What to do in the case of parental refusal to process data

[mjk]

I think you are getting confused about lawful bases for processing and what they mean.

If you rely on public interest, performance of a contract, legitimate interest, then no you can't dictate to an organisation how they are used.

If you are relying on consent, then the data subject has the power. The ICO guidance is pretty clear, have you read it? This is a quote which describes the exact sitution;

"If you require someone to agree to processing as a condition of service, consent is unlikely to be the most appropriate lawful basis for the processing. In some circumstances it won’t even count as valid consent"That's why you must fully understand what consent actually means under the GDPR. It has to be freely given, the person must want to give it to you. I always advise my customers to think really hard about using consent and really stress the meaning of it to them and consider if legitimate interest, as an example, would be more suitable.

 

OK - I understand what you are saying now: that the OP shouldn't ask for consent because they already have a legal basis for collecting the data and the parent can go whistle.

[jmak]

OK - I understand what you are saying now: that the OP shouldn't ask for consent because they already have a legal basis for collecting the data and the parent can go whistle.

In this instance, the school already has the data, but it can only be used where there is a legal basis relating to providing the child's education or the essential running of the school. However, as the parent's attendance at the school production is not essential to educating the child, you would need their consent to process their data for this purpose. (Based on my understanding from the documentation I've read. If someone can say what the legal basis for processing the data is with respect to tickets for school events I'd be happy to hear I'm wrong about it.)

 

We use http://www.parentseveningsystem.co.uk by School Cloud Systems for both parents evenings and school event tickets. I'd suggest that we can continue to use it for parents evenings on a legal basis, but would need consent for school events. Anyone agree or disagree?

[Ditto]

In this instance, the school already has the data, but it can only be used where there is a legal basis relating to providing the child's education or the essential running of the school. However, as the parent's attendance at the school production is not essential to educating the child, you would need their consent to process their data for this purpose. (Based on my understanding from the documentation I've read. If someone can say what the legal basis for processing the data is with respect to tickets for school events I'd be happy to hear I'm wrong about it.)

We use www.parentseveningsystem.co.uk by School Cloud Systems for both parents evenings and school event tickets. I'd suggest that we can continue to use it for parents evenings on a legal basis, but would need consent for school events. Anyone agree or disagree?

 

Now there's an idea, we have PES too. Obvious in hindsight of course, it has an Events section! We use it for after school clubs as well as parent evenings. I'll suggest to the office we use it for ticketing in future. If we use parents evening for multiple purpose, but the same data, would we need three lot's of permissions? Perhaps this parent is happy for us to use it - I'm not aware an issue has been raised about that system being used. In your case, how do you go from PES to the payment system?

[IrritableTech]

Whilst google are (arguably) the processor, are we really sharing the data with them. I'm sure they state very clearly it's our data and they don't use it. In fact in this case they are not even processing it, we are , they are purely offering secure storage.

 

By offering secure storage for that data they immediately become a data processor.

 

As others have said, we’re talking about a parents want to see their child in the school play. We all work in schools. We’re not entering a contract for a seat to watch a musical with a billed b-list celebrity and a no refund policy.

 

The parent needs to give consent for this type of data to be processed. They don’t like the means in which it collected and is going to be processed. So let’s just do what schools do and adapt to specific pupil and parent needs so that everyone gets the same opportunity.

 

The law has been created to allow users more control over their data and more transparency for who holds what. It’s not designed to stop parents celebrate success with their child, the internal school process is causing the issue - so I’d suggest the school changes the process, either for this one parent, or for all.

[synaesthesia]

You can't have different systems in place for everything just in case someone objects to something. needs to be some give and take.

[IrritableTech]

You can't have different systems in place for everything just in case someone objects to something. needs to be some give and take.

 

Agreed, but they’ve made a reasonable request for a simple change. They can’t refuse that all their data is removed from google if that is what the school uses for administrative purposes because they have another legal basis, but in this case the request isn’t excessive and it’s possible to adapt.

[Ditto]

You can't have different systems in place for everything just in case someone objects to something. needs to be some give and take.

