GDPR - Managing consents

[DrCheese]

Also, I'd say any photos collected for educational reasons such as GCSE Coursework Evidence don't come down to consent - that legal basis is probably public interest.

Yes already have that done as ok for us - I'm also using public interest/legitament interests to take photos for safeguarding (i.e to go in SIMS) only issue is at the moment a lot of systems pull that out (Our VLE/Office365 via salamander) so wasn't sure how we stood on that.

[ht6]

Yes already have that done as ok for us - I'm also using public interest/legitament interests to take photos for safeguarding (i.e to go in SIMS) only issue is at the moment a lot of systems pull that out (Our VLE/Office365 via salamander) so wasn't sure how we stood on that.

 

Hmmm I'd be tempted to go down the consent route for that - you don't need that photo information sending out to third parties for you to do a job (give kids an education). I think your safeguarding reasoning checks out, but when it leaves SIMS it's a different use of that data then.

[DrCheese]

hmm ok - But if parents have already given us consent to take photos would that count? (if we assume as above that parental consent counts past the age of 13 but allowing then for students to opt out if they choose)

[ht6]

Yes, I would say the consent stands so long as it was sought inline with the new requirements. I'm by no means a legal expert, but I would say I have a fair understanding of the new requirements. Us, however, used to seek photo consent as an opt-out and so are having to readdress our procedures to comply with new requirements. Just be transparent about it all, send a letter home explaining the new rules, how you are dealing with them, what it means, and where parents/students can find further information should they require.

[ITGuyWestMidlands]

Do we need to obtain consent to register a student on a third party website such as MyMaths?

[ht6]

Do we need to obtain consent to register a student on a third party website such as MyMaths?

 

Again, not a self proclaimed expert, but I'd say it's a public interest legal basis since you need those tools to deliver your teaching and learning, and if students revoked consent it would cause mayhem and would make you unable to carry out your business obligations. However, MyMaths is a data processor and therefore you need to ensure the correct contracts are in place and they themselves comply with the requirements of GDPR.

[enjay]

Yes already have that done as ok for us - I'm also using public interest/legitament interests to take photos for safeguarding (i.e to go in SIMS) only issue is at the moment a lot of systems pull that out (Our VLE/Office365 via salamander) so wasn't sure how we stood on that.

 

Ask yourself why you're doing it. Photos in SIMS for safeguarding is clear. If you can justify the legal grounds why the photo has been sent to Office365/Show My Homework/%EdTechSite%, then that's fine; if you can't provide those legal grounds, you have two options: consent (fiddly) or remove them from %EdTechSite%.

 

- - - Updated - - -

 

Again, not a self proclaimed expert, but I'd say it's a public interest legal basis since you need those tools to deliver your teaching and learning, and if students revoked consent it would cause mayhem and would make you unable to carry out your business obligations. However, MyMaths is a data processor and therefore you need to ensure the correct contracts are in place and they themselves comply with the requirements of GDPR.

 

I agree, except I thought "legal obligation" was the more appropriate...

[ht6]

I understand legal obligation as in "the DfE tell us we must do this". However, they don't tell you that O365 (et al) is mandatory, so you're using those services in the public interest, as in carrying out your duties of educating children in the public interest.

[enjay]

I understand legal obligation as in "the DfE tell us we must do this". However, they don't tell you that O365 (et al) is mandatory, so you're using those services in the public interest, as in carrying out your duties of educating children in the public interest.

 

No, they don't tell us we are legally required to use Office365, but we are legally required to provide for their education, and Office365 is our tool of choice for that. Quoting the ICO, "Article 6(3) requires that the legal obligation must be laid down in UK or EU law ... This does not mean that there must be a legal obligation specifically requiring the specific processing activity. The point is that your overall purpose must be to comply with a legal obligation". Source: https://ico.org.uk/media/for-organisations/guide-to-the-general-data-protection-regulation-gdpr-1-0.pdf page 28.

 

That said, that same document defines public interest as processing "necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller" which is probably closer to what we're doing in education.

[mjk]

I'm in the legal obligation camp. The school must educate the children and it chooses to use certain tools to do so.

You don't need consent to use educational tools. Things like Biometric are different. CCTV is more public interest.

Edited March 8, 2018 by mjk

[Narwhal]

I'm in the public interest camp. you must teach the children maths but you don't have to use MyMaths to do it. Either way you don't need their consent.

[enjay]

The more I think about this, the more I come down on public interest - even though it was me who said legal obligation earlier!

[ht6]

You'll not be the first to sway opinion after consideration in relation to GDPR. Give me 2 weeks and I'll be back in the legal obligation camp again.

[rom1984]

I'm in the legitimate interest camp rather than consent or public interest lol. It's in the public interest that you teach maths, but its in the schools legitimate interest to be able to teach it how they see fit (i.e via mymaths)

[DrCheese]

& this is why people are struggling so much with it all - The laws kinda just been dumped out there and left up to individual places to interpret it. I suspect it won't be until places are taken to court that prescidents will be set that places will adjust their policies to reflect.

[GrumbleDook]

& this is why people are struggling so much with it all - The laws kinda just been dumped out there and left up to individual places to interpret it. I suspect it won't be until places are taken to court that prescidents will be set that places will adjust their policies to reflect.

 

It is and it isn’t ... over time more discussion and advice *will* come out ... and as people from different sectors discuss application and based on WP29 guidance too, things will be clearer.

