GDPR & Students (Secondary)

[mhw1970]

Apologises if already asked!

 

Secondary schools - are you educating students about their rights / issuing them directly with privacy notices - once they hit 13 years old, they are able to provide consent...

 

Thanks

[forkies]

We are still in discussion with our legal but it looks like we will be issuing privacy notices via our website and directing students to that (still providing paper copies as required).

We will gain consent from students when they move up a year rather than on their 13th birthday as this seems acceptable, obviously we would still treat any requests or issues based on their age at the time, for example if they have just turned 13 but hadn’t moved up to the next year yet.

[Bigbird7]

I get the privacy notices part, I’m not sure why you would need to consent pupils for things like photographs or biometrics. GDPR refers specifically to information services only with reference to children’s consent. The consents that you already hold from parents will suffice

[forkies]

We ask for consents every year, therefore we MAY be asking for student consents in September once they are over the age of 13 (or in the relevant year groups if that makes sense). This hasn’t been confirmed here but is a potential option as we feel it is important to inform and have our students understand about data protection and consents, especially with all these websites doing naughties with their data. Best way to educate them is to involve them

[Bigbird7]

We ask for consents every year, therefore we MAY be asking for student consents in September once they are over the age of 13 (or in the relevant year groups if that makes sense). This hasn’t been confirmed here but is a potential option as we feel it is important to inform and have our students understand about data protection and consents, especially with all these websites doing naughties with their data. Best way to educate them is to involve them

 

Ah ok, that makes a lot of sense

[rom1984]

If it makes it easier for anyone you can get the parental consent in year 7 and that will be valid throughout the child’s school life. Likewise you don’t necessarily need to issue the privacy notice every year as long as it is available and transparent.

 

The thing you would need to take into consideration is if a child expresses any of their data protection rights, if the school determines that the child has the capacity to understand, then they should review the request as if they would of any adult.

 

Of course as a matter of great data protection awareness, if the school did want to involve Year 9,10 etc children in the process, then what matter time to get them thinking about their own data and what it means to give someone access to it. If there ever was a breach, I think this in of it self would be a great marker of the culture of the school and how embedded they want their data protection practises to be.

[jenatddm]

Apologises if already asked!

 

Secondary schools - are you educating students about their rights / issuing them directly with privacy notices - once they hit 13 years old, they are able to provide consent...

 

Thanks

 

There's lots of incorrect information being given in presentations by companies that are making money out of consent solutions. Be careful.

 

There is lots of confusion on consent under GDPR. Get some data protection legally qualified advice but hopes this helps. Consent only applies where you have no other of the six legal bases for processing and only where it is freely given, can be refused and withdrawn at any time without effect to the service provided. And it cannot be a basis for processing where there is any imbalance in power in the relationship between organisation and data subject (school and pupil/parent) -- almost nothing will be consent based except you should already be using it -- biometrics.

 

Consent is legal obligation for biometrics and an alternative must be offered (England: Protection of Freedoms Act 2012) and required for Youth Services 13+.

 

Consent in Article 8 of he GDPR at age 13 is *only* for Information Society Services targeted at and used by a child, and only where consent is the basis for processing. If your children's access to GSuite, apps etc are all optional and can be refused, then you can ask for consent. If they're not -- and clearly they are not -- there is no consent process.

 

See the GDPR threads in the forum for lots of discussion on this and ICO and get your data protection officers guidance. https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/applications/children/

[GrumbleDook]

Consent advice is a tricky one to manage in schools ... which is why some firms spend a lot of time trying to explain it ... unfortunately, as @jenatddm says, this can end up as advising on using consent as the de facto lawful basis.

If you do go to a presentation and have consent pushed to you then push back and ask where safeguarding requirements fit, processing of the educational record and even about educational school trips.

 

Emphasis should be on transparency and informing, not consent as a catch all.

[SovietRussia]

We are even providing children friendly privacy notices!

 

https://www.newtown-hs.powys.sch.uk/website/images/docs/your_information_young_people.pdf

[mhw1970]

Thanks to all who have contributed!!! As said above there is an awful lot of hoo ha about at the moment!!

[minimoo]

@jenatddm - in case you've not seen it - the dfe published a document last week updating their guidance on biometric information - https://www.gov.uk/government/uploads/system/uploads/attachment_data/file/692116/Protection_of_Biometric_Information.pdf

 

In terms of 'consent', between grumbledock, our LA and a couple of other sources, lots of comments about NOT making 'consent' a solution for everything.

[junz]

What are you thoughts getting consent about using images of the kids for markerting purpose?

 

When going on my GDPR course, I was told Explicit consent would needed to use the kids images on the website, Social media, and other marketing material. Furthermore consent would need to be provided for the images to be used for those purpuse/platforms seperately.

 

For boys over 13, the kids could provide consent but under that age the parents would need to provide consent on the childs behalf.

 

Anyone else have the same information.

[IrritableTech]

What are you thoughts getting consent about using images of the kids for markerting purpose?

 

When going on my GDPR course, I was told Explicit consent would needed to use the kids images on the website, Social media, and other marketing material. Furthermore consent would need to be provided for the images to be used for those purpuse/platforms seperately.

 

For boys over 13, the kids could provide consent but under that age the parents would need to provide consent on the childs behalf.

 

Anyone else have the same information.

 

We will be gaining consent for images for marketing purposes - one important point we raised recently though was the school prospectus or other printed marketing media. If a child or parent removes their consent after publication, either the investment in printing is lost or potentially the publication is already ‘out in the wild’.

[tj2419]

We will be gaining consent for images for marketing purposes - one important point we raised recently though was the school prospectus or other printed marketing media. If a child or parent removes their consent after publication, either the investment in printing is lost or potentially the publication is already ‘out in the wild’.

I asked about this very scenario on a training event I went on and they said that as long as we had consent when it was printed it is ok but that it would need to not be reproduced and not be used for an extensive time.

 

The example I used was we tend to print prospectuses in batches for 2 years. If consent was withdrawn after print. They said we could still use it for the two years but nothing like 5. Said a common sense approach can justify it. Not sure if this is right but it's what we were told.

[DrCheese]

The example I used was we tend to print prospectuses in batches for 2 years. If consent was withdrawn after print. They said we could still use it for the two years but nothing like 5. Said a common sense approach can justify it. Not sure if this is right but it's what we were told.

Yes I was told the same - That if we'd got consent and then it was withdrawn after we'd printed everything then we can reasonably still use it for a time and the ICO wouldn't see it as an issue.