PRIVACY NOTICE FOR PARENTS/ CARERS 

Under the data protection law, individuals have a right to be informed about how a school uses any personal data that we hold about them. We comply with this right by providing 'privacy notices' (sometimes called 'fair processing notices') to individuals where we are processing their personal data.

We collect data and information about our pupils so that we can run effectively as a school.  This privacy notice explains how and why we collect pupils’ data, what we do with it and what rights parents and pupils have.

Privacy Notice (How we use pupil information)

Why do we collect and use pupil information?

We collect and use pupil information under the following lawful bases:

1. where we have the consent of the data subject (Article 6 (a));
2. where it is necessary for compliance with a legal obligation (Article 6 (c));
3. where processing is necessary to protect the vital interests of the data subject or another person (Article 6(d));
4. where it is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller (Article 6 (e)).

Where the personal data we collect about pupils is sensitive personal data, we will only process it where:

1. we have explicit consent;
2. processing is necessary to protect the vital interests of the data subject or of another natural person where the data subject is physically or legally incapable of giving consent; and / or
3. processing is necessary for reasons of substantial public interest, on the basis of Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject.

Please see our Data Protection Policy for a definition of sensitive personal data.

We use the pupil data to support our statutory functions of running a school, in particular:

1. to decide who to admit to the school;
2. [to maintain a waiting list];
3. to support pupil learning;
4. to monitor and report on pupil progress;
5. to provide appropriate pastoral care;
6. to assess the quality of our services;
7. to comply with the law regarding data sharing;
8. for the protection and welfare of pupils and others in the school;
9. for the safe and orderly running of the school;
10. to promote the school;
11. to communicate with parents / carers.
12. for data collection purposes (Departmental Censuses) are the Education Act 1996 – this information can be found in the census guide documents on the following website https://www.gov.uk/education/data-collection-and-censuses-for-schools

The categories of pupil information that we collect, hold and share include:

1. Personal information (such as name, unique pupil number and address);
2. Characteristics (such as ethnicity, language, medical conditions, nationality, country of birth and free school meal eligibility);
3. Attendance information (such as sessions attended, number of absences and absence reasons)
4. assessment information
5. relevant medical information
6. child protection / safeguarding information
7. special educational needs information
8. exclusions / behavioural information

From time to time and in certain circumstances, we might also process personal data about pupils, some of which might be sensitive personal data, including information about criminal proceedings / convictions, child protection / safeguarding.  This information is not routinely collected about pupils and is only likely to be processed by the school in specific circumstances relating to particular pupils, for example, if a child protection issue arises or if a pupil is involved in a criminal matter.  Where appropriate, such information may be shared with external agencies such as the child protection team at the Local Authority, the Local Authority Designated Officer (LADO) and / or the Police.  Such information will only be processed to the extent that it is lawful to do so and appropriate measures will be taken to keep the data secure.

We collect information about pupils when they join the school and update it during their time on the roll as and when new information is acquired.

Collecting pupil information

Whilst the majority of pupil information you provide to us is mandatory, some of it is provided to us on a voluntary basis. In order to comply with the General Data Protection Regulation, we will inform you whether you are required to provide certain pupil information to us or if you have a choice in this. Where appropriate, we will ask parents for consent to process personal data where there is no other lawful basis for processing it, for example where we wish to use photos or images of pupils on our website or on social media to promote school activities or if we want to ask your permission to use your information for marketing purposes.  Parents may withdraw consent at any time.

Storing pupil data

We keep personal information about pupils while they are attending our school. We may also keep it beyond their attendance at our school if this is necessary in order to comply with our legal obligations. The Information and Records Management Society’s toolkit for schools sets out how long we keep information about pupils.

A significant amount of personal data is stored electronically, for example, on our MIS database.  Some information may also be stored in hard copy format.

Data stored electronically may be saved on a cloud based system which may be hosted in a different country.

Personal data may be transferred to other countries if, for example, we are arranging a school trip to a different country.  Appropriate steps will be taken to keep the data secure.

Who do we share pupil information with?

We routinely share pupil information with:

• schools that  pupils attend after leaving us;
• our local authority [Luton Borough Council];
• a pupil’s home local authority (if different);
• the Department for Education (DfE);
• school governors / trustees;

From time to time, we may also share pupil information other third parties including the following:

• the Police and law enforcement agencies;
• NHS health professionals including the school nurse, educational psychologists,
• Education Welfare Officers;
• Courts, if ordered to do so;
• the National College for Teaching and Learning;
• the Joint Council for Qualifications;
• Prevent teams in accordance with the Prevent Duty on schools;
• other schools, for example, if we are negotiating a managed move and we have your consent to share information in these circumstances;
• our legal advisors;
• our insurance providers / the Risk Protection Arrangement;

Some of the above organisations may also be Data Controllers in their own right in which case we will be jointly controllers of your personal data and may be jointly liable in the event of any data breaches. 

