📨 Updated Subject Access Request Guidance for MATs & Schools
December 11, 2024
The end of another academic year is here and our breach log has been lighting up with incidents of end of year reports being sent to the wrong person! If your school has fallen foul of this particular breach, now would be a good time to review your systems in advance of 12 months’ time.
The start of the new academic year is also a time when many schools are still sending out Data Collection Sheets to families. This can be another breach risk and it would be worth asking yourself those same three questions about this process too. Pre-empt the breach before it happens!
The main topic this month focuses on the now-introduced UK Data Protection and Digital Information Bill. It is still early days for the new Bill but we give our early takes at this stage. There is also:
Due to the topics we have included this month, we haven’t created an ‘All Staff’ update. We expect there will be one with the next newsletter in the new academic year.
And, as always, if you have any further questions about the topics below, or if you would like to book your next visit from us, either online using video conferencing or onsite now many schools are accepting visitors, please get in touch via our new email address DPO@schoolpro.uk.
Don’t forget, if there is anything else that you need support with at this time, please ask and we will do whatever we can within our capacity to assist.
Stay safe and healthy!
On the 18th July, the Government introduced their new Data Protection and Digital Information Bill (formally known as the Data Reform Bill). We broke down some of the implications of their consultation response last month and not a lot has changed now that the bill itself has been introduced.
Whilst timescales are still unclear, it could be that the new Bill will come into force by early 2023. However, potential ministerial and/or Government changes in that time could impact both the Bill and the timescales around it. As could the various readings as it goes through parliament.
This is the first area that we want to focus on at this early stage:
The new Bill replaces the current requirement to have a Data Protection officer with a requirement to appoint a ‘senior responsible individual’ (SRI). The SRI has to be “a designated individual [who] must be part of the organisation’s senior management” or two or more individuals who act jointly if people are employed part-time and share a single senior management role.
Just like a DPO currently, the details of the SRI must be publicly available and the SRI must be “individuals who play significant roles in the making of decisions about how the whole or a substantial part of its activities are to be managed or organised.” This would seem to rule out the possibility of an externally appointed SRI and also raised questions about conflicts of interest.
The Bill then goes on to list the tasks of the SRI (many of which overlap with a current DPO) in paragraph 30:
The Bill continues with, and this is key, “The senior responsible individual designated by a controller must be responsible at least for performing the tasks listed in paragraph 30 or securing that they are performed by another person.”
This then, brings back the role of the externally appointed individual or company and addresses the potential issues around conflicts of interest that the SRI might have when performing those tasks. In fact, the Bill clearly states that “Where the performance of one of its tasks would result in a conflict of interests, the senior responsible individual must secure that the task is performed by another person.”
When identifying who ‘another person’ could be, the Bill states that “the senior responsible individual must consider, among other things:
For a more in depth review of how the new Bill compares to the old requirements of the GDPR, see the IAPP’s comparative analysis – UK DPDI Bill: Comparative analysis with the EU GDPR and ePrivacy framework | IAPP
Here is an accessible version of the Data Protection and Digital Information Bill.
Paragraph 220 of Keeping Children Safe in Education 2022 states that “schools and colleges should consider carrying out an online search as part of their due diligence on the shortlisted candidates. This may help identify any incidents or issues that have happened, and are publicly available online, which the school or college might want to explore with the applicant at interview.”
We have been contacted by a few schools about the possible data protection implications of this. They are as follows:
We know that our privacy notice templates need an update as a result of this update to KCSIE 2022. We will be looking to get those updates done over the summer and the new templates available on the portal in time for the new academic year.
Over the past month, the DfE has sent out a number of updates to their guidance which impact on data protection work. These are as follows:
The final update of these three is simply a new tool for digging into the information of a number of MIS tools and comparing features. However, the other two require a little more explanation:
The updated guidance was only released yesterday morning (21st July) so we haven’t had a chance to fully process it yet. However, we will be doing so over the summer and getting out any updates to schools in advance of the new school year. It may mean an update to our:
These are both documents that you should have in place if you are processing biometric data so we will look at ensuring the most up to date templates are available for schools before the start of the new academic year.
For this update, the DFE has uploaded new versions of the National Pupil Database data tables, School Workforce data tables, Individualised Learner Record data tables and the Higher Education Statistics Agency data tables. They have also made minor updates to the application form, guidance and information security questionnaire.
There isn’t any specific action that you need to take here as our privacy notice templates already contain links to this DfE page and so will link to the latest guidance on it as it is updated.
Each month we throw the spotlight on a different partner. This month it is Cloud Happi who say:
“We’re on a mission to shake up IT in schools, and to show you there is a better way. Very quickly, we’ll switch your school to fast, secure and affordable cloud-based technology. No mess, no loss of access, and no disruption to your pupils and staff – the only thing your staff will notice is fast, secure, fuss-free technology. Contact us today, and start your journey to better IT.”
