Processing of special categories of personal data

[Narwhal]

Hi All,

 

I am looking at a revising our Privacy Notice with regard to GDPR. We process various bits of special personal data namely biometric, health and ethnic. We ask for consent for the processing of the biometric data but simply ask for ethnicity, first language, religion and medical conditions on the data collection form. Under GDPR we will have to pick an Article 9 exemption but I am not sure which one would apply. Will it all have do be processed by explicit consent?

your views would be appreciated.

[rom1984]

I got a feeling you wouldn't do it under consent because if the school knew of a medical condition that the child had but the parent said they didn't want this to be recorded, I think the school would still record it anyway due to safe guarding concerns.

 

I'm thinking exemption 2(g) - processing is necessary for reasons of substantial public interest...

[rom1984]

I'm wondering now if you'd be best splitting them up. So data concerning health I'm sure would be in the public's interest. Then data concerning race, ethnicity, political opinion, religious or philosophical beliefs, biometric data and sexual orientation you would process under consent?

 

The school would need to be careful when using consent in cases when the parent withdrew consent. If this happened the school would need to stop processing that particular set of data. If the school were not prepared to do this, then they couldn't use consent.

 

This sounds like a reasonable approach to me but would be good to hear if there are some other views on this as I'm not 100% on this one.

[djrscally]

You're legally obliged to report Ethnicity etc on the census returns, so that's your basis for processing those. You don't have to report medical information but you have a legal duty of care to the children in your school, which you can only effectively fulfill if you collect information about their medical needs.

 

Tl;dr your legal basis is fulfilment of a legal obligation. Almost nothing a school does will require consent as a basis for processing.

 

Edit; almost missed the biometric stuff. That one might actually be one of the exceptions! I'm not sure myself there, as we don't use it so I haven't thought about it.

Edited March 13, 2018 by djrscally

[rom1984]

 

Tl;dr your legal basis is fulfilment of a legal obligation. Almost nothing a school does will require consent as a basis for processing.

.

 

That's what I first thought but a legal obligation is not one of the Article 9 exceptions for processing special category data so you couldn't use that as a bases for processing data relating to health, religion, ethnicity etc.

[djrscally]

That's what I first thought but a legal obligation is not one of the Article 9 exceptions for processing special category data so you couldn't use that as a bases for processing data relating to health, religion, ethnicity etc.

 

Oh sorry my bad, I thought I'd checked that but looked up the 'normal' personal data list!

 

I think we settled on relying on (g) substantial public interest for all the things you listed, again excepting biometrics which we don't collect.

 

EDIT: I wonder if the new Data Protection bill makes this a bit clearer, as reporting ethnicity and so on IS a legal obligation. I shall have a looksee...

Edited March 13, 2018 by djrscally

[rom1984]

Yeah I think your right public interest does make more sense!

 

Biometric = consent. All other special cat data = public interest as it allows the school to safe guard children, tailor the curriculum, identify potential vulnerable students, budget for additional support etc.

 

Using public interest also stops the argument that a public authority will find it difficult to use consent because of the imbalance in power between them and the data subject.

 

If a school does use consent for special category data, and the parent withdraws consent and the school respects this, I can't see it being too much of an issue. If you haven't yet decided though, I agree public interest makes sense to me.

[djrscally]

God I hate legalese.

 

It's coming back to me. The DP 2018 bill does actually make it clear. Basically Schedule 1 Part 2 of that bill lays out the conditions that the government thinks meet the substantial public interest test, and the second one is "processing is necessary in order to comply with a legal obligation" (paraphrased). Does kind of seem like a back-handed way of making legal obligation also apply to special categories, but that's what the bill says.

[Narwhal]

That's what I first thought but a legal obligation is not one of the Article 9 exceptions for processing special category data so you couldn't use that as a bases for processing data relating to health, religion, ethnicity etc.

 

That is my problem. I am ok with the Article 6 bits and I thought there would be an equivelent in article 9.

9(g) does seem to be the nearest thing if you scrunch up your eyes and don't look too closely!

[djrscally]

That is my problem. I am ok with the Article 6 bits and I thought there would be an equivelent in article 9.

9(g) does seem to be the nearest thing if you scrunch up your eyes and don't look too closely!

 

Naw, the DP2018 bill makes it crystal clear that that's the appropriate provision. If I was the EU I might have kicked up some stink about the UK implementation of that one, but I doubt that'll happen between May and March.

[enjay]

I'm wondering now if you'd be best splitting them up. So data concerning health I'm sure would be in the public's interest. Then data concerning race, ethnicity, political opinion, religious or philosophical beliefs, biometric data and sexual orientation you would process under consent?

 

Unless there is an incident of homophobic or racist bullying, when presumably we're processing the information relating to that as safeguarding/legal obligation... Sorry, just playing devil's advocate!

