Privacy Notice (How We Use Pupil Information)
We, the Federation of St Cuthbert’s & St Sebastian’s are a Data Controller for the purposes of the 2018 Data General Data Protection Regulations (GDPR) and previously the Data Protection Act of 1998.
Contact
If you would like to discuss anything in this privacy notice, please contact:
School Office:
0151 228 4137 for St Cuthbert’s; 0151 260 9697 for St Sebastian’s.
Why We Collect And Use This Information
Section 537A of the Education Act 1996 requires schools to collect and provide any such individual pupil information as may be prescribed. This includes sharing of a set of named pupil records through the submission of termly school census returns to the local authority and DfE.
Putting the school census on a statutory basis:
- means that schools do not need to obtain parental or pupil consent to the provision of information
- ensures schools are protected from any legal challenge that they are breaching a duty of confidence to pupils
- helps to ensure that returns are completed by schools
To find out more about the data collection requirements placed on us by the Department for Education go to https://www.gov.uk/education/data-collection-and-censuses-for-schools.
We also collect and share individual pupil information with the local authority – including attendance and exclusions data- each week. This is supported under The Education (Pupil Registration) (England) Regulations 2006 Regulation 12; Children’s Act 2004 Section 10: co-operation to improve wellbeing; Children’s Act 2004 Section 11: arrangement to safeguard and promote welfare; Education and Inspections Act 2006 Section 38 and Working together to safeguard children March 2013 Guidance.
This information is used by the local authority to fulfil a number of statutory duties:
- to ensure there are sufficient school places in the area
- promote high education standards
- ensure fair access to educational opportunity and promote the fulfilment of every child’s educational potential
- the need to meet the local authority’s safeguarding requirements
- to facilitate the ability of partner organisations to support the learning and welfare of children and young people through the exchange of data and the use of information not otherwise available to either organisation.
For more information on how the local authority uses information we share with them go to http://liverpool.gov.uk/schools-and-learning/requests-for-pupil-records/.
We also use the pupil data:
- to support pupil learning
- to monitor and report on pupil progress
- to provide appropriate pastoral care
- to assess the quality of our services
- to comply with the law regarding data sharing
- to respond to LA and DfE requirements
The Lawful Basis On Which We Use This Information
We collect and use pupil information under Articles 6 and 9 of the GDPR (General Data Protection Regulations):
- Article 6.1c – processing is necessary for compliance with a legal obligation to which the controller is the subject;
- Article 6.1e – processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
- Article 9.2g – processing is necessary for reasons of substantial public interest, on the basis of Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject.
Collecting Pupil Information
Whilst the majority of pupil information you provide to us is mandatory, some of it is provided to us on a voluntary basis. In order to comply with the General Data Protection Regulation, we will inform you whether you are required to provide certain pupil information to us or if you have a choice in this.
The categories of pupil information that we collect, hold and share include:
- Personal information (such as name, unique pupil number and address)
- Characteristics (such as ethnicity, language, nationality, country of birth and free school meal eligibility)
- Attendance information (such as sessions attended, number of absences and absence reasons)
- Assessment information (such as key stage test results and assessments)
- Special educational needs information
- Exclusions/ behavioural information
- Post 16 learning information
Who We Share Pupil Information With
We routinely share pupil information with:
- schools that the pupil’s attend after leaving us
- our local authority – Liverpool City Council
- the Department for Education (DfE)
- NHS
- Federated Schools
- School Nurse
- Health Professionals e.g. Education Psychologists
Why We Share Pupil Information
We share pupils’ data with the Department for Education (DfE) on a statutory basis. This data sharing underpins school funding and educational attainment policy and monitoring.
We are required to share information about our pupils with our local authority (LA) and the Department for Education (DfE) under section 3 of The Education (Information About Individual Pupils) (England) Regulations 2013.
