What information does the school need to keep?

[Jimmer3568]

Apologies if this has been asked before.

Rumour has it that school, in our case a Secondary Academy, has a statutory duty to retain certain information for a number of years. Does anyone know what exactly need to be retained and for how long? If anyone could point me in the direction of some detailed information, and whether this is impacted by GDPR, I'd be very grateful.

[pete]

Try this as a starting point: IRMS Schools Toolkit - Information and Records Management Society (scroll down for the PDF).

[Priya_Shah]

Hi,

 

The following from ICO should point you in the right direction: https://ico.org.uk/for-organisations/education/

[Jimmer3568]

Thanks Pete and Priya for posting. Useful information on both sites. The IRMS document (p36 "Retention Schedules") comes close to answering the question, but as I'm not a IRMS member, I can't pursue this further with them.

 

Perhaps some background would be useful: I was at a GDPR training event, and it came over loud and clear that we shouldn't be hanging on to data that we no longer need. Fair enough. But other delegates were adamant (without going into detail) that there is a statutory requirement for school to hold on to some data. I'm trying to the bottom of this, but coming up against a haystack of information, when I only want the needle!

[GrumbleDook]

We have had this query email to us from someone outside of EG recently, as well as in discussions via LinkedIn.

 

The Pupil record (both paper and electronic) is meant to be handed over to a new school when the pupil transfers to that new school and the record is no longer needed, so a record needs to be deleted.

 

However ... if we take attendance, then this is retained for three years after the data of the entry made or an IEP which is kept for data of birth of the pupil plus 25 years.

 

Considerations also need to be taken into account where there may be litigation ... so records of injuries, bullying and other possible areas may need to be kept once the pupil has left.

 

It is not black and white but it has been this way for years and the principle of having and adhering to a retention schedule is enshrined within the upcoming changes.

 

I would strongly recommend that your school becomes IRMS membership, or is in contact with someone has is a member (within the LA, etc.)

[enjay]

Try this as a starting point: IRMS Schools Toolkit - Information and Records Management Society (scroll down for the PDF).

 

Exactly the document I was going to point them to, in particular p36 onwards. There is a highlighted copy of this on my desk and the HT's desk.

[enjay]

I was at a GDPR training event, and it came over loud and clear that we shouldn't be hanging on to data that we no longer need. Fair enough. But other delegates were adamant (without going into detail) that there is a statutory requirement for school to hold on to some data. I'm trying to the bottom of this, but coming up against a haystack of information, when I only want the needle!

 

Both are correct. Some data needs to be kept for a long time, other data should be destroyed when no longer needed (technology permitting, e.g. you can't currently delete from SIMS!).

[pete]

(technology permitting, e.g. you can't currently delete from SIMS!).

 

You can (Routines > Student > Delete Student), but only one at a time while referring to a "leaver, now older than 25yrs" report and each time it resets the search results and orders them alphabetically (when ideally you want by admission number).

 

Which probably means our admin staff will be hunting @PhilNeal with pitchforks, as there's been CR* open for years about improving this functionality.

 

*1402-1279373 and 1611-3557429, for example.

[enjay]

You can (Routines > Student > Delete Student), but only one at a time while referring to a "leaver, now older than 25yrs" report and each time it resets the search results and orders them alphabetically (when ideally you want by admission number)

Yes, but that process deletes the entire record, so as you say can only be done a large number of years after the student leaves. What DPA and GDPR dictate is we only keep data as long as necessary, which means we should delete attendance data fairly soon after a student leaves but not their safeguarding data until a lot later. There's no provision within SIMS for that selective deletion.

[PhilNeal]

I'm fairly certain that the team is working on making deletions easier to achieve. We have been talking to ICO and it is not at all certain that pupil records need to be deleted. Schools have a responsibility to supply references, provide evidence of attendance, connections that a child may have had with supervisors etc.

 

Harrow Boys for example would have to delete loads of paper records and destroy historical evidence - if this interpretation of GDPR persisted!

[pete]

I'm fairly certain that the team is working on making deletions easier to achieve.

 

That's good to hear.

 

We have been talking to ICO and it is not at all certain that pupil records need to be deleted. Schools have a responsibility to supply references, provide evidence of attendance, connections that a child may have had with supervisors etc.

 

Lots of school retention falls under "just in case" or "can't be bothered to have a clearout", rather than the "can actually point to a legal need to retain this data".

 

While some may find it helpful to have a last-ditch "was quite good at football" reference from an old headteacher, that doesn't justify the school keeping information on thousands of people long past them having an operational need to do so. Retention for 7 years after the date of leaving should cover all but the most unlikely requests.

 

Harrow Boys for example would have to delete loads of paper records and destroy historical evidence - if this interpretation of GDPR persisted!

 

GDPR covers living identifiable people, not the dead - see Recital 27. Member states can add specific language about it if they wish*, but there's nothing there by default.

 

*https://www.twobirds.com/en/hot-topics/general-data-protection-regulation/gdpr-tracker/deceased-persons

[PhilNeal]

History is of course in the making!

 

I agree that some stuff would be just in case but there is no requirement for complete deletion of pupil records.

[GrumbleDook]

History is of course in the making!

 

I agree that some stuff would be just in case but there is no requirement for complete deletion of pupil records.

 

The problem is the word ‘complete’.

 

We’ll get there though ... it is slowly coming out.