GDPR

GENERAL DATA PROTECTION REGULATION (GDPR)
 
From 25th May 2018 Data protection regulations have changed.  This page will show how Leechpool Primary School use and store your data.  It will also give you information about how to access and change the data we hold on you or your child and what consent you will be asked to give.
 
As part of the new regulations the school have appointed Hazel Wellcome as the Data Protection Officer.  Any enquiries about data should go to the Data Protection Officer via the Leechpool e-mail address office@leechpool.w-sussex.sch.uk or by calling 01403 210 233
 
Leechpool Primary School is registered with the ICO.  Registration reference Z6724985
POLICIES / PRIVACY NOTES
FREEDOM OF INFORMATION
IDENTIFYING OUR LAWFUL BASIS FOR PROCESSING DATA
 

 

In schools

We use public task as your lawful basis for most of your processing. This means that we need to process personal data to carry out your official functions in the public interest.

We also use consent for processing data where it's not necessary for you to fulfill your function. This is used when none of the other bases apply, as the standard for getting consent is very high and consent can be withdrawn at any time.

SIX PRINCIPLES OF DATA PROTECTION
 
There were 8 principles under the DPA and now there are 6. Essentially the same but condensed. Article 5 of the GDPR states that personal data must be:
  1. Processed fairly, lawfully and in a transparent manner in relation to the data subject.
  2. Collected for specified, explicit and legitimate purposes and not further processed for other purposes incompatible with those purposes.
  3. Adequate, relevant and limited to what is necessary in relation to the purposes for which data is processed.
  4. Accurate and, where necessary, kept up to date.
  5. Kept in a form that permits identification of data subjects for no longer than is necessary for the purposes for which the personal data is processed.
  6. Processed in a way that ensures appropriate security of the personal data including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures.
RIGHTS
Individuals have the following rights:
  1. be informed of data processing (which is covered by the School’s Privacy Notice)
  2. access information (also known as a Subject Access Request)
  3. have inaccuracies corrected
  4. have information erased
  5. restrict processing
  6. data portability (this is unlikely to ever be relevant to schools)
  7. intervention in respect of automated decision making (automated decision making is rarely operated within schools)
  8. Withdraw consent
  9. Complain to the Information Commissioner’s Office
HOW WE DEAL WITH RECORDS
DATA WITH THIRD PARTIES
 
Leechpool use third party IT systems in order to process data such as attendance, communication and special needs information.  All providers are GDPR compliant and have strict procedures in please to protect any information they hold.
 
The main third party providers are:-
 
SIMS - this is the system run on behalf of West Sussex County Council by Capita.  It holds all of the pupils information that is required for their education.  Contact details for the pupils and parents/guardian as well as any special needs and medical information.  This information is passed to any school that the pupil transfers to through an electronic CTF file.  This system also provides the Government details for census and exam results as well as recording registration and attendance information.  See GDPR statement from Capita SIMS.
 
eschools - This is the schools communication platform.  We also hold our class pages where homework can be set and pupils can communicate with each other.  Payments for trips and parent evening bookings can be made.  Data is transferred from SIMS to eschools.  The data required will be basic name, sex and email address that is used for communicating.  Please see eschool privacy notice for further details.
 
CPOMS - This is our safeguarding system.  All information is entered by staff regarding any special needs or safeguarding information that is relevant for the school.  The information on this system is restricted.
 
Target Tracker - On this system test results and assessments are kept to help the school monitor pupil progress.  This system gets data from SIMS.  Plesae see EYFP Primary Target Tracker Studen Data Policy.
 
2Simple - Used in Early Years to capture observations of the children's progress.  This can be shared with parents.  See GDPR statement from 2Simple for further details.
 
Library System - run by Capita.  Holds basic information.  Children's details are deleted when they leave.  See GDPR statement from Capita SIMS.
 
Bug club - run by ActiveLearn.  Hold name and date of birth.  Information comes from SIMS.  Pupils details are deleted when they leave.  Click on link for more details  Bug Club GDPR
 
Rock Stars, My Maths - These systems use minimal pupil data such as name and date of birth.  Pupil data is deleted once they leave Leechpool.
 
JSPC - This is our IT supplier who manage our server and IT systems.  Data is held on a cloud system.  JSPC work with many schools in the West Sussex area are are GDPR compliant.  See JSPC Data policy.
 
Cool Milk - When a Reception child starts at Leechpool their name, date of birth and class are sent to cool milk to provide free milk.  See Cool Milk GDPR statement.
 