[rom1984]

Yeah your right, after the djrscally post I went back to the original opinion of processing all special category data under public interest for a school

 

I really wish the GDPR would have just included a line or two about educational establishments

[jenatddm]

Yeah your right, after the djrscally post I went back to the original opinion of processing all special category data under public interest for a school

 

I really wish the GDPR would have just included a line or two about educational establishments

<< Please write to your MP briefly and tell them that. We think you need guidance and that the ICO should provide it.

 

There is a proposed amendment to the DP Bill which would require the Information Commissioner to write a Statutory Code of Practice in consultation to give guidance how to apply GDPR in education. (Consultation would be open to everyone, schools, industry etc) It would not create any new rights, or obligations, just set out *how to apply GDPR in practice* and explain some of the more complex expected standards, in context for the education sector.

 

Why we believe it is needed is set out in detail here, including as s

imply, as Lord Jim Knight said in the House of Lords Second Reading, "Schools desperately need advice on GDPR compliance to allow them to comply with this Bill when it becomes law.”

 

Write to your MP (you can use this is easier https://www.writetothem.com/ ) Tell them who you are, why you are writing (in support of New Clause 16 to have a Statutory Code of Practice in the Data Protection Bill for schools), and why it matters to you. The sooner the better.

[jenatddm]

God I hate legalese.

 

It's coming back to me. The DP 2018 bill does actually make it clear. Basically Schedule 1 Part 2 of that bill lays out the conditions that the government thinks meet the substantial public interest test, and the second one is "processing is necessary in order to comply with a legal obligation" (paraphrased). Does kind of seem like a back-handed way of making legal obligation also apply to special categories, but that's what the bill says.

 

It doesn't change much compared with your existing legal basis today as per sensitive data, in so far as they need to meet tests of necessity and proportionality if collected under substantial public interest (not just 'want' or 'helpful to have') and does not effect fundamental rights or freedoms or cause distress.

 

Today, under existing law, and will also be under GDPR, ethnicity (and country of birth, and nationality, language) can only be consent based (you are obliged to ask for it to fulfil the legal duty via DfE regs, and 'refused' is possible answer, and must not be ascribed by school) [see Census guidance section 5.3]. Biometrics can only be consent based (as today, plus any parental/guardian objections must be respected, Protection of Freedoms Act 2012). Also today -- adopted from care [5.3.20], service child indicator optional [5.3.10] and collected only on a consent basis in census submission.

 

Same will be true of religion, and union membership (for staff).

[djrscally]

It doesn't change much compared with your existing legal basis today as per sensitive data, in so far as they need to meet tests of necessity and proportionality if collected under substantial public interest (not just 'want' or 'helpful to have') and does not effect fundamental rights or freedoms or cause distress.

 

Today, under existing law, and will also be under GDPR, ethnicity (and country of birth, and nationality, language) can only be consent based (you are obliged to ask for it to fulfil the legal duty via DfE regs, and 'refused' is possible answer, and must not be ascribed by school) [see Census guidance section 5.3]. Biometrics can only be consent based (as today, plus any parental/guardian objections must be respected, Protection of Freedoms Act 2012). Also today -- adopted from care [5.3.20], service child indicator optional [5.3.10] and collected only on a consent basis in census submission.

 

Same will be true of religion, and union membership (for staff).

 

To be clear; the processing is not consent based; it shouldn't be recorded as such in our data logs. Rather it's just that whatever a person gives as their ethnicity or whatever must be accepted, and they have the right to give "refused" as that value.

[jenatddm]

To be clear; the processing is not consent based; it shouldn't be recorded as such in our data logs. Rather it's just that whatever a person gives as their ethnicity or whatever must be accepted, and they have the right to give "refused" as that value.

 

This is where it gets interesting. Art 9 makes it prohibited to process these things, unless one of the Art 9(2) applies. None do, 2(j) is a higher bar and especially because there is no confidentiality applied on distribution from the DfE - they give it out as identifying data at pupil level, there can be little regard for siilar standards to professional secrecy, so it has to be consent based. I think schools will have to record it at consent based, also has therefore clear legal basis for retraction and removal at any time -- which is why things like ethnicity have a basis for refusal at all.

 

(And biometrics must be). We're in process of asking around, and will keep you posted.

[djrscally]

This is where it gets interesting. Art 9 makes it prohibited to process these things, unless one of the Art 9(2) applies. None do, 2(j) is a higher bar and especially because there is no confidentiality applied on distribution from the DfE - they give it out as identifying data at pupil level, there can be little regard for siilar standards to professional secrecy, so it has to be consent based. I think schools will have to record it at consent based, also has therefore clear legal basis for retraction and removal at any time -- which is why things like ethnicity have a basis for refusal at all.

 

(And biometrics must be). We're in process of asking around, and will keep you posted.

 

Well, see what you get back. I think that for the demographic data items (but not the biometrics) 9(2)(g) applies, and the DP2018 bill does seem to back that up.

[witch]

You're legally obliged to report Ethnicity etc on the census returns, so that's your basis for processing those..

 

Not sure this will fly. A school isnt doing a census and if you apply for a job that asks for your ethnicity they always allow you to "prefer not to say" so you are not legally obliged to state it.