect and use personal data in order to meet legal requirements and legitimate interests set out in the GDPR and UK law
The categories of pupil information that we process include:
• personal identifiers and contacts (such as name, unique pupil number, contact details and address)
• characteristics (such as ethnicity, language, and free school meal eligibility)
• safeguarding information (such as court orders and professional involvement)
• special educational needs (including the needs and ranking)
• medical and administration (such as doctors information, child health, dental health, allergies, medication and dietary requirements)
• attendance (such as sessions attended, number of absences, absence reasons, any previous schools attended and destination schools for leavers)
• assessment and attainment (such as key stage 1 and phonics results, post 16 courses enrolled for and any relevant results)
• behavioural information (such as exclusions and any relevant alternative provision put in place)
Why we collect and use pupil information
We collect and hold personal information relating to our pupils and may also receive information about them from their previous school, local authority and/or the Department for Education (DfE).
We collect and use pupil information, for the following purposes:
a) to support pupil learning
b) to monitor and report on pupil attainment progress
c) to provide appropriate pastoral care
d) to assess the quality of our services
e) to keep children safe (food allergies, or emergency contact details)
f) to meet the statutory duties placed upon us for DfE data collections
Under the General Data Protection Regulation (GDPR), the lawful bases we rely on for processing pupil information are:
• for the purposes of (a), (b), (c) & (d) in accordance with the legal basis of Public task: collecting the data is necessary to perform tasks that schools are required to perform as part of their statutory function
• for the purposes of (e) in accordance with the legal basis of Vital interests: to keep children safe (food allergies, or medical conditions)
• for the purposes of (f) in accordance with the legal basis of Legal obligation: data collected for DfE census information
o Section 537A of the Education Act 1996
o the Education Act 1996 s29(3)
o the Education (School Performance Information (England) Regulations 2007
o regulations 5 and 8 School Information (England) Regulations 2008
o the Education (Pupil Registration) (England) (Amendment) Regulations 2013
In addition, concerning any special category data:
• conditions a, b, c and d of GDPR - Article 9
(a) the data subject has given explicit consent to the processing of those personal data for one or more specified purposes, except where Union or Member State law provide that the prohibition referred to in paragraph 1 may not be lifted by the data subject;
(b) processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law in so far as it is authorised by Union or Member State law or a collective agreement pursuant to Member State law providing for appropriate safeguards for the fundamental rights and the interests of the data subject;
(c) processing is necessary to protect the vital interests of the data subject or of another natural person where the data subject is physically or legally incapable of giving consent;
(d) processing is carried out in the course of its legitimate activities with appropriate safeguards by a foundation, association or any other not-for-profit body with a political, philosophical, religious or trade union aim and on condition that the processing relates solely to the members or to former members of the body or to persons who have regular contact with it in connection with its purposes and that the personal data are not disclosed outside that body without the consent of the data subjects;
Collecting pupil information
We obtain pupil information via registration forms at the start of each academic year. In addition, when a child joins us from another school we are sent a secure file containing relevant information.
Pupil data is essential for the schools’ operational use. Whilst the majority of pupil information you provide to us is mandatory, some of it is provided to us on a voluntary basis. In order to comply with GDPR we will inform you at the point of collection, whether you are required to provide certain pupil information to us or if you have a choice in this.
Storing pupil data
We hold pupil data securely for the set amount of time shown in our data retention schedule.
Who we share pupil information with
We routinely share pupil information with:
• schools that the pupils attend after leaving us
• our local authority
• the Department for Education (DfE)
• relevant NHS staff including school nurse
• Children’s Social Care
• Early Health & Wellbeing Team
Why we regularly share pupil information
We do not share information about our pupils with anyone without consent unless the law and our policies allow us to do so.
Department for Education
The Department for Education (DfE) collects personal data from educational settings and local authorities via various statutory data collections. We are required to share information about our pupils with the Department for Education (DfE) either directly or via our local authority for the purpose of those data collections, under section 3 of The Education (Information About Individual Pupils) (England) Regulations 2013.