In the event that we share personal data about pupils with third parties, we will provide the minimum amount of personal data necessary to fulfil the purpose for which we are required to share the data.

Why we share pupil information

We do not share information about our pupils with anyone without consent unless the law allows us to do so.

We share pupils’ data with the Department for Education (DfE) on a statutory basis. This data sharing underpins school funding and educational attainment policy and monitoring.

We are required to share information about our pupils with our local authority (LA) and the Department for Education (DfE) under section 3 of The Education (Information About Individual Pupils) (England) Regulations 2013.

Data collection requirements:

To find out more about the data collection requirements placed on us by the Department for Education (for example; via the school census) go to https://www.gov.uk/education/data-collection-and-censuses-for-schools.

The National Pupil Database (NPD)

The NPD is owned and managed by the Department for Education and contains information about pupils in schools in England. It provides invaluable evidence on educational performance to inform independent research, as well as studies commissioned by the Department. It is held in electronic format for statistical purposes. This information is securely collected from a range of sources including schools, local authorities and awarding bodies.

We are required by law, to provide information about our pupils to the DfE as part of statutory data collections such as the school census and early years’ census. Some of this information is then stored in the NPD. The law that allows this is the Education (Information About Individual Pupils) (England) Regulations 2013.

To find out more about the pupil information we share with the department, for the purpose of data collections, go to https://www.gov.uk/education/data-collection-and-censuses-for-schools.

 

To find out more about the NPD, go to https://www.gov.uk/government/publications/national-pupil-database-user-guide-and-supporting-information.

The department may share information about our pupils from the NPD with third parties who promote the education or well-being of children in England by:

• conducting research or analysis
• producing statistics
• providing information, advice or guidance

The DfE has robust processes in place to ensure the confidentiality of our data is maintained and there are stringent controls in place regarding access and use of the data. Decisions on whether DfE releases data to third parties are subject to a strict approval process and based on a detailed assessment of:

• who is requesting the data;
• the purpose for which it is required;
• the level and sensitivity of data requested; and
• the arrangements in place to store and handle the data.

To be granted access to pupil information, organisations must comply with strict terms and conditions covering the confidentiality and handling of the data, security arrangements and retention and use of the data.

For more information about the department’s data sharing process, please visit:

https://www.gov.uk/data-protection-how-we-collect-and-share-research-data

For information about which organisations the department has provided pupil information, (and for which project), please visit the following website: https://www.gov.uk/government/publications/national-pupil-database-requests-received

To contact DfE: https://www.gov.uk/contact-dfe

Requesting access to your personal data

Under data protection legislation, parents and pupils have the right to request access to information about them that we hold (“Subject Access Request”).  Where a child does not have the maturity to make their own requests for personal data, parents may do so on their behalf in a primary school setting.  To make a request for your child’s personal data, or be given access to your child’s educational record, contact The Executive Head teacher although any written request for personal data will be treated as a Subject Access Request.

Subject to the section below, the legal timescales for the School to respond to a Subject Access Request is one calendar month.  As the School has limited staff resources outside of term time, we encourage parents / pupils to submit Subject Access Requests during term time and to avoid sending a request during periods when the School is closed or is about to close for the holidays where possible.  This will assist us in responding to your request as promptly as possible.  [For further information about how we handle Subject Access Requests, please see our Data Protection Policy].

Parents of pupils who attend a maintained school have a separate statutory right to access their child’s educational record.  Upon receipt of a written request for a pupil’s educational record, the School will respond to it within 15 school days. This is an independent legal right of parents which falls outside of the GDPR, therefore a pupil’s consent is not required even if a pupil is able to make their own decisions in relation to their personal data unless a court order is in place which states otherwise.

The term “parent” is widely defined in education law to include the natural or adoptive parents (regardless of whether parents are or were married, whether a father is named on a birth certificate or has parental responsibility for the pupil, with whom the pupil lives or whether the pupil has contact with that parent), and also includes non-parents who have parental responsibility for the pupil, or with whom the pupil lives.  It is therefore possible for a pupil to have several “parents” for the purposes of education law.

You also have the right to:

• object to processing of personal data that is likely to cause, or is causing, damage or distress;
• prevent processing for the purpose of direct marketing;
• object to decisions being taken by automated means;
• in certain circumstances, have inaccurate personal data rectified, blocked, erased or destroyed; and
• claim compensation for damages caused by a breach of the our data protection responsibilities.

Contact:

If you have any questions, concerns or would like more information about anything mentioned in this privacy notice, please contact:

• The Head teacher or the  Data Protection Officer via the School Office