Retention of certain records when a child leaves Primary - your thoughts, please?

[RS67]

Hi all

 

Apologies if this comes over as an extreme bit of nit-picking, just wanted to gain some views prior to a meeting!

 

We're reviewing our Primary School's data retention schedule, which states that the pupil record will be kept for X years after the pupil leaves the school, then destroyed (in the main, this refers to the electronic record in the school's MIS). To my mind, this means the entire pupil record. The Head is keen to retain copies of certain paper records for a longer period, e.g. if a pupil has been restrained, or if there have been ongoing parental issues, in case there's a law suit against the school at some point in the future. I can't see a lawful basis for doing this if the pupil record in its entirety - including the records of those particular issues - have been passed to the next setting, who will presumably retain it until the pupil reaches the age of 25.

 

Any thoughts or opinions welcomed!

[AlanD]

I don't think there is - or should be much difference between what can be kept on paper - and what can be kept electronically. You could argue either way that one might be more secure than the other....perhaps in reality its easier to lose paper records (either by theft of fire/water) than electronic ones...but yes, electronic ones could be distributed easily...

 

I think there are real problems with "X years"....often a figure associated with financial records is quoted as being appropriate - but without any logical reason why this should be the case. Why should it be X and not X+1 or X-1 is almost impossible to come up with a logical reason.

 

An when you hear of current (albeit abuse cases) going back decades - its not inconceivable that schools might be asked for records going back ...and indeed most would have had records going back decades - held in filing cabinets...I don't see why such a time scales might not be appropriate for electronic records - provided - that encryption and restriction of access is appropriately controlled.

 

All this becomes particular relevant when we hear of the destruction of the Windrush landing card documents - which would have been so helpful today to establish the rights of so many. There seems to be a race to destroy as much as possible - to avoid thinking about GDPR - which might involve policies and justification....and sometimes that justifcation doesn't become clear until much later. My own belief is that have records have been made - fo a good reason at the time - then it is appropriate to look after those records so that later if there is a need to look for evidence and justification - or indeed blame - then that that evidence remains - rather than speculative memories of what people vaguely remember.

[RS67]

Hi @AlanD

 

Thanks for your swift response! I know you wanted to avoid thinking about GDPR (don't we all?!) but if the records are retained, any idea what we could list as the lawful basis for doing so?

 

Thanks again, much appreciated.

[elsiegee40]

You probably will get the best idea by calling the school’s insurers and getting their advice.

 

In the event of historical claims against the school they’ll be the ones having to pay out.

[sjatkn]

Add far as I understand it there is no difference between paper and electronic records under GDPR (or the current DPA for that matter). There is also little in the way of legal limits as to the length of time records must be kept. GDPR wants justification as to why the data is kept and for it to be disposed once it is no longer required. So as long as it is justifiable you can keep it. However you probably need legal advice on what classifies adequate justification. Given that GDPR hasn't taken effect and there haven't been any test cases that may be difficult to obtain.

 

We are at the moment using the advice from the IRMS for our retention policy.

 

Get out clause, I'm not a solicitor or a trained DPO. So I could be completely wrong!

http://irms.org.uk/page/SchoolsToolkit

[markberry]

You have to ask yourself why you need to keep the records. As stated above, there is guidance on the Information and Records Management Society website.

 

Their recommendation is that the entire record should be passed on to their next school:

 

"The file should follow the pupil when he/she leaves the primary school. This will include:

• to another primary school

• to a secondary school

• to a pupil referral unit

• If the pupil dies whilst at primary school the file should be returned to the Local Authority to be retained for the statutory retention period.

 

If the pupil transfers to an independent school, transfers to home schooling or leaves the country the file should be returned to the Local Authority to be retained for the statutory retention period.

Primary Schools do not ordinarily have sufficient storage space to store records for pupils who have not transferred in the normal way. It makes more sense to transfer the record to the Local Authority as it is more likely that the pupil will request the record

from the Local Authority."

[crc-ict]

With the exception of certain medical information, we were advised that all of the pupil record should be passed on to the receiving school (or LA as described by the IRMS from @markberry's post).

 

In the event of it being required, it would then be obtained from the current holder, by court requisition if necessary. We were told that retaining data 'just in case' of future claims or lawsuits were not justification to keep copies of files that are passed on.

[Oaktech]

There is a statutory 25 year retention period for pupil data regardless of format.

 

We're in the process of looking at how we manage this as we've changed DfE numbers and we have an MIS filled with old data and an MIS with current data and we're exploring what the most effective way of hanging onto that historic data is.

 

You can delete their work whenever you like!