All data is transferred securely and held by DfE under a combination of software and hardware controls, which meet the current government security policy framework.
For more information, please see ‘How Government uses your data’ section.
Requesting access to your personal data
Under data protection legislation, parents and pupils have the right to request access to information about them that we hold. To make a request for your personal information, or be given access to your child’s educational record, contact Mrs L Keatings on the following details.
You also have the right to:
• to ask us for access to information about you that we hold
• to have your personal data rectified, if it is inaccurate or incomplete
• to request the deletion or removal of personal data where there is no compelling reason for its continued processing
• to restrict our processing of your personal data (i.e. permitting its storage but no further processing)
• to object to direct marketing (including profiling) and processing for the purposes of scientific/historical research and statistics
• not to be subject to decisions based purely on automated processing where it produces a legal or similarly significant effect on you
If you have a concern or complaint about the way we are collecting or using your personal data, you should raise your concern with us in the first instance or directly to the Information Commissioner’s Office at https://ico.org.uk/make-a-complaint/
For further information on how to request access to personal information held centrally by DfE, please see the ‘How Government uses your data’ section of this notice.
Last updated
We may need to update this privacy notice periodically so we recommend that you revisit this information from time to time. This version was last updated on 27th March 2019.
Contact
If you would like to discuss anything in this privacy notice, please contact: Mrs L Keatings on 01282 812287 or email bursar@gisburnroad.lancs.sch.uk
How Government uses your data
The pupil data that we lawfully share with the DfE through data collections:
• underpins school funding, which is calculated based upon the numbers of children and their characteristics in each school.
• informs ‘short term’ education policy monitoring and school accountability and intervention (for example, school GCSE results or Pupil Progress measures).
• supports ‘longer term’ research and monitoring of educational policy (for example how certain subject choices go on to affect education or earnings beyond school)
Data collection requirements
To find out more about the data collection requirements placed on us by the Department for Education (for example; via the school census) go to https://www.gov.uk/education/data-collection-and-censuses-for-schools
The National Pupil Database (NPD)
Much of the data about pupils in England goes on to be held in the National Pupil Database (NPD).
The NPD is owned and managed by the Department for Education and contains information about pupils in schools in England. It provides invaluable evidence on educational performance to inform independent research, as well as studies commissioned by the Department.
It is held in electronic format for statistical purposes. This information is securely collected from a range of sources including schools, local authorities and awarding bodies.
To find out more about the NPD, go to https://www.gov.uk/government/publications/national-pupil-database-user-guide-and-supporting-information
Sharing by the Department
The law allows the Department to share pupils’ personal data with certain third parties, including:
• schools and local authorities
• researchers
• organisations connected with promoting the education or wellbeing of children in England
• other government departments and agencies
• organisations fighting or identifying crime
For more information about the Department’s NPD data sharing process, please visit:
https://www.gov.uk/data-protection-how-we-collect-and-share-research-data
Organisations fighting or identifying crime may use their legal powers to contact DfE to request access to individual level information relevant to detecting that crime. Whilst numbers fluctuate slightly over time, DfE typically supplies data on around 600 pupils per year to the Home Office and roughly 1 per year to the Police.
For information about which organisations the Department has provided pupil information, (and for which project) or to access a monthly breakdown of data share volumes with Home Office and the Police please visit the following website: https://www.gov.uk/government/publications/dfe-external-data-shares
How to find out what personal information DfE hold about you
Under the terms of the Data Protection Act 2018, you are entitled to ask the Department:
• if they are processing your personal data
• for a description of the data they hold about you
• the reasons they’re holding it and any recipient it may be disclosed to
• for a copy of your personal data and any details of its source
If you want to see the personal data held about you by the Department, you should make a ‘subject access request’.
Further information on how to do this can be found within the Department’s personal information charter that is published at the address below:
https://www.gov.uk/government/organisations/department-for-education/about/personal-information-charter