Increased Ransomware Threat
Organisations can get advice about how to prevent and protect against ransomware at the NCSC ransomware hub here:
A guide to ransomware – NCSC.GOV.UK
Warnings continue to go out with regards to an increased cyber threat as a growing consequence of the on going situation in Ukraine. More information on what actions you can take can be found here:
Actions to take when the cyber threat is heightened – NCSC.GOV.UK
Email Security Tool
The NCSC has recently launched an email security tool to assist organisations in checking their defences. The security service check helps organisations to identify vulnerabilities. More information can be found here:
New email security tool launched to help organisations… – NCSC.GOV.UK
NCSC Expands Services to Protect Against Online Scams
A record number of scams were removed online in 2021. This was due to the Active Cyber Defence programme and the National Cyber Security Centre has significantly expanded its services in order to protect the UK against this new level of threat. Read on for more:
NCSC significantly expands services to protect UK from… – NCSC.GOV.UK
Other Threats Identified…
We are asked data protection questions by schools on a daily basis and there are some questions that come up regularly. We now have an FAQ section on the website for these and all of our answers are published there. You can find this on the Data Protection page of the website or in the blog. Here is one of the questions we’ve been asked recently and the answer we have provided. We will publish more in future newsletters:
Answered May ’22.
The Surveillance Camera Code of Practice states the following:
7.2 There may be other limited occasions when disclosure of images to another third party, such as a person whose property has been damaged, may be appropriate. Such requests for images or information should be approached with care and in accordance with the data protection legislation, as a wide disclosure may be an unfair intrusion into the privacy of the individuals concerned.
7.3 A system operator should have clear policies and guidelines in place to deal with any requests that are received. In particular:
- Arrangements should be in place to restrict disclosure of images in a way consistent with the purpose for establishing the system.
- Where images are disclosed, consideration should be given to whether images that may identify individuals need to be obscured to prevent unwarranted identification.
- Those that may handle requests for disclosure should have clear guidance on the circumstances in which disclosure is appropriate.
- The method of disclosing images should be secure to ensure they are only seen by the intended recipient.
- Appropriate records should be maintained.
7.4 Judgements about disclosure should be made by a system operator. They have discretion to refuse any request for information unless there is an overriding legal obligation such as a court order or information access rights. Once they have disclosed an image to another body, such as the police, then the recipient becomes responsible for their copy of that image.
We’ve highlighted some of the key points in bold. It is down to the school to decide if it is appropriate and you will need to demonstrate you have guidance on this (which should be in your CCTV Policy) and a way of recording requests. We have a CCTV Request Log template in Global Documents on the portal that could be used for this, or it could be logged as a Data Decision.
Other legislation to consider is the UK GDPR and DPA 2018. This is technically a SAR although you are disclosing a third party’s data. This guidance is the most relevant – What should we do if the request involves information about other individuals? | ICO. The guidance states that you can release data about a third party without their consent if you feel it is reasonable to comply with the request without that individual’s consent. Step Three of the guidance on ‘information about others’ shows the considerations that the school should take about releasing this information. As long as you are making the considerations as seen in the guidance, taking into consideration that context, then you will not go too far wrong.
You could also consider limiting the amount of information too – perhaps if you are able to extract and release stills of the footage rather than the footage itself, or even just the details of the car/driver – this may assist with this decision.
We spoke to the ICO about this specific situation and they said:
These decisions can be tricky to make, but with the use of the guidance and your knowledge of the context of the situation, you should be able to justify either holding the information back, or releasing it. In either case you will be balancing up the information rights of all parties involved.
So, in summary, the key actions will be:
Since our last newsletter, we have added a large number of links to websites we think you will find useful. These can be found in the ‘Important Weblinks’ folder in Global Documents and includes links to sites such as Action Fraud, the National Cyber Security Centre and the ICO.
We have also added a new folder where we are going to put Data Processor Agreements (DPAs) that have been signed by companies (processors) and that can be used by schools. At present, there is a single DPA in the folder for Squirrel Learning Ltd – GoRead, GoWrite, GoApps.
UK court: Sharing citizen data with foreign allies was legal | The Register
Brent Council investigates Veolia over data breach | Kilburn Times
‘Data localisation’ is seeping into UK public sector contracts | Tech Monitor
Apple’s Tim Cook: Protecting privacy ‘most essential battle of our time’ | IAPP
Facebook Doesn’t Know What It Does With Your Data, Or Where It Goes: Leaked Document | Vice
Phishing operation hits NHS email accounts | The Register
Microsoft, Apple, Google step up push to eliminate passwords | The Register
Assessing risk: Determining the appropriate risk flags for your privacy risk assessments | IAPP
Apple, Google, and Microsoft team up to support passwordless FIDO logins | The Verge
Web ad firms scrape email addresses before you know it | The Register
Cornwall Council data breach: Children’s details published | BBC News
Privacy. Ad bidders haven’t heard of it, report reveals | The Register
Email is the riskiest channel for data security | Help Net Security
Halfords removes vulnerability that leaked customer details | The Register
Facebook Reportedly Collects Data About Abortion Seekers | CNET
Microsoft Plans to Eliminate Face Analysis Tools in Push for ‘Responsible A.I.’ | The New York Times
Japanese city worker loses USB containing personal details of every resident | The Guardian
SchoolPro TLC Ltd (2024)
SchoolPro TLC guidance does not constitute legal advice.
SchoolPro TLC is not responsible for the content of external websites.
For a confidential conversation about the needs of your school or organisation, please contact SchoolPro TLC using the links below. Based in Gloucestershire, available anywhere in the UK!
SchoolPro TLC Limited was formed by school and education leaders with over 60 years of experience across all stages of education and in a variety of contexts. The company founders have worked to improve educational provision as both senior leaders and school governors.
Monday – Friday : 8am – 6pm
© 2024 SchoolPro TLC – All Rights Reserved