Agreed. In this case the parent appears to have an deep seated distrust of a particular data processor - in fact a deep seated distrust of the internet was expressed. If we comply with all the regulations and show we have exercised due diligence, we shouldn't have to bend to every parental whim - especially if there is a cost to other parents, which although minimal, is still present. As stated early, we will make a compromise with this parent, but there are times when what's good for the whole school is more important than individual.

[mjk]

Agreed, but they’ve made a reasonable request for a simple change. They can’t refuse that all their data is removed from google if that is what the school uses for administrative purposes because they have another legal basis, but in this case the request isn’t excessive and it’s possible to adapt.

I don't think it is a reasonable request because it would become impractical: If I have 3000 parents and some don't like Google, some don't like paper, some don't like open source and some won't use propriety I cannot be expected to create an ad hoc system for each parent: thus (as @Edutech98 pointed out) the data would best be processed under a legitimate interest.

[jmak]

Now there's an idea, we have PES too. Obvious in hindsight of course, it has an Events section! We use it for after school clubs as well as parent evenings. I'll suggest to the office we use it for ticketing in future. If we use parents evening for multiple purpose, but the same data, would we need three lot's of permissions? Perhaps this parent is happy for us to use it - I'm not aware an issue has been raised about that system being used. In your case, how do you go from PES to the payment system?

The link to payments is the least smooth part - we put a link in the auto response telling them how much to pay. It's not perfect, but much better than Google forms/sheets as you can control how many tickets are available in total and per pupil or per showing, per family etc

 

In Schoolcomms we put a matching item, but we can't stop people paying for a ticket without booking - or stop then booking and then not paying. We haven't had any problems so far, but it relies on parents not being stupid or awkward and we know how that goes....

 

I also checked and their data centre is UK hosted by UKfast.co.uk - having read about them just now, their offering would be a good response for someone who doesn't like Google but isn't 100% against technology.

[DrCheese]

However, as the parent's attendance at the school production is not essential to educating the child, you would need their consent to process their data for this purpose.

I disagree - It's "needed for a contract" which is a legitament interest. The parent can choose not to sign that contract if they wish, but then they can't come to the evening. They aren't "forced" to come so they can't cry about it.

That's not the schools problem. Again, I'll use the Amazon example, if I order something from Amazon, Amazon can legally process my details without my consent as it would be impossible for them to deliver my items (and forefill the contract) without my data.

 

In this case, you can't reserve the ticket, send required safety information, be covered for insurance purposes, inform of any changes or allocate seats without the parents information. That's not something they can give consent for, it's required.

 

The GDPR doesn't allow people to demand you change your processes because they disagree with it & I don't think we should be setting precedent that they can.

 

I don't think it is a reasonable request because it would become impractical: If I have 3000 parents and some don't like Google, some don't like paper, some don't like open source and some won't use propriety

Yarp. Allow it for one & before you know it, it's become a giant mess

[Edutech98]

It’s normally frowned upon for schools to use legitimate interest, but because this isn’t part of the curriculum so to speak they might be able to get away with it.

 

I personally don’t think contract is suitable for this, the data isn’t really necessary for the performance of a contract. You don’t need every parents details for the insurance to be valid, as long as you know how many chairs to how many parents you've got then do you really need every parents details, that seems excessive. It’s just easier for the school to have them to apply tickets.

 

I still think consent is the correct lawful basis, but with consent comes certain caveats that you need to apply by.

 

Putting GDPR/Data Protection to one side – isn’t this just a customer service issue. The schools can easily adapt to the parent and everyone will be happy. I don’t think schools should refuse to adapt any of their polices on the off chance that it creates a precedence. Just adapt and overcome to the situation as it is easy in this case. If it becomes an issue because the majority of parents don’t want their details processed over to Google then you should rethink your procedure. I honestly don’t think this will happen though, it sounds like a one off parent.

 

I like the Elon Musk attitude that was in the newspaper this week – “As for company rules, if following them is “obviously ridiculous” in a particular situation “such that it would make for a great Dilbert cartoon” then adapt the rule.

Edited April 24, 2018 by Edutech98

[MkII]

Exactly. it's a school decision (The decision to to GSuite as data processor). If the individual disagrees they should approach a school governor or become a governor themselves to be part of the decision making process.