 

At the moment, it is clear that any item that is statutory or is affected by secondary legislation would be covered as Compliance with Legal Obligation. Delivery of the curriculum (either the NC or that chosen and set by the school) would be Public Interest (as it is a core activity of the public authority) and the method of delivery is part of this. The choice of tools should be those most likely to allow the schools to deliver the curriculum to the highest quality, but the delivery is the action, the tool is simply the method.

 

When consent is used, it needs to be clear what it is being given for, that the data will only be used for the purpose under which the consent is granted and only for the duration set out.

 

We also need to remember that the lawful basis for processing is not a hierarchical list ... with consent as the last chance on the list ... you choose the most appropriate basis for processing ... people want to avoid processing under consent because it can be difficult to manage, has less options on exemptions to data rights and so on.

 

This is why people are starting to look at consent monitoring tools more ... to make life easy and manageable ... and I would rather see it become a bit more of a chore for schools than schools try to avoid consent as a reason and wrongly use a different basis to try to make their life easier.

[rom1984]

I've got some clarification from my colleague who is working on the draft GDPR guidance for children.

 

She was off the view that if the person with parental responsibility gave consent (when consent is the legal bases) this would be relevant and generally last the duration of the child's school life

 

However if the child expressed any of their rights under the GDPR, for example the right to erasure, and the child was compentent, then the school should adhere to the request (providing it is a valid request of course)

 

There is no guidance on what age a child would be competent so this would be for the school to decide.

 

This is still draft guidance at the moment.

 

ps I'm back i the public interest camp after the last post! Think I was over thinking it

[gh5000]

I'm in the legitimate interest camp rather than consent or public interest lol. It's in the public interest that you teach maths, but its in the schools legitimate interest to be able to teach it how they see fit (i.e via mymaths)

I was on @GrumbleDook 's site earlier and if I'm reading it correctly legitimate interest can't be used by a state school

https://www.gdpr.school/how-concerned-should-schools-be-about-consent/

 

I'm in the legitimate interest camp rather than consent or public interest lol. It's in the public interest that you teach maths, but its in the schools legitimate interest to be able to teach it how they see fit (i.e via mymaths)

I was on @GrumbleDook 's site earlier and if I'm reading it correctly legitimate interest can't be used by a state school

[gh5000]

^^^ replying on phone went a little crazy - apologies

[GrumbleDook]

To some extent, mea culpa. @rom1984 and I have been having a number of parallel conversations and this has fallen out into the thread ...

 

We had been looking at independent schools and the application of the public interest test (recent amendment on DP bill refers to independent schools in NI so doing a bit of thinking on “what if” and extrapolating) and we hadn’t realised the conversation had bled into the thread ... apologies on that.

 

Yes, you are right that Legitimate Interests cannot be used to cover core activities of a Public Authority.

[gh5000]

Cool, it's just that you can't trust everything you read on some flashy website that says it will solve all your problems.

[steve_forbes]

To some extent, mea culpa. @rom1984 and I have been having a number of parallel conversations and this has fallen out into the thread ...

 

We had been looking at independent schools and the application of the public interest test (recent amendment on DP bill refers to independent schools in NI so doing a bit of thinking on “what if” and extrapolating) and we hadn’t realised the conversation had bled into the thread ... apologies on that.

 

Yes, you are right that Legitimate Interests cannot be used to cover core activities of a Public Authority.

 

 

I think is quite commonly misunderstood, as @GrumbleDook says, it can't be used to cover the core activities of a Public Authority, but that's not to say it can't be used at all.

The ICO have a good example on their website of a University that would be the same for schools: https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/

 

"There is no absolute ban on public authorities using consent or legitimate interests as their lawful basis, but the GDPR does restrict public authorities’ use of these two bases."

 

Completely agree on the use of public interest for those things discussed, without absolute clarity it is down for each school to decide which lawful basis they are processing data under and as long as there is sound reasoning, it is transparent and fair then it is unlikely anyone is going to object to that processing for those reasons.

[GrumbleDook]

Thanks @steve_forbes.

 

Just to clarify to others about the restrictions ... for Legitimate Interests it cannot be used for core activities ... which is extremely restrictive and every attempt I’ve tried with ICO on listing possible non-cite activities ends up with it being the school’s decision or speak to the DfE (which we are).

 

For consent, it is about the clear, unambiguous consent for a given purpose for a set time by the relevant, competent person and/or their guardian (heavily paraphrased) ... and that is what we have been talking about.

[tj2419]

Is anyone using Google Forms to collect the initial consent?

 

We are looking at the SIMS Lite parent app but think we will get more uptake of initial consent if they don't have to create a login etc

 

Was just going to provide a google form asking for their name, student name, reg group, tick this box for consent etc

[jmak]

Is anyone using Google Forms to collect the initial consent?

 

We are looking at the SIMS Lite parent app but think we will get more uptake of initial consent if they don't have to create a login etc

 

Was just going to provide a google form asking for their name, student name, reg group, tick this box for consent etc

Got an invite to "sign up" for SIMS parent app from my kids' school yesterday. If you had an existing SIMS ID you could log in with that. Otherwise it offered sign in with MS, Google, Facebook or Twitter. Realistically most parents who are using the internet at all will have at least one of those. I was impressed with how smoothly it went and I presume it will make it more straightforward for the school to get the data into SIMS.