Lists of pupil names on the wall

[GREED]

I don't think it is. If we played an after-school match with another school and members of the public turned up to watch, I think we'd send them away. That said, if they were parents of students in the opposing school, we'd probably allow it, at which point it has become sort-of-public, as we don't know who they are and (possible but unlikely) whether there is a court order in force with regards to one of our students.

 

It is questions like that which make me glad I'm not the DPO!

 

Indeed - and is worth following this though as a conversation.

 

My definition of public in this case is someone who you are not in direct control of knows the information and could mention or make it more publicly available - as opposed to you know and professionally need to keep it confidential...

[enjay]

My definition of public in this case is someone who you are not in direct control of knows the information and could mention or make it more publicly available - as opposed to you know and professionally need to keep it confidential...

 

Obviously we don't have a professional responsibility to keep the specific scoreline confidential, so at this point I think match reports come under the same category as any other press reports about activities within the school - do we have the right to name students who are in the school? Guidance up until now has been we can name them but don't specifically identify them, e.g. post a photo of the winners and names, but don't write "pictured from left to right are:".

 

It is probably one of those grey areas we've never really considered properly before. I suspect some suitable wording could be written into the parental agreement and consent form which permits us to share exam results, sports results, name participants in a music or drama event as part of marketing the school. Parents would of course be free not to grant that consent.

[GREED]

Fun conversation.

 

So what would happen when parent doesn't want this, their kid scores the winning goal, what do you put on the score sheet like you publish for all the other events/sports teams/games etc?

 

Smith (4 mins)

Jones (51 mins)

Redacted (90 mins)

[andyturpie]

Here is another teaser, after May you get a right to be forgotten request. You duly process it, but you need to hold a copy of the request from the individual (possibly signed) for auditing purposes. If we hold only a single piece of paper to prove that the request was made and carried out, then the person still hasn't been forgotten???

[GREED]

Here is another teaser, after May you get a right to be forgotten request. You duly process it, but you need to hold a copy of the request from the individual (possibly signed) for auditing purposes. If we hold only a single piece of paper to prove that the request was made and carried out, then the person still hasn't been forgotten???

 

We are all over this currently! Was discussing in the office today.

 

You need to keep a record of Subject Access Requests and RTBFs, and the details of when/who requested. This is a requirement that sits above the subjects rights, and so you can legitimately keep a record of that because contractually you have to. I would guess though that this would a) fall into data retention territory (how long do you keep that for - and longer than original data retention requires on the original data you have deleted?) and b) not be required when you delete data due to retention rules - as opposed to RTBF.

[pete]

@jmak

 

I'd say the cleaner does need to know of people who shouldn't be on school premises. They don't necessarily need to know the context, but for things like after-school clubs and fixtures, the cleaner is likely to be around and should know how to handle it/escalate it.

 

@elsiegee40

 

We did the same data protection briefing with our cleaners that we did with everyone else. They're the last line of defence in the "wait, this shouldn't be in a paper recycling bin" campaign and are pretty good at bringing problems to our attention. They do work for the school rather than a subcontractor.

 

What about when the room is occupied by visitors? Our Heads of Year routinely have parent meetings in their offices.

 

HOY offices are shared (lower school and upper school offices) so for reasons of confidentiality and not annoying co-workers, meetings with external parties are held in one of our meeting rooms which just have Y12/13 artwork on the walls.

[Narwhal]

Whilst looking at what ICO has to say about Data Protection I came across this document. I do struggle to understand how publishing names and exam results doesn't contravene the current DPA.

 

 

[GREED]

Whilst looking at what ICO has to say about Data Protection I came across this document. I do struggle to understand how publishing names and exam results doesn't contravene the current DPA.

 

 

 

Nice find.

 

One of the changes with GDPR is active consent with personal data - and so with this being for the old DPA my interpretation is this is no longer true with GDPR.

 

Sounds like one for Mr @GrumbleDook to take to DfE or the ICO

[GrumbleDook]

Fun conversation.

 

So what would happen when parent doesn't want this, their kid scores the winning goal, what do you put on the score sheet like you publish for all the other events/sports teams/games etc?

 

Smith (4 mins)

Jones (51 mins)

Redacted (90 mins)

 

Am I the only one who has considered changing the name of their child to a bit of VBA so when it gets typed up it does something amusing?

[GrumbleDook]

We are all over this currently! Was discussing in the office today.

 

You need to keep a record of Subject Access Requests and RTBFs, and the details of when/who requested. This is a requirement that sits above the subjects rights, and so you can legitimately keep a record of that because contractually you have to. I would guess though that this would a) fall into data retention territory (how long do you keep that for - and longer than original data retention requires on the original data you have deleted?) and b) not be required when you delete data due to retention rules - as opposed to RTBF.

 

Just in case anyone asks ... this is because the personal data you now hold is for compliance with legal obligations ... so you are processing it under a different lawful basis. You should inform people that you will be retaining that personal data as a result ... it makes for some interesting circular arguments ...

[GREED]

Am I the only one who has considered changing the name of their child to a bit of VBA so when it gets typed up it does something amusing?

[ATTACH=CONFIG]47769[/ATTACH]

 

Have you discussed this with the wife yet?

[GrumbleDook]

Whilst looking at what ICO has to say about Data Protection I came across this document. I do struggle to understand how publishing names and exam results doesn't contravene the current DPA.

 

 

 

Yes, the guidance appears to say that you do not need consent to publish. I've asked ICO and so far they can't explain the lawful basis for processing that would cover the advice in the existing guidance.

"we are planning to develop more detailed guidance on this topic".

 

Consent, at the moment, is the fall back, but will keep asking.

[Disease]

What about school photos and how that affects the Right to be Forgotten? If we have trip photos posted on walls and someone exercises their RTBF, do we need to delete/edit all photos containing their image?

[enjay]

Here is another teaser, after May you get a right to be forgotten request. You duly process it, but you need to hold a copy of the request from the individual (possibly signed) for auditing purposes. If we hold only a single piece of paper to prove that the request was made and carried out, then the person still hasn't been forgotten???

 

I think I've resolved that one in my mind. You don't have to carry out a right to erasure if you still have ground to process their details - you can't delete a student until their 25th birthday, even if they ask to be forgotten, because you have a legal duty to retain that information. So, keeping someone's name as evidence you've fulfilled your legal obligation to delete them from everywhere else is okay too. I think!