GENERAL DATA PROTECTION REGULATION (GDPR)
From 25th May 2018 Data protection regulations have changed. This page will show how The Forest School use and store your data. It will also give you information about how to access and change the data we hold on you or your child and what consent you will be asked to give.
As part of the new regulations the school have appointed Caroline Dedman as the Data Protection Officer. Any enquiries about data should go to the Data Protection Officer via the Forest e-mail address firstname.lastname@example.org or by calling 01403 261086
The Forest School is registered with the ICO. Registration reference Z7748758
FREEDOM OF INFORMATION
IDENTIFYING OUR LAWFUL BASIS FOR PROCESSING DATA
We use public task as your lawful basis for most of your processing. This means that we need to process personal data to carry out your official functions in the public interest.
We also use consent for processing data where it's not necessary for you to fulfil your function. This is used when none of the other bases apply, as the standard for getting consent is very high and consent can be withdrawn at any time.
SIX PRINCIPLES OF DATA PROTECTION
There were 8 principles under the DPA and now there are 6. Essentially the same but condensed. Article 5 of the GDPR states that personal data must be:
- Processed fairly, lawfully and in a transparent manner in relation to the data subject.
- Collected for specified, explicit and legitimate purposes and not further processed for other purposes incompatible with those purposes.
- Adequate, relevant and limited to what is necessary in relation to the purposes for which data is processed.
- Accurate and, where necessary, kept up to date.
- Kept in a form that permits identification of data subjects for no longer than is necessary for the purposes for which the personal data is processed.
- Processed in a way that ensures appropriate security of the personal data including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures.
Individuals have the following rights:
- be informed of data processing (which is covered by the School’s Privacy Notice)
- access information (also known as a Subject Access Request)
- have inaccuracies corrected
- have information erased
- restrict processing
- data portability (this is unlikely to ever be relevant to schools)
- intervention in respect of automated decision making (automated decision making is rarely operated within schools)
- Withdraw consent
- Complain to the Information Commissioner’s Office
HOW WE DEAL WITH RECORDS
DATA WITH THIRD PARTIES
The Forest School use third party IT systems in order to process data such as attendance, communication and special needs information. All providers are GDPR compliant and have strict procedures in place to protect any information they hold.
The main third party providers are:-
SIMS - this is the system run on behalf of West Sussex County Council by Capita. It holds all of the pupils information that is required for their education. Contact details for the pupils and parents/guardian as well as any special needs and medical information. This information is passed to any school that the pupil transfers to through an electronic CTF file. This system also provides the Government details for census and exam results as well as recording registration and attendance information. See GDPR statement from Capita SIMS.
Schools Comms & ParentPay - This is the school's communication platform. Payments for trips and parent evening bookings can be made. Data is transferred from SIMS using MSSync. The data required will be basic name, sex and email address that is used for communicating.
JSPC - This is our IT supplier who manage our server and IT systems. Data is held on a cloud system. JSPC work with many schools in the West Sussex area are GDPR compliant. See JSPC Data policy.
All Governors and staff have been made aware of the new GDPR regulations. New staff are given this information at their induction and are expected to read the Data Protection policy. Staff have access to the important policies and some are displayed in the staff room.
The Forest School have a procedure to deal with any breach in data security. Any breach will be reported to and dealt with by the DPO. The breach will be recorded, investigated and steps taken to lessen any impact. The DPO will decide if the breach is significant enough to report to the ICO. This must be done within 72 hours of the data breach. The DPO will evaluate the breach, risk assess and put in any changes to data security or process as required.
DATA PROTECTION OFFICER/GOVERNANCE
The DPO for The Forest School is Caroline Dedman. She is responsible for update policies and produces and ensuring they are kept too. All policies are agreed with the School Governors.
Any queries relating to Data should be address to the Data Protection Officer.
The lawful basis for processing personal data of students and staff is that it is necessary in order for the School to discharge its legal obligations and statutory duties. In respect of this processing the Privacy Notices are sufficient to ensure lawful processing. It is not usual for Schools to process personal data solely based on written consent. Where the School takes a photograph or film of someone on school premises, events or trips and wants to use this image for educational purposes, consent is not required. However, the pupil if over 16 years old, or if younger their guardian must still be informed that photography or filming is taking place and the context in which the image will be used.
Consent will be required where there is additional processing of personal data which is not within the reasonable expectation of those involved.
Where the child is below the age of 16 years, consent must be given by the holder of parental responsibility over the child.
How we obtain consent.
When a pupil starts at Forest a consent form is sent out in the new starter pack. This will cover their time at Forest until they leave. If additional consent is required a separate form will be sent out to cover the consent for a particular event.
Guidance on consent and withdrawal.
Anything requiring consent requires a positive opt-in. If another organisation/third party is relying on the consent we will name them in the consent form.
Consent can be withdrawn at any time. We will require this in writing and given to the office. You will receive a receipt of a withdrawal of consent and it will be acted upon within a reasonable period of time. If we have used your photo on printed literature or advertising boards we have a right to continue using these until replacements are produced.
UPDATING AND REVIEWING
All policies and procedures will be reviewed and updated once a year. The review date is set for April 2020. This review will be carried out by the DPO and any changes agreed with the Headteacher and Governors.
Policies and procedures will also be reviewed if there are any changes to how data is managed at the school, Government guidelines or following a breach of data security.