GDPR Responsibility in your school

[enjay]

I keep thinking about this periodically and the point I get stuck at is: Why would anyone who's not involved in either the procurement or management of data systems have acquired the level of knowledge required to carry out this role?

 

Or indeed be at a level of seniority which means they'd feel comfortable calling out the HT or SBM on something they're doing wrong?

[sparkeh]

I keep thinking about this periodically and the point I get stuck at is: Why would anyone who's not involved in either the procurement or management of data systems have acquired the level of knowledge required to carry out this role?

Or indeed be at a level of seniority which means they'd feel comfortable calling out the HT or SBM on something they're doing wrong?

Indeed, which is why I am of the firm opinion that even though 'it can be someone in school', effectively, it can't be.

[elsiegee40]

Indeed, which is why I am of the firm opinion that even though 'it can be someone in school', effectively, it can't be.

 

This where those schools in a MAT are at an advantage. Someone appointed at Trust level

[GrumbleDook]

In the army we had a saying ... “I’m sorry sir/ma’am, you seem to be confusing your tank with my authority!”

 

Sadly, we know that this approach would be a struggle in schools so it does need to have a certain amount of ‘weight’ to them.

 

This is why we are looking at Governors or even doing a school swap between linked schools.

 

We are investing questions around Operation v strategy as well as liabilities for Governors, and also querying how a DH in school A can be DPO for school B and vice versa ... without them thinking too operationally.

[enjay]

Indeed, which is why I am of the firm opinion that even though 'it can be someone in school', effectively, it can't be.

 

Ah but, for what we can afford we could probably only get a few hours a month, and isn't there something about the DPO also having sufficient time to actually do the job?!

[elsiegee40]

In the army we had a saying ... “I’m sorry sir/ma’am, you seem to be confusing your tank with my authority!”

 

Sadly, we know that this approach would be a struggle in schools so it does need to have a certain amount of ‘weight’ to them.

 

This is why we are looking at Governors or even doing a school swap between linked schools.

 

We are investing questions around Operation v strategy as well as liabilities for Governors, and also querying how a DH in school A can be DPO for school B and vice versa ... without them thinking too operationally.

 

Well as a governor, I'll be saying no way and I'll make sure the rest do too.

 

How many governors have the free time to spend doing the audit requirements, etc! Never mind anything else. I have no intention of spending any more time on the school and MAT than I already do (and I can assure you that my time spent is not inconsiderable already)

 

And then there's the small question of the size of the fines for getting it wrong. I am not paid to be a governor. If I was paid then I'd be an employee and I couldn't be a governor.

[GrumbleDook]

Yep, and this is why we are asking about liabilities as the DPO is not liable, that is shared between the data controller and data processor.

[elsiegee40]

Yep, and this is why we are asking about liabilities as the DPO is not liable, that is shared between the data controller and data processor.

 

How much time do you think this role will take at an 'average' school @GrumbleDook. How many hours per week?

 

A couple of hours a month? In which case schools could probably afford it anyway. And that would be manageable by a governor. My feeling is that this a much bigger role.

 

Being available to take over in case of a breach and get everything reported? When you're actually probably employed by somebody else and have other priorities?

 

Governors already go above and beyond. At a conservative estimate, including panels, Ofsted, meetings and three link visits... and excluding paperwork at home... I already do over 100 hours a year. I am not unusual. It's why it is so difficult to get governors.

[GrumbleDook]

How much time do you think this role will take at an 'average' school @GrumbleDook. How many hours per week?

 

A couple of hours a month? In which case schools could probably afford it anyway. And that would be manageable by a governor. My feeling is that this a much bigger role.

 

Being available to take over in case of a breach and get everything reported? When you're actually probably employed by somebody else and have other priorities?

 

Governors already go above and beyond. At a conservative estimate, including panels, Ofsted, meetings and three link visits... and excluding paperwork at home... I already do over 100 hours a year. I am not unusual. It's why it is so difficult to get governors.

 

And the operational side is the other question I’ve raised with Governance groups.

[maturelady]

I agree a deputy head can be DPO provided he/she is not a direct decision maker for systems that process personal data.

 

Likewise a school governor or any other senior member of staff.

 

Please add to my request for things to ask the DfE - I need as many cries for help as possible. If I get only a few they may just say 'schools don't seem to need help - not many are asking'

 

http://www.edugeek.net/forums/data-protection-information-handling/188681-lets-get-our-voice-heard-dfe.html

[elsiegee40]

I agree a deputy head can be DPO provided he/she is not a direct decision maker for systems that process personal data.

 

Likewise a school governor or any other senior member of staff.

Governors are NOT staff. They're not allowed to be staff @maturelady. They are volunteers who fit their duties around employment and real life elsewhere. Sorry to be a broken record on this, but I do feel that the role and legal obligations of the governing board is widely misunderstood.

[FN-GM]

Governors are NOT staff. They're not allowed to be staff

 

I know a number of schools that have governors who are also members of staff.

[elsiegee40]

I know a number of schools that have governors who are also members of staff.

 

Staff governors are different. They're elected and there are restrictions on the duties they are allowed to undertake.

 

For the purposes of GDPR, we'd be talking about the Parent and Appointed governors

[DavR]

Well, it ain't gonna be me, that's the main thing! *jumps in air clicks heels*

 

Sorry, that's not overly helpful is it. I'm just very glad I found this discussion as I'm in a GDPR meeting next week and this question is bound to come up. Thank you @enjay for the helpful document.

 

Re DHs, I'm pretty sure all of our SLT have some input or decision making about what data is processed and how, so that would rule them out. Given that governors also can be said to have decision making rights over data processing, wouldn't that rule them out too? If we were to change MIS or have a massive IT investment, it would have to be approved by governors.

