📨 Updated Subject Access Request Guidance for MATs & Schools
December 11, 2024
We have a bumper issue this month with a lot to get through so we thought it best to get straight to business!
The main update this month is regarding the ICO’s new Accountability Framework and our plans for an auditable action plan document based on this. There is also:
If you have any further questions about the topics below, or if you would like to book your next visit from us, either online using video conferencing or onsite once schools are accepting visitors, please get in touch via GDPR@schoolpro.uk.
Stay safe and healthy!
The ICO has recently released a new accountability framework designed to help organisations assess their accountability. This is a key element of data protection work and shows that data protection is not a one-off activity but an ongoing process for organisations. The accountability framework focuses on 10 key areas:
The ICO suggests that the framework could be used for a number of things such as:
We are in the process of using this new framework to create an auditable Data Protection Toolkit or Action Plan for schools. This document will contain key actions, success criteria and other features that will be very similar to a School Development Plan but for Data Protection. A Data Protection Development Plan or DPDP!
he NHS Test and Trace system has not been without controversy including the newly launched app. We will reiterate again that you MUST have something in place that gives your pupils, parents, staff, governors, visitors and any other school stakeholders transparency about what data you will collect or use for this system, how it will be used, who it will be shared with, and the legal basis for this sharing. Our NHS Test and Trace addendum is designed to do just that so please ensure that you are using it within your organisation.
The ICO has also reiterated the importance of getting it right with this data and “protecting customer and visitor details”. Their guidance can be found here and can be summarised by the following 5 points:
The National Cyber Security Council (NCSC) has issued an alert to the academic sector following a spate of online attacks against UK schools, colleges and universities. This has been supported by a guidance document that gives practical cyber security tips for everyone working in education. The document can be downloaded by clicking on the image below:
The NCSC explains that schools are vulnerable to cyber attacks because:
The document goes on to highlight ways in which schools can best protect themselves from these attacks such as:
Back in February we wrote about dealing with Freedom of Information requests. There are a few doing the rounds at the moment so we thought that we would repeat some of the information again here:
Ideally, you should have a Freedom of Information Policy for your school – there is a template for this on the portal – and this contains a lot of information about how you will respond to requests, what exemptions may apply and when you may charge a fee, among other things.
As public bodies, state schools are obliged, under the Freedom of Information (FOI) Act 2000, to publish certain information about their activities and produce information requested by members of the public. The principles of the FOI Act are:
The FOI Act covers recorded information that is held by the school including printed documents, computer files, letters, emails, photographs, and sound or video recordings. This means that schools do not need to provide information they do not collect and hold as part of their regular routines. So, if the information is just in someone’s head and is not recorded, this is not subject to a Freedom of Information Request. As the guidance on the ICO website states, “You do not have to create new information or find the answer to a question from staff who may happen to know it.”
This is just the first part of our guidance – the rest can be found in a previous blog post here or can be downloaded as a pdf from the portal or from this link.
If you have any questions about this, please contact us and we can help!
We are asked data protection questions by schools on a daily basis and there are some questions that come up regularly. We are looking at how we can create a FAQs section either on the website or in the portal for these. In the meantime, here are a couple of the questions we’ve been asked recently and the answers we have provided. We will publish more in future newsletters:
You are indeed able to store the photos as an historical record. There is an exemption in the Data Protection Act (2018) which applies to “Archiving in the Public Interest” which this comes under. (Schedule 2, Part 6, Paragraph 28 of the DPA 2018)
The best way to address this is to ensure that your retention policy states that photos will be kept for the purposes of archiving in the public interest and creating an historical record. It may also be worthwhile adding that statement to your photo consents going forward so that parents/pupils are aware in advance. Technically, you don’t have to get consent for this (that’s what the exemption means) but you might want to let people know that photos will be archived in this way. You don’t have to though!
Within the exemption itself, it states that it is available only where personal data is processed in accordance with Article 89(1) of the GDPR. This is essentially stating that the processing must be subject to appropriate safeguards for individuals’ rights and freedoms – among other things, you must implement data minimisation measures.
You must ensure the personal data you are processing is:
And it is important to ensure that they are kept securely as well of course, as that would also constitute an appropriate safeguard for individuals’ rights and freedoms!
Essentially, the ICO has been keen to stress that data protection should not be a barrier to sharing data with the police where it is necessary. They have written a blog post clarifying this which can be found here.
The key message is that the GDPR and DPA 2018 do not prevent data sharing but it must be done appropriately. To quote:
“Organisations should remain confident that when asked for personal data to assist the police whether in an emergency, or in their ongoing community policing activities, necessary, relevant and proportionate data can be disclosed in compliance with the law.”
Depending on the detail in the data request, it would be worth clarifying that with them to make you able to appropriately assess whether the information you are disclosing is necessary, relevant and proportionate. This links to the following quote:
“In particular it is in the DPA2018 where organisations will find the rules surrounding the processing of data for law enforcement purposes. In addition, Part 3 of the Act specifically applies to organisations defined as ‘competent authorities’ – such as police forces, criminal courts and prisons.
Requests for information made by competent authorities must be reasonable in the context of their law enforcement purpose, and the necessity for the request should be clearly explained to the organisation.”
They give an example which we think is relevant:
“…take the example of a social worker, who is asked to pass on case files to police containing details of young teenagers. … the social worker might feel reluctant to voluntarily disclose information to the police if the request appears excessive, or the necessity or urgency appears unjustified. So the onus is on the police to provide as much clarity as they can without prejudicing their investigation.”
We recommend:
Apps for children must offer privacy by default – BBC
Nearly 500,000 Scots removed from police database – BBC
Free VPNs are a privacy nightmare. You shouldn’t download them – Wired
Private data gone public: Razer leaks 100,000+ gamers’ personal info – ArsTechnica
Zhenhua Data leak: personal details of millions around world gathered by China tech company – The Guardian
Phishers are targeting employees with fake GDPR compliance reminders – Help Net Security
Data breach following cyber attack prompts legal action against University of Surrey – Surrey Live
Cybersecurity lessons learned from data breaches and brand trust matters – Help Net Security
Covid: Worker fired for misusing test-and-trace details – BBC
Pension scheme cold caller fined £130,000 by UK data watchdog – The Register
GCHQ agency ‘strongly urges’ Brit universities, colleges to protect themselves after spike in ransomware infections – The Register
UK Parliament’s human rights committee pushes for better protections of coronavirus contact-tracing data in law – The Register
SchoolPro TLC Ltd (2020)
SchoolPro TLC is not responsible for the content of external websites.
For a confidential conversation about the needs of your school or organisation, please contact SchoolPro TLC using the links below. Based in Gloucestershire, available anywhere in the UK!
SchoolPro TLC Limited was formed by school and education leaders with over 60 years of experience across all stages of education and in a variety of contexts. The company founders have worked to improve educational provision as both senior leaders and school governors.
Monday – Friday : 8am – 6pm
© 2024 SchoolPro TLC – All Rights Reserved