What to do in the case of parental refusal to process data

[enjay]

The key info we are collecting is how many tickets they want and what day for as the event runs a couple of times. We have much of the other data, but we need to collect a least some PII to know who the tickets are being ordered by. There's a limited number of tickets.

 

Do you have an online payment system? If so, sell the tickets through that, first-come-first-served. That takes Google out of the mix, too. Otherwise, perhaps ask the parent to complete the form with the least amount of information they're willing to give - as long as they enter the student name and number of tickets, you're good.

[Ditto]

Thanks to you all for the input. The conversation is useful particularly in terms of post GDPR consideration. In relation to earlier points about payment, my understanding is this parent is not happy to use our electronic payment system either, but I believe we allow some kind of alternative payment - as rightly pointed out we do need to accommodate those without internet access. In this case, we are receiving responses by email so I believe the objection is more to do with the data processor(s). Edited April 23, 2018 by Ditto

[mjk]

Worth remembering as well that if the school is relying on consent to process the personal data relating to the ticket, then they need to be able to offer the person choice on how their data is processed. If you are saying you either buy the ticket and we process the data in Google Apps, or you can't have a ticket, then you can't rely on consent and you would need another lawful basis for processing the data.

 

No they don't. I'm not sure where you got this idea from.

I want a driving license but I'm not going to let the government store the data in the DVLA system - fine, don't have a driving license.

[synaesthesia]

I mean how many of us would love to refuse to have any of our data processed by Capita? Wonderful, speeding & parking tickets, council tax fines, driving licensing issues. All gone!

[enjay]

I mean how many of us would love to refuse to have any of our data processed by Capita? Wonderful, speeding & parking tickets, council tax fines, driving licensing issues. All gone!

 

Yes, but so would my shareholding and at least one of my pension funds. I want to keep those!

[elsiegee40]

Thanks you all for the input. The conversation is useful particularly in terms of post GDPR consideration. In relation to earlier points about payment, my understanding is this parent is not happy to use our electronic payment system either, but I believe we allow some kind of alternative payment - as rightly pointed out we do need to accommodate those without internet access.

Good, but email doesn’t work without internet!

In this case, we are receiving responses by email so I believe the objection is more to do with the data processor(s).

[MkII]

my understanding is this parent is not happy to use our electronic payment system either, but I believe we allow some kind of alternative payment

 

You should already have an alternate payment system set up then such as PayPoint.

Edited April 23, 2018 by MkII

[TwistedHelixis]

If it was just Google the parent had issues with, I would say they do not understand the difference between the personal Google services and G Suite, as they also have an issue with the payment system its going to be a real nightmare for you. Almost everything we do now is electronic.

 

I would probably ask them in and have a chat. I assume they have a bank, email etc so must have some digital footprint. Perhaps they do not realize how much of an issue it will be for the school and pupil or that they can ask at anytime to have details removed.

 

Good luck

[Edutech98]

No they don't. I'm not sure where you got this idea from.

I want a driving license but I'm not going to let the government store the data in the DVLA system - fine, don't have a driving license.

 

The government wouldn't rely on consent for a driving licence lol

 

Please see the ICO guidance on consent...

 

https://ico.org.uk/media/about-the-ico/consultations/2013551/draft-gdpr-consent-guidance-for-consultation-201703.pdf

 

The in-brief section covers this: A couple of quotes from the guidance;

"Consent is appropriate if you can offer people real choice and control over how you use their data, and want to build their trust and engagement. But if you cannot offer a genuine choice, consent is not appropriate."

 

"If you make ‘consent’ a precondition of a service, consent is unlikely to be the most appropriate lawful basis."

 

"Consent is likely to be the most appropriate lawful basis for processing (or the appropriate gateway through other relevant provisions) if you want to offer your customers real choice and control over how you use their data."

 

"When is consent inappropriate? - It follows that if for any reason you cannot offer people a genuine choice over how you use their data, consent will not be the appropriate basis for processing"

[IrritableTech]

Worth remembering as well that if the school is relying on consent to process the personal data relating to the ticket, then they need to be able to offer the person choice on how their data is processed. If you are saying you either buy the ticket and we process the data in Google Apps, or you can't have a ticket, then you can't rely on consent and you would need another lawful basis for processing the data.

