GDPR - Privacy Notices advice please

[gh5000]

Just reading through our template privacy notices provided by the schools legal team. There is a section that reads:

We will also disclose your personal data to:

 

[sTATE ANY FURTHER THIRD PARTY DISCLOSURES HERE]

[NON – EXHAUSTIVE LIST OF THINGS TO LOOK AT]

Seek further advice if there is a concern over lawfulness.

 

Your new school if you move schools

Disclosures connected with SEN support – e.g. non-LA professionals [explain what these are]

School nurse

School Counsellor

CAMHS (Child and Adolescent Mental Health Service)

 

The information disclosed to these people / services will include sensitive personal information about you. Usually this means information about your health and any special educational needs or disabilities which you have. We do this because these people need the information so that they can support you.

 

This is the place that I can see you would list other data processors eg Google, Parentpay, GCSEPod - correct?

 

If you then decide to start using Office 365 (for example) do you have to reissue this document to everyone.

 

Been reading through GDPR stuff all weekend and feel like I've got myself mixed up somewhere. There is a requirement to tell staff/students etc every 3rd party that the data goes to right? And what pieces of data each one receives (eg GCSEPod gets name and email address/Parentpay gets name, email, contact number)?

 

And last one that I just wanted to check - is us deciding to use Google/GCSEPod (as examples) and saying it is necessary for us to provide an education legitimate therefore we aren't required to get consent. Or is the counterargument that the school could quite capably provide an education without needing to use Google/GCSEPod, therefore consent is required.

 

Thanks

[rom1984]

 

This is the place that I can see you would list other data processors eg Google, Parentpay, GCSEPod - correct?

 

Thanks

 

Yep that's right

 

 

 

If you then decide to start using Office 365 (for example) do you have to reissue this document to everyone.

 

Been reading through GDPR stuff all weekend and feel like I've got myself mixed up somewhere. There is a requirement to tell staff/students etc every 3rd party that the data goes to right? And what pieces of data each one receives (eg GCSEPod gets name and email address/Parentpay gets name, email, contact number)?

 

Thanks

 

You wouldn't need to reissue the whole document but it would be best practise to tell parents/students that you now use a new system (i.e Office 365), this is what we use it for and this is what data we collect.

 

The requirement is more about transparency, so yeah you should tell staff/students/parents etc about any personal data that you pass to a third party so they are aware.

 

 

And last one that I just wanted to check - is us deciding to use Google/GCSEPod (as examples) and saying it is necessary for us to provide an education legitimate therefore we aren't required to get consent. Or is the counterargument that the school could quite capably provide an education without needing to use Google/GCSEPod, therefore consent is required.

 

Thanks

 

You can still use legitimate interest in this case, as long as the school has a legitamte interest to do so that balances what the school wants to achieve against the personal rights of the individual. One test to apply to see if consent is more applicable is to ask yourself if the student/parent says they don't want their students personal data processed via Google, would you still do it. If the answer is yes, then you couldn't use consent and would need to use another lawful bases, for example legitimate interest.

Edited March 5, 2018 by rom1984

[Meldrew]

Taking advice from the training day that GroupCall provided, it's acceptable to provide a URL to a page on your website where you list the data processors. That way if it does change, you just update the webpage.

 

Regarding the last point, you have the right to share the data under the public interest umbrella. Its up to you who you (the school) to decide what's necessary to educate your students. All you would need to be aware of is ensuring that any 3rd party processor is someone that a parent would consider that would help educating students, so GCSEPod, yes, but random company nothing to do with education, no. Essentially, you need to be able to justify it.

 

Meldrew.