Youth Support Services
Pupils Aged 13+
Once our pupils reach the age of 13, we also pass pupil information to our local authority and / or provider of youth support services as they have responsibilities in relation to the education or training of 13-19 year olds under section 507B of the Education Act 1996.
This enables them to provide services as follows:
- youth support services
- careers advisers
A parent or guardian can request that only their child’s name, address and date of birth is passed to their local authority or provider of youth support services by informing us. This right is transferred to the child/pupil once he/she reaches the age 16.
Pupils Aged 16+
We will also share certain information about pupils aged 16+ with our local authority and/or provider of youth support services as they have responsibilities in relation to the education or training of 13-19 year olds under section 507B of the Education Act 1996.
This enables them to provide services as follows:
- post-16 education and training providers
- youth support services
- careers advisers
The National Pupil Database (NPD)
The NPD is owned and managed by the Department for Education and contains information about pupils in schools in England. It provides invaluable evidence on educational performance to inform independent research, as well as studies commissioned by the Department. It is held in electronic format for statistical purposes. This information is securely collected from a range of sources including schools, local authorities and awarding bodies.
We are required by law, to provide information about our pupils to the DfE as part of statutory data collections such as the school census and early years’ census. Some of this information is then stored in the NPD. The law that allows this is the Education (Information About Individual Pupils) (England) Regulations 2013.
To find out more about the NPD, go to https://www.gov.uk/government/publications/national-pupil-database-user-guide-and-supporting-information.
The department may share information about our pupils from the NPD with third parties who promote the education or well-being of children in England by:
- conducting research or analysis
- producing statistics
- providing information, advice or guidance
The Department has robust processes in place to ensure the confidentiality of our data is maintained and there are stringent controls in place regarding access and use of the data. Decisions on whether DfE releases data to third parties are subject to a strict approval process and based on a detailed assessment of:
- who is requesting the data
- the purpose for which it is required
- the level and sensitivity of data requested: and
- the arrangements in place to store and handle the data
To be granted access to pupil information, organisations must comply with strict terms and conditions covering the confidentiality and handling of the data, security arrangements and retention and use of the data.
For more information about the department’s data sharing process, please visit: https://www.gov.uk/data-protection-how-we-collect-and-share-research-data.
For information about which organisations the department has provided pupil information, (and for which project), please visit the following website: https://www.gov.uk/government/publications/national-pupil-database-requests-received.
To contact DfE: https://www.gov.uk/contact-dfe
Requesting Access To Your Personal Data
Under data protection legislation, parents and pupils have the right to request access to information about them that we hold. To make a request for your personal information, or be given access to your child’s educational record, contact the school offices.
You also have the right to:
- object to processing of personal data that is likely to cause, or is causing, damage or distress
- prevent processing for the purpose of direct marketing
- object to decisions being taken by automated means
- in certain circumstances, have inaccurate personal data rectified, blocked, erased or destroyed; and
- claim compensation for damages caused by a breach of the Data Protection regulations
If you have a concern about the way we are collecting or using your personal data, we request that you raise your concern with us in the first instance. Alternatively, you can contact the Information Commissioner’s Office at https://ico.org.uk/concerns/.
Storing Pupil Data
We hold pupil data as directed by the Local Authority and DfE. The federation has a Data Retention Policy which is available on request.
COVID-19 High Risk Groups
Privacy Notice
This privacy notice is to make it easier to understand and provide you with more information about how The Federation of St Cuthbert’s and St Sebastian’s may seek to collect and hold information about you in relation to the unprecedented challenges we are all facing during the Coronavirus pandemic (COVID-19).
At this time, The Federation of St Cuthbert’s and St Sebastian’s may seek to collect and process your personal data in response to the recent outbreak of Coronavirus, which is above and beyond what would ordinarily be collected in order to ensure your safety and well-being.
Such information will be limited to what is proportionate and necessary, taking into account the latest guidance issued by the Government and health professionals, in order to manage and contain the virus.
