Text messaging service/payment system - Legal basis of collecting the data?

[scarecrow42]

Hi

 

We use parentpay/schoolcomms for all of our payment/email/text messaging services.

 

Does this fall within 'used for specified, explicit and legitimate purposes i.e we use it communicate nearly everything with parents using these systems, or do we need consent?

 

I think that the data which flows from Sims to the above, is the parent mobile number or email address and parent name and child name must site somewhere in the background to match. The parents then sign up on parentpay/schoolcomms.

 

I have amended my admission form with a note that the data on the form will be shared with the above companies and it is part of school protocol to communicate this way. I have also included it on my privacy notice.

[enjay]

I think that depends on the message you're sending. If it directly relates to the operation of the school (e.g. school is closed tomorrow, or reminders about parents evening) it is processed under public interest. If it is a flyer about the summer PA barbecue you might need consent.

[Love_Sausage]

Last session at a Trust solicitor they used this as an example of legal basis for processing being contractual, the school needs to pass data on to that supplier to enable the school to offer meals and payments.

[jmak]

I think that depends on the message you're sending. If it directly relates to the operation of the school (e.g. school is closed tomorrow, or reminders about parents evening) it is processed under public interest. If it is a flyer about the summer PA barbecue you might need consent.

I'd love a definitive answer to the point @enjay makes.

 

At the minute we don't maintain a separate list for opting out of "marketing". If we send out a school newsletter which is mostly full of "remember to book a parents'evening appointment", "there's an e- safety session next week and please don't park on the zigzag lines", does it count as marketing if it also has diary dates which include the PTA disco?

 

And at what point does it become marketing? If there's an item included? If there's a picture? If it's a separate communication?

[clangstaffnhts]

I'd love a definitive answer to the point @enjay makes.

 

At the minute we don't maintain a separate list for opting out of "marketing". If we send out a school newsletter which is mostly full of "remember to book a parents'evening appointment", "there's an e- safety session next week and please don't park on the zigzag lines", does it count as marketing if it also has diary dates which include the PTA disco?

 

And at what point does it become marketing? If there's an item included? If there's a picture? If it's a separate communication?

 

 

I'd also like confirmation on this - my understanding to date is that consent will be required from parents to push out any promotions that may be seen as advertising such as a school event or a school strategy for homework.

[AlanPartridgeAhaa]

I'd also like confirmation on this - my understanding to date is that consent will be required from parents to push out any promotions that may be seen as advertising such as a school event or a school strategy for homework.

 

I think this could be justified as Legitimate Interest, as could any communication relating to an activity of the school that educates their child.

Edited October 22, 2018 by AlanPartridgeAhaa

[jmak]

I think this could be justified as Legitimate Interest, as could any communication relating to an activity of the school that educates their child.

The only things we promote are PTA events, which are run purely for the benefit of the school but they're not essential to delivering education. I guess you could argue legitimate interest and as we have no realistic way of differentiating communications currently we'll carry on until a parent somewhere challenges and takes a test case to the ICO/court...

[clangstaffnhts]

@GrumbleDook can you shed any light on this topic?

 

It seems that every school I talk to is struggling to decipher what is classed as a communication falling under legitimate interest and what requires consent. Where do we draw the line is a school trip seen as essential communication or do we require consent for this?

 

As a school that prides itself as being at the centre of the local community it seems a shame to be forced to into ending advertisements for local events or seek consent from all parents which will take time to launch, collate and additional time to update mailing lists before sending each communication.

[BFCIT]

For marketing purposes, eg PTA, we were told that a nice way around this is to advertise the page on your website, eg http://www.school.com/pta and put all of your promotional material on your website. Then through schoolcomms tell parents visit your site to view event details, rather than directly sending out promotional/marketing data. This way the parent/carer still has the 'active' choice whether or not to view the content.

 

My understanding is that if you use schoolcomms for sending parents texts regarding school closure etc this is perfectly acceptable and is under the lawful bases of GDPR. If you are sending promotional material using schoolcomms you would need to seek clear consent from that parent.

