Special Category, but...

[Gongalong]

Hi folks,

 

When reading around the topic of sensitive data, soon to become special category data, I was sure I'd read that equivalent protection has to be made to any form of data that would cause damage or distress if lost, illegally accessed etc.

 

For example, Pupil Premium data is... well, sensitive. I would also think progress/achievement data is particularly sensitive.

 

Any thoughts on how you deal with these types of data that are more sensitive than say a name and a phone number? Is it better to just err on the side of caution and treat it as special category? Is there clearer guidance on this somewhere?

 

Thanks

[Bigbird7]

The guidance from the DfE published this week suggests exactly that. The relevant para is copied below

 

“Within education, we do process some sensitive information about children that is not set out in the legislation as a ‘special category personal data’. Notably information about children’s services interactions, free school meal status, pupil premium eligibility, elements of special educational need information, safeguarding information and some behaviour data. We consider it best practice that when considering security and business processes about such data, that they are also treated with the same ‘high status’ as the special categories set out in law”

[GrumbleDook]

The guidance from the DfE published this week suggests exactly that. The relevant para is copied below

 

“Within education, we do process some sensitive information about children that is not set out in the legislation as a ‘special category personal data’. Notably information about children’s services interactions, free school meal status, pupil premium eligibility, elements of special educational need information, safeguarding information and some behaviour data. We consider it best practice that when considering security and business processes about such data, that they are also treated with the same ‘high status’ as the special categories set out in law”

 

The law gives a description of special category personal data, but information can have ‘handling notes’ ... reminding you to take care of it. In the same way that commercial data in a company would be ‘sensitive’ in how it needs to be handled ... think about it in a simulate fashion.

[Gongalong]

What I've told staff previously as a rule of thumb is to think if that information were about them... would they want it locked away, or equally would they mind if it were just open to read, or illegally accessed? That's on top of giving them the defined sensitive/special category info, and some examples of other items that would be viewed as such in an education context.

[Gongalong]

My feeling also is that progress/achievement data should be treated as sensitive/special category. I wouldn't want other people to know my progress, yet it's common in schools to post progress on public display boards.

 

What are other people's thoughts about this type of data?

[Edutech98]

My feeling also is that progress/achievement data should be treated as sensitive/special category. I wouldn't want other people to know my progress, yet it's common in schools to post progress on public display boards.

 

What are other people's thoughts about this type of data?

 

I agree with you. These are what I tend to think about when deciding if something needs a high degree of security measures.

 

 

Is it something the person could be discriminated/bullied against - i.e race, religion, sexaulitiy, free school meals, disability etc

 

Is it something that could cause the person embarrassment - i.e sex life, disciplinary notes, achievement data, salary

 

Is it something that could cause the person financial lost - i.e credit card, bank details etc

 

Is it something that the person could be targeted for - i.e children in care, SEN students.

 

If the answer is yes then this equals a high measure of risk mitigation.

Edited April 26, 2018 by Edutech98