It will enable the The Federation of St Cuthbert’s and St Sebastian’s to effectively fulfil our functions to keep people safe, put contingency plans into place to safeguard those vulnerable and aid business continuity.
What Personal Data Is Being Collected?
In order to best respond and help coordinate the community response for COVID-19 it is necessary to collect:
- Basic details about you including name, address, telephone number and email address.
- We will also need to collect details about your health to identify if you (or those closely linked to you) are in any of the high-risk categories and would be considered vulnerable, if infected with Coronavirus.
Who Is Processing Your Data?
All personal data held, is processed in accordance with the Data Protection Act 2018 and General Data Protection Regulation. The Data Controller for the information outlined in this privacy notice is The Federation of St Cuthbert’s and St Sebastian’s .
How Will We Use The Information We Hold About You?
We will use the information you provide to:
- Connect you to support in the community as part of the COVID-19 response.
- To analyse your information in order to improve the services we offer.
What Is Your Lawful Basis For Processing Your Personal Data?
The legal basis for processing the data is that it is in the public interest for us to deal with the outbreak of COVID-19.
The General Data Protection Regulation requires specific conditions to be met to ensure that the processing of personal data is lawful. These relevant conditions are below:
- Article 6(1)(d) – is necessary in order to protect the vital interests of the data subject or another natural person.
- Recital 46 adds that “some processing may serve both important grounds of public interest and the vital interests of the data subject as for instance when processing is necessary for humanitarian purposes, including for monitoring epidemics and their spread”.
- Article 6(1)(e) – is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
- Section 8(c) of the Data Protection Act sets out that such a task must be necessary for the performance of a function conferred on a person by an enactment or rule of law.
- The processing of special categories of personal data, which includes data concerning a person’s health, are prohibited unless specific further conditions can be met. These further relevant conditions are below:
- Article 9(2)(i) – is necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health.
- Schedule 1, Part 1(1) – is necessary for the performance or exercising obligations or rights which are imposed or conferred by law on the controller or the data subject in connection with employment, e.g. Health and Safety at Work Act 1974.
- Schedule 1, Part 1(3) – is necessary for reasons of public interest in the area of public health, and is carried out by or under the responsibility of a health professional, or by another person who in the circumstances owes a duty of confidentiality under an enactment or rule of law, e.g. Governmental guidance published by Public Health England
Who Will We Share Your Information With?
We will normally only share your information with other partner organisations as part of the response to the COVID-19 outbreak.
We will not share your information with anyone else unless required to do so under additional legal requirements, for example to assist the government in containing the spread of COVID-19. This may be where we are required to do so by law, to safeguard public safety, and in risk of harm or emergency situations.
Any information which is shared will only be shared on a need to know basis, with appropriate individuals. Only the minimum information for the purpose will be shared.
How Long Will My Personal Data Be Retained For By The School?
The School will only keep your information for as long as it necessary, taking into account of Government advice and the on-going risk presented by Coronavirus. At a minimum the information outlined in this privacy notice will be kept for the duration of the COVID-19 response.
Information provided in relation to this outbreak of Coronavirus will not be used for any other purpose, including to be held within personnel files ‘just in case’ it may be needed again.
When the information is no longer needed for this purpose, it will be securely deleted.
Your Rights
If you are not happy about the way your personal data is being processed you can complain directly to the School or the School’s Data Protection Officer – School Improvement Liverpool 0151 233 3901
or
Chris Walsh: dpo@liverpool.gov.uk
You also have the right to complain to the Information Commissioner’s Office:
- Website: ico.gov.uk
- Post: The Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
- Email: mail@ico.gsi.gov.uk
- Telephone: 0303-123-113
If you require further information about how we process your personal data, you can contact the Data Protection Officer at – DPO@liverpool.gov.uk
Further advice and guidance from the ICO on this issue can be found on the ICO website at www.ico.gov.uk