[mjk]

See the annex of this document:

https://www.gov.uk/government/publications/data-protection-toolkit-for-schools

 

There isn't much on holding behavior records past a year, but you can certainly hold safeguarding info for 25+yrs.

I'm not sure if restraint would come under safeguarding?

All data on the safeguarding file potentially formspart of an important story that may be neededretrospectively for many years. The elements of apupil file (name, address) that are needed toidentify children with certainty are needed to beretained along with those records.

[markberry]

We were told that retaining data 'just in case'

 

Absolutely agree! Retaining data 'just in case' is not a valid reason to keep it under GDPR. However if you do have a valid reason which you can justify to the ICO and it is reasonable you may be able to retain it. If it was me, I wouldn't want to keep it if I didn't have to!

 

If you read through the guidance from the IMRS, the retention period I describe above applies to the Pupils Basic File. There are other retention periods for other documents relating to SEN, CP, Attendance Registers etc. You must look at those other areas and decide whether those need to be retained in line with that guidance. The guidance is here: IRMS Schools Toolkit - Information and Records Management Society

[mjk]

There is a statutory 25 year retention period for pupil data regardless of format.

That's not entirely accurate, it depends upon the type of data. See the document that I linked to in my post above.

[Oaktech]

That's not entirely accurate, it depends upon the type of data. See the document that I linked to in my post above.

 

Perhaps not entirely accurate but our MAT have taken the view that for both simplicity and for maximum CYOB that we just keep everything for the longest period of time.

 

It may just be our environment, but the amount of data that *doesn't* have to be kept for 25 years pales into insignificance compared with that which *does*, such that to try and split out other retention periods becomes a significant administrative burden.

[mjk]

Perhaps not entirely accurate but our MAT have taken the view that for both simplicity and for maximum CYOB that we just keep everything for the longest period of time.

 

It may just be our environment, but the amount of data that *doesn't* have to be kept for 25 years pales into insignificance compared with that which *does*, such that to try and split out other retention periods becomes a significant administrative burden.

 

That's very interesting because the DfE document seems to be quite clear that only a small amount of information should be retained for 25 years. I'm genuinely interested because it would save us a lot of time if we are able to keep all information this long. Do you have any legal advice from you MAT's lawyers that you could share with the forum - it will certainly help others out!

[RS67]

Many thanks to all for your responses. My understanding is that certain aspects of the pupil record should be retained until the pupil reaches the age of 25 (e.g., SEND records), but - as a Primary School - I would expect these to be passed to the next setting when a pupil leaves, and that setting is then responsible for maintaining the record. As I can't identify any lawful basis for us to retain data around restraint/a parent who's given us lots of issues to deal with (CYOB doesn't seem to be included!), we'd have trouble justifying to the data subject/ICO.

 

I feel as though I know the IRMS toolkit almost off by heart now

[AlanD]

I can't help but think that we need clear statements from government on what we should collectively do....rather than having government abdicate any responsibility and let schools come up with their varied policies and reasons for holding or not holding on to data.

[GrumbleDook]

An insight into the DfE and IRMS sides of things.

 

The IRMS schools toolkit is fantastic and I would recommend your school’s cough up for membership (it truly is a small amount) to help contribute to the group of volunteers working on it. It really does look into where legislation affects data retention and GDPR is not going to make changes to that side of things (other than changing the name of the Act once it is finally signed off.

 

The DfE advice also covers a lot more ‘operational’ areas in consideration though ... and helps set a culture of only retaining what is needed.

 

As the DfE toolkit says, there is no single guide that covers everything right now, but it will kept evolving with advice.

[jenatddm]

I can't help but think that we need clear statements from government on what we should collectively do....rather than having government abdicate any responsibility and let schools come up with their varied policies and reasons for holding or not holding on to data.

 

Nothing changes under GDPR. You should have a legal basis for holding data now, and the same basis from 26th May.

[jenatddm]

There is a statutory 25 year retention period for pupil data regardless of format.

 

We're in the process of looking at how we manage this as we've changed DfE numbers and we have an MIS filled with old data and an MIS with current data and we're exploring what the most effective way of hanging onto that historic data is.

 

You can delete their work whenever you like!

 

There is no statutory 25 year retention period for pupil data regardless of format. For each data *type* there are no statutory periods. For *purposes* there may be. For example, processing a child's name and photograph for local press purposes does not have the same legal basis (consent), as processing it in your MIS (public authority / public task). The retention periods for each are different. But it's the same chilld's name and photo.

 

If not read already, the DfE advice could be useful; and they're accepting written feedback for next versions, until June.