 

Exactly - consent must be freely given. You can't say we won't sell you a ticket unless you consent to us processing your data in this manner. As a data subject you are being forced to consent so you can watch your child perform.

 

I can't see another legal reason to process this data so I think this boils down to common sense - you've asked for parents to complete this process to make your life easier or ticket allocation more fair. One doesn't wish to share their data with a third party processor on this occasion. You'll have to make alternative arrangements for this person.

[DrCheese]

I can't see another legal reason to process this data

Needed for a contract? i.e if I buy from Amazon, they have to have my data to get me the product I've ordered. It's required to forefill the customers request, consent doesn't come into it

 

One doesn't wish to share their data with a third party processor on this occasion. You'll have to make alternative arrangements for this person.

Why tho? If I want to buy something that only one company sells, but dislike how they are processing my data the only thing I can do is not buy it. I can't insist they change their processes to accommodate me.

[Edutech98]

 

 

Why tho? If I want to buy something that only one company sells, but dislike how they are processing my data the only thing I can do is not buy it. I can't insist they change their processes to accommodate me.

 

That is why most companies will not choose consent for the lawful bases for processing data, they will use something like legitimate interest.

 

Consent is one of the areas that I see a lot of confusion. The GDPR has set the bar high with consent and if you want to rely on consent it has to be true, freely given consent.

 

@Irritable Tech put it perfectly, you can't say to someone you have to give me your personal details other I won't do something, and then claim the person gave consent freely. They didn't give it freely, they didn't want to give you their details but they had no choice, it was either give away your personal details or you don't get to watch your child.

[mjk]

The government wouldn't rely on consent for a driving licence lol

Please see the ICO guidance on consent...

https://ico.org.uk/media/about-the-ico/consultations/2013551/draft-gdpr-consent-guidance-for-consultation-201703.pdf

The in-brief section covers this: A couple of quotes from the guidance;

"Consent is appropriate if you can offer people real choice and control over how you use their data, and want to build their trust and engagement. But if you cannot offer a genuine choice, consent is not appropriate."

"If you make ‘consent’ a precondition of a service, consent is unlikely to be the most appropriate lawful basis."

"Consent is likely to be the most appropriate lawful basis for processing (or the appropriate gateway through other relevant provisions) if you want to offer your customers real choice and control over how you use their data."

"When is consent inappropriate? - It follows that if for any reason you cannot offer people a genuine choice over how you use their data, consent will not be the appropriate basis for processing"

 

None of these points are talking about the system in which the data is held so they are irrelevant, rather they are talking abut consent around how the data is used (who it is shared with).

You are misinterpreting the law if you think that you can dictate to institutions the systems that they use, that's not what the GDPR is designed for, nor how it can be used.

I absolutely can guarantee you that (as a parent) I cannot make any institution hold data about me only on paper or system Y and it's ridiculous to suggest otherwise. You might be getting muddled up with offering alternatives about storing biometric data - where you would offer an alternative because the student refuses to give the data - but it's not about the system.

[Edutech98]

I think you are getting confused about lawful bases for processing and what they mean.

 

If you rely on public interest, performance of a contract, legitimate interest, then no you can't dictate to an organisation how they are used.

 

If you are relying on consent, then the data subject has the power. The ICO guidance is pretty clear, have you read it? This is a quote which describes the exact sitution;

 

"If you require someone to agree to processing as a condition of service, consent is unlikely to be the most appropriate lawful basis for the processing. In some circumstances it won’t even count as valid consent"

 

That's why you must fully understand what consent actually means under the GDPR. It has to be freely given, the person must want to give it to you. I always advise my customers to think really hard about using consent and really stress the meaning of it to them and consider if legitimate interest, as an example, would be more suitable.

[DrCheese]

Yes, agree - I had to stop a letter going out recently to staff here asking for consent to keep their data after they leave. We don't need their consent, it's legitment interests/already covered under UK law. If you ask for consent when you don't need it, you open yourself up to a world of hurt (i.e situation above!)