[rom1984]

Warning PECR/direct marketing isn't my area of expertise but from what I can tell the official guidance would be from the PECR/Direct marketing guides.

 

Direct marketing is defined as the communication of any advertising or marketing material which is directed to a particular individuals. So school closures, lateness, don't park on double yellows etc is not advertising or marketing material. Any promotional material, advertising or marketing such as PTA BBQ, look at our amazing website, come to our fair, would be classed as direct marketing even if you believe there is some greater good for the school. I believe the standard of direct marketing is not "how does this benefit the school or the child?" - the standard is are we promoting or advertising something?

 

If you are advertising or marketing something, then you require consent. There is no legitimate interest / public interest to market to someone.

 

It also says

 

"Not-for-profit organisations need to be aware that the definition of direct marketing will cover any messages that contain marketing elements even if this is not the main purpose of the message."

 

So as in @jmak example this message would contain elements of marketing even though that was not the main purpose of the message.

 

You can do an opt-in asking if parents are happy to receive future marketing from the school so you wouldn't necessarily need to obtain consent every time you send a new message (providing it follows the usual consent standards).

Edited December 3, 2018 by rom1984

[AndrewSharp]

There are six lawful bases to choose from.

 

Contract would be the logical lawful basis for communications about payments. This prevents opt-out as you need to communicate as part of delivering the contracted services.

 

Consent or Legitimate Interest would be suitable for messages which might be considered marketing. In either case the parent can opt out if they wish.

 

The key is to ensure that the lawful basis, or bases if there are multiple purposes, is clear when you collect the data, so refer to it in a privacy notice and perhaps on the admissions form where it is collected and make sure that it's also clear on your Record of Data Processing for each purpose.

 

PECR (which covers electronic communications) permits contact with existing customers, but not new prospects, about products or services similar to those already purchased without prior consent as long as an option to opt out was provided when the data was collected and in subsequent communications (known as a "soft opt in" or "implied consent"), so you may choose to rely on Legitimate Interest for marketing similar services to current parents.

Edited December 4, 2018 by AndrewSharp

[rom1984]

There are six lawful bases to choose from.

 

 

Consent or Legitimate Interest would be suitable for messages which might be considered marketing. In either case the parent can opt out if they wish.

 

 

I don't think this is correct Andrew? If you are direct marketing you require consent. There is no LI to direct market.

 

You would have to be careful using the soft-opt in under PECR as there are times when not for profit orgs can not use it.

Edited December 4, 2018 by rom1984

[AndrewSharp]

rom1984 - you're right that PECR always requires consent, but there's a difference under PECR between marketing to prospective customers, where specific consent is required, and offering additional similar products/services to existing customers via soft opt in.

 

The ICO's guidance on PECR, which governs email and SMS marketing is summarised as "You must not send marketing emails or texts to individuals without specific consent. There is a limited exception for your own previous customers, often called the ‘soft opt-in’., Details can be found at https://ico.org.uk/for-organisations/guide-to-pecr/electronic-and-telephone-marketing/electronic-mail-marketing/

 

You're also right that there's a particular challenge for not for profit organisations. This is most commonly encountered when they want to use data for fundraising. For example, taking an entertainment example, you attend a show at a not for profit theatre and they then want to approach you for a donation. Fundraising isn't a similar product or service to the originally purchased item so the soft opt in doesn't apply. Many not for profit organisations now seek a separate consent to keep supporters up to date with projects and related fundraising activities, which schools could do on the admissions form "we'd like to keep you up to date with our new library project, supported by fundraising, and other similar projects...".

 

Looking at the lawful basis for processing under GDPR, Legitimate Interest "is likely to be most appropriate where you use people’s data in ways they would reasonably expect and which have a minimal privacy impact" says the ICO at https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/legitimate-interests/ Marketing was specifically mentioned in GDPR as a possible purpose for which Legitimate Interest might be appropriate, along with fraud prevention and others. Note, however, that a Public Authority, which includes a state school, can't use this basis for anything where that task is already covered by their duty as an authority. The school doesn't, I suspect, have a statutory duty to inform parents about most of what is in a typical newsletter, so couldn't rely on Public Task, but it can argue that it has a legitimate interest in doing so. A Legitimate Interest Assessment can be used to record the possible impact and whether the balancing test of the school's interest vs the data subject's right to privacy is met.