 

It's a minefield isn't it - the best option would probably be shared DPOs from Local Authorities, as a buy in service. But the last thing any LA wants right now is to find the money for more staff.

[enjay]

I raised my concerns about our DH's potential conflict of interest with the HT yesterday. HT thinks it is fine because she makes all decisions; we just make recommendations to her, sometimes very strong recommendations, but ultimately the decision is hers. This makes her sound massively controlling and dictatorial - she really isn't! Her point is more that the buck stops with her. Thoughts?

 

She also made the very valid point that if DH can't do it, no-one in the school can. That only leaves an external company, and how could they truly know what's going on around the school?

 

Of course, if the DfE would break their vow of silence on GDPR, we'd all know the answer to this!

[jenatddm]

Remember it is expected that the DPO reports to the highest management level of your organisation. It requires that they should have professional experience and expert knowledge of data protection law. This should be proportionate to the type of processing your organisation carries out, taking into consideration the level of protection the personal data requires. Adequate resources must be provided to enable DPOs to meet their GDPR obligations.

 

The DPO’s minimum tasks are defined in Article 39:

 

 

• To inform and advise the organisation and its employees about their obligations to comply with the GDPR and other data protection laws.
  
• To monitor compliance with the GDPR and other data protection laws, including managing internal data protection activities, advise on data protection impact assessments; train staff and conduct internal audits.
  
• To be the first point of contact for supervisory authorities and for individuals whose data is processed (employees, customers etc).
  

 

Reference WP 29 Guidance on DPOs and the ICO guidance on DPO and governance.

[Steve21]

I That only leaves an external company, and how could they truly know what's going on around the school?

 

Of course, if the DfE would break their vow of silence on GDPR, we'd all know the answer to this!

 

Well based on what I've seen it says DPOs etc are expected to be involved in the SLT meetings that are linked to the data etc, basically think of it like a governor kind of role, won't be st every meeting but basically crap can't happen without it going through them sometime

 

But as you said hopefully we'll actually get some clarification!

 

Steve

[pcstru]

I raised my concerns about our DH's potential conflict of interest with the HT yesterday. HT thinks it is fine because she makes all decisions; we just make recommendations to her, sometimes very strong recommendations, but ultimately the decision is hers. This makes her sound massively controlling and dictatorial - she really isn't! Her point is more that the buck stops with her. Thoughts?

It is true to some (quite a large) extent, but I'd ask her if that what is what peoples job descriptions say. Does the JD's for the DH capture the delegation of responsibility and accountability for functions which would be a conflict of interest? If they do, can she really expect someone to make recommendations to her that are clear of conflict. It has to make her job difficult if she is always having to assure herself that the DH is championing the correct action or not presenting a fair picture by omission of fact because of that conflict.

 

She also made the very valid point that if DH can't do it, no-one in the school can. That only leaves an external company, and how could they truly know what's going on around the school?

IMO a DH could do it, but they should not also have responsibility/accountability for data processing. However, in a small school that might be difficult. Even in a large school, it might be difficult to disentangle all sources of conflict. Sometimes, pragmatism it is going to dictate that it has to be a case of what is least worst.

[jmak]

Our LA (Cambridgeshire) is offering a service to contract out the DPO role 😀

 

Not sure how much it'll cost though.....

[smurfomatic]

We're looking at getting a governor to fulfill this role, however as we are an independent school all of our governors are also trustees of the charity. Would this be considered a conflict of interest on being a DPO?

[DavR]

I think the conflict of interest comes not from your position or stake in the organisation as such, but more if you have any input into decision making re data and the systems that data resides on.

 

My argument against your governors holding the role would more be that surely they sign off on certain decisions about data and it's processing. Just out of a meeting with our governors where the workload, complexity and availability needs of the DPO role was cited as being beyond the call of duty.

 

We're looking at LA or third party as our ideal, just looking at our options. We've recently done the safe with H&S responsible person, so it's perhaps not unreasonable.

[jmak]

We're looking at getting a governor to fulfill this role, however as we are an independent school all of our governors are also trustees of the charity. Would this be considered a conflict of interest on being a DPO?

They need to have the appropriate level of expertise and be able to hold the leadership team to account.

 

I wouldn't have thought they'd be in a position to make operational decisions on how you process data or what you use it for. I'd expect governors to view data and analyse it, but my understanding is that wouldn't be a conflict of interest.

 

Whether they could effectively hold staff to account is questionable. I know that challenging the school is part of the governor's role, but this is potentially more operational and I'd guess more likely to lead to a conversation along the lines of "no head teacher, you can't do that - you must do this"

 

Unless they have a related role outside of their governor duties, they'd probably need training.

[smurfomatic]

They need to have the appropriate level of expertise and be able to hold the leadership team to account.

 

I wouldn't have thought they'd be in a position to make operational decisions on how you process data or what you use it for. I'd expect governors to view data and analyse it, but my understanding is that wouldn't be a conflict of interest.

 

Whether they could effectively hold staff to account is questionable. I know that challenging the school is part of the governor's role, but this is potentially more operational and I'd guess more likely to lead to a conversation along the lines of "no head teacher, you can't do that - you must do this"

 

Unless they have a related role outside of their governor duties, they'd probably need training.

 

Thanks jmak. A couple of our governors have a legal background so hopefully one of those will be interested and available to take on the role. Even then they'll need specific GDPR training anyway, just like the rest of us!

[GrumbleDook]

I’m waiting for my school to ask me to take it on ... I have a business conflict for some reason though ... can’t think what.

[nicholab]

How can the law have created such a ridiculous roll that no one on the SLT had actually do unless they have some weird SLT setup? Also how many company have someone that can hold the leadership to account but don't have active control over this stuff.