[Ditto]

You should already have an alternate payment system set up then such as PayPoint.

We do - probably cash in to the petty cash box. Would love to accept a bitcoin (no change of course), but I expect that needs the internet too . Recently, when I needed to pay a deposit on a car, I was prohibited from paying cash - apparently anti-money laundering. I guess without the internet, I'd have to see if I can find a cheque book.

[enjay]

"If you require someone to agree to processing as a condition of service, consent is unlikely to be the most appropriate lawful basis for the processing. In some circumstances it won’t even count as valid consent"

 

Okay, so what IS the grounds in this situation then? I can't see any of the other legal bases apply either.

[enjay]

We do - probably cash in to the petty cash box. Would love to accept a bitcoin (no change of course), but I expect that needs the internet too . Recently, when I needed to pay a deposit on a car, I was prohibited from paying cash - apparently anti-money laundering. I guess without the internet, I'd have to see if I can find a cheque book.

 

Do bankers drafts still exist? I've used one of those to buy a car before. I've also bought a car on a credit card, but that's another story!

[Edutech98]

Okay, so what IS the grounds in this situation then? I can't see any of the other legal bases apply either.

 

I agree with @IrritableTech and @enjay 's suggestions. You process the data on the bases of consent, but if the person doesn't want to give you their details they shouldn't have to. The school will just need to put ParentX or the child's teacher name for example. The school can still ask for the persons details, but the parent shouldn't be forced to give them up.

Edited April 23, 2018 by Edutech98

[LeMarchand]

I've also bought a car on a credit card, but that's another story!

 

I've done that - quite a lot of Nectar points were gained!

[Ditto]

Exactly - consent must be freely given. You can't say we won't sell you a ticket unless you consent to us processing your data in this manner. As a data subject you are being forced to consent so you can watch your child perform.

I can't see another legal reason to process this data so I think this boils down to common sense - you've asked for parents to complete this process to make your life easier or ticket allocation more fair. One doesn't wish to share their data with a third party processor on this occasion. You'll have to make alternative arrangements for this person.

In practice we will probably sell the ticket at the reception desk. Many schools have the exceptionally parent to deal with and a pragmatic approach is simpler. But is it fair on all the other parents to subsidise the more expensive process? Whilst google are (arguably) the processor, are we really sharing the data with them. I'm sure they state very clearly it's our data and they don't use it. In fact in this case they are not even processing it, we are , they are purely offering secure storage.

[enjay]

I agree with @IrritableTech suggestion. You process the data on the bases of consent, but if the person doesn't want to give you their details they shouldn't have to. The school will just need to put ParentX or the child's teacher name for example. The school can still ask for the persons details, but the parent shouldn't be forced to give them up.

 

So, what I said back in post 11 then?

[Ditto]

If it was just Google the parent had issues with, I would say they do not understand the difference between the personal Google services and G Suite, as they also have an issue with the payment system its going to be a real nightmare for you.

You bet!

I would probably ask them in and have a chat.

That's happening. The email to the office bordered on offensive. There was another issue too that required the head to follow up on, but I'll not cloud the discussion.

Perhaps they do not realize how much of an issue it will be for the school and pupil or that they can ask at anytime to have details removed.

Hard to judge - we hope the chat with the head will find a happy middle ground. We certainly have other parents where it would be of no concern to the parent how much work it is for the school.

[Edutech98]

So, what I said back in post 11 then?

 

Yep spot on! Just edited the post to give credit to your idea - it's surely the simplest and best solution

[Ditto]

Yes, agree - I had to stop a letter going out recently to staff here asking for consent to keep their data after they leave. We don't need their consent, it's legitment interests/already covered under UK law. If you ask for consent when you don't need it, you open yourself up to a world of hurt (i.e situation above!)

I think this is a really important point. I'm advising we should notify about processing wherever it is the right thing to do - no point asking for permission unless it is actually necessary.

Edited April 23, 2018 by Ditto