Edited December 4, 2018 by AndrewSharp

[rom1984]

But the school couldn't direct market under legitimate interest or have I misunderstood what you are saying? This is the run through I've got in mind;

 

Public Task - messages relating to the child's education, e.g. Child's detention, schools closed, your child has banged his head etc.

 

Direct marketing - any promotion or advertising e.g. Come to our BBQ/fair, look at our website, donate to our cause etc. These would all require consent.

 

Parent Pay as an example could use the soft in option to advertise additional services via SMS providing it was a similar service they are offering and there is a clear opt out. The school couldn't take the details from Parent Pay though and use them for there own interest as this wouldn't comply with the soft opt in.

 

The school also couldn't get a parents contact details on the proviso that it was to be used, for example, as an emergency contact, and then advertise or promote to them as this wouldn't be a commercial sale so wouldn't comply with soft opt in.

Edited December 4, 2018 by rom1984

[enjay]

This is the run through I've got in mind;

 

Public Task - messages relating to the child's education, e.g. Child's detention, schools closed, your child has banged his head etc.

 

Direct marketing - any promotion or advertising e.g. Come to our BBQ/fair, look at our website, donate to our cause etc. These would all require consent.

 

I think the categories actually look more like this:

 

Public Task - messages relating to the child's education, e.g. Child's detention, schools closed, your child has banged his head etc. This would also include communication about upcoming school trips, parents consultation evenings, etc.

 

legitimate interest - come to our BBQ, don't forget it is the school concert tonight, newsletters, etc. things not directly related to the child's education but taking place within the context of their school life. I believe - and so does our DPO - parents expect the school to communicate this sort of information to them (indeed we had one Year 7 parent contact the school at the end of the first week worried we had their email address wrong because they hadn't received any emails from us yet!)

 

Direct marketing - promoting events in the local community, events taking place at school but not organised by school, etc.

[rom1984]

The deputy commissioner of the ICO has just put out a myth busting blog and one of the things he addressed was contacting parents to promote Christmas fairs etc. Looks like he agreed with @enjay of doing it under legitimate interests - great minds think alike

 

https://ico.org.uk/about-the-ico/news-and-events/news-and-blogs/2018/12/sleigh-ing-the-christmas-gdpr-myths/

Edited December 10, 2018 by rom1984

[AndrewSharp]

The deputy commissioner of the ICO has just put out a myth busting blog and one of the things he addressed was contacting parents to promote Christmas fairs etc. Looks like he agreed with @enjay of doing it under legitimate interests - great minds think alike

 

https://ico.org.uk/about-the-ico/news-and-events/news-and-blogs/2018/12/sleigh-ing-the-christmas-gdpr-myths/

 

In relying on Legitimate Interest to process contact data for marketing activities (and PECR implied consent to send the message electronically) beware, however, that parents can opt out of marketing purposes but not of public duty/contractual purposes, so you'd need to be able to determine which messages are which and apply your opt-out flags accordingly to those sent as marketing. You not remove a parent from all communications because they opt out of marketing, so you'll need to be sure that your messaging platform supports opt-out by message genre or that you can over-ride the marketing opt-out when sending a message to which it doesn't apply.

Edited December 10, 2018 by AndrewSharp

[enjay]

In relying on Legitimate Interest to process contact data for marketing activities (and PECR implied consent to send the message electronically) beware, however, that parents can opt out of marketing purposes but not of public duty/contractual purposes, so you'd need to be able to determine which messages are which and apply your opt-out flags accordingly to those sent as marketing. You not remove a parent from all communications because they opt out of marketing, so you'll need to be sure that your messaging platform supports opt-out by message genre or that you can over-ride the marketing opt-out when sending a message to which it doesn't apply.

 

This is why we have decided to only send emails which fall into the legitimate interest category!