Privacy Notices - resend in May?

[Love_Sausage]

Any thoughts on whether we need to send out new Privacy notices in May or before, or can we wait until the new intake and do it in September?

[Love_Sausage]

So this is something either everyone already knows or nobody knows..

[MYK-IT]

I personally don't know, although we have GDPRiS on-site this afternoon for a GDPR Staff Awareness meeting, so I will add this to my list of many questions!

[Meldrew]

My opinion is that current privacy notices are invalid on May 25th, so new ones will need to be distributed before then. We'll see if GDPRiS agree...

 

Meldrew

[enjay]

Doesn't putting the new one on the website (perhaps accompanied by a parent mail saying about it) count as distributing it?

[CC359]

Planning to publish/distribute all updated policies and notices on 25th of May over here. Just makes it simpler to publicly prove that we are aware of law changes and have acted accordingly to ensure compliance, regardless of how harshly or softly people view the deadline.

[Love_Sausage]

I personally don't know, although we have GDPRiS on-site this afternoon for a GDPR Staff Awareness meeting, so I will add this to my list of many questions!

 

@MYK-IT did you get a chance to ask?

[MYK-IT]

@MYK-IT did you get a chance to ask?

 

Hi, apologies... I didn't get the opportunity to ask as our meeting was a bit 'trivialised', as not to scare any one I think!

 

Having said all that... going by the umpteen emails from SLT that followed immediately afterwards, in relation to policies and IT etc. I can safely say that (for our school at least) we 'are' implementing everything we possibly can in relation to GDPR in readiness for 25th May 2018.

 

Not sure if that helps you.

[rom1984]

Doesn't putting the new one on the website (perhaps accompanied by a parent mail saying about it) count as distributing it?

 

I think it does. The GDPR recital describe transparency as the requirement that any information and communication relating to the processing of personal data can be easily accessible and easy to understand, and that clear and plain language be used. If its on your website and you've sent out a parent mail about it I think you've ticked the transparency box and have been transparent in publishing your new privacy notice.

[jenatddm]

Any thoughts on whether we need to send out new Privacy notices in May or before, or can we wait until the new intake and do it in September?

 

You must bring any new uses of an individual’s personal data to their attention before you start the processing. (current law as well as GDPR) I suspect your new intake data collection happens long before September - more likely May or June start as well, no? To get started, do you know what needs to be in the privacy notice and how many you need? i.e make sure all your data collection and processing and their legal bases are clear. List where data are optional vs required? Retention periods? Where it's for pupil data, they will need to be understandable to children not only written in clear and plain language. Workforce, governors, and public using the website are separate.

 

Do you inform how DfE, LA, MAT processes data or just say "we pass data on to the DfE". Purpose of the processing and the legal basis for the processing, retention period etc. I'm sure you've seen the ICO guidance already: https://ico.org.uk/for-organisations/guide-to-data-protection/privacy-notices-transparency-and-control/privacy-notices-under-the-eu-general-data-protection-regulation/

 

If not already done, you might try user-testing with the PTA and/or governors. We could review if you post a current non-identifiable version and/or future to-be draft.

[Love_Sausage]

We could review if you post a current non-identifiable version and/or future to-be draft.

 

No thanks, the question was simply polling opinion on whether we resend them in May or find an alternative.