Tempest Photography - Tempest take the school photos each year.  They are given via SIMS a list of all of the children with a barcode that hold identification information.  Once the photos are taken this barcode enables the photographs to be uploaded into SIMS for identification of children.  See the Tempest statement.
 
 
TRAINING
 
All Governors and staff have been made aware of the new GDPR regulations.  New staff are given this information at their induction and are expected to read the Data Protection policy.  Staff have access to the important policies and some are displayed in the staff room.
DATA SECURITY
 
Leechpool Primary have a procedure to deal with any breach in data security.  Any breach will be reported to and dealt with by the DPO.  The breach will be recorded, investigated and steps taken to lessen any impact.  The DPO will decide if the breach is significant enough to report to the ICO.  This must be done within 72 hours of the data breach.  The DPO will evaluate the breach, risk assess and put in any changes to data security or process as required.
DATA PROTECTION OFFICER/GOVERNANCE
 
The DPO for Leechpool Primary School is Hazel Wellcome.  She is responsible for update policies and produces and ensuring they are kept too.  All policies are agreed with the School Governors.
 
Any queries relating to Data should be address to the Data Protection Officer.
CONSENT
 
The lawful basis for processing personal data of students and staff is that it is necessary in order for the School to discharge its legal obligations and statutory duties. In respect of this processing the Privacy Notices are sufficient to ensure lawful processing. It is not usual for Schools to process personal data solely based on written consent. Where the School takes a photograph or film of someone on school premises, events or trips and wants to use this image for educational purposes, consent is not required.  However, the pupil if over 16 years old, or if younger their guardian must still be informed that photography or filming is taking place and the context in which the image will be used. 
 
Consent will be required where there is additional processing of personal data which is not within the reasonable expectation of those involved.
 
Who’s consent?
 
Where the child is below the age of 16 years, consent must be given by the holder of parental responsibility over the child. 
 
How we obtain consent.
 
When a pupil starts at Leechpool a consent form is sent out in the new starter pack.  This will cover their time at Leechpool until they leave.  If additional consent is required a separate form will be sent out to cover the consent for a particular event.  Due to the changes in Data Protection the school will be sending out new consent forms to cover all children in Years R to 5 for their remaining time at Leechpool.
 
Guidance on consent and withdrawal.
 
Anything requiring consent requires a positive opt-in.  If another organisation/third party is relying on the consent we will name them in the consent form.
 
Consent can be withdrawn at any time. We will require this in writing and given to the office.  You will receive a receipt of a withdrawal of consent and it will be acted upon within a reasonable period of time and no longer than one month from the date of receipt.
 
UPDATING AND REVIEWING
 
All policies and procedures will be reviewed and updated once a year.  The review date is set for April 2019.  This review will be carried out by the DPO and any changes agreed with the Headteacher and Governors.
 
Policies and procedures will also be reviewed if there are any changes to how data is managed at the school, Government guidelines  or following a breach of data security.
LEECHPOOL EVENTS AND FUNDRAISING
 
At Leechpool we are very lucky to hold events throughout the year to raise money for the school.  Leechpool Events and Fundraising [LEAF] is a "Friends of " charity that has been set up.  The committee of this group is set up of parents and staff of Leechpool.  Mrs Davenport, the Headteacher sits on this committee.  Mrs Hazel Wellcome, School Business Manager is the Treasurer and the Clerk to LEAF is Mrs Sandra Bailey.  Mrs Bailey is employed by the school and her time then charged to LEAF.  This means that she is under all of the same confidentially rules as any other staff member which enables her to have access to the schools computer.
 
LEAF hold very little data and anything held is kept at school or on the school computer system.  Mrs Bailey accesses the files remotely.  Data held includes:-
 
Class lists for discos - produced by school and shredded after the event
List of volunteers for events -  only name is keep on the sheet
List of external stall holders - list of email and contact details.  Consent will is required for this list
Raffle ticket stubs - all destroyed after event
Committee member details for the Charity Commission  - Consent is required for this.
 
All communication about events, request for help and advertising is via the school office.  This is sent via eschools in the same way as all school communication.  Consent is given for this communication when an email address is given to the school or eschool app is downloaded.  You can withdraw your consent at anytime if you do not wish to receive any information from LEAF.  If you wish to withdraw consent then please send a letter to the school office.
 
As LEAF is run by staff at the school, the data comes under the school policies / procedures such as data security, rights etc.  At no time is data shared with any non staff members of the committee except in the form of simple name lists which are then destroyed.  The Data Protection Officer for LEAF is Mrs Hazel Wellcome.  Please contact Mrs Wellcome if you have any questions about how LEAF use data.
 
For further information and to look at LEAF specific policies and procedure go to the LEAF webpage.