Student Name and GDPR

[CommodoreS]

I have been informed that a school was advised that having a child's name on a piece of work on the school wall is breaking GDPR.

 

Does anyone know if this is true or been advised the same?

[3s-gtech]

It's so much more complicated than that, but basically it's not correct. Who can see the work? What information does it contain? A sensible amount of caution should be advised (I've seen student work with details down to phone number, parents' names etc!) but generally it's fine to display it. If it's a public area or an area shown during Parents' Evening it should be considered, but GDPR doesn't have a specific 'don't do this' policy here.

[djrscally]

I have been informed that a school was advised that having a child's name on a piece of work on the school wall is breaking GDPR.

 

Does anyone know if this is true or been advised the same?

 

It's not automatically true. Whether some piece of personal data can be displayed or not depends on a range of factors including the nature of the data itself, the level of risk that someone unauthorised will see it, the severity of someone unauthorised seeing it (I.E. what harm it might cause), the context behind the decision to display it, when it is (term time or holidays, because this changes the level of risk) and so on.

[enjay]

If the child is fostered/adopted/LAC/witness protection, perhaps don't display it.

 

Could the name label just say "by Ben, Year 9" or "by Ben A, Year 9"? Of course, even that isn't fool-proof as you probably have several children called Ben but might only have Caleb or Mercedes.

[sparkeh]

As always, its about risk. Having a child's name on a piece of work in school (barring certain circumstances) is going to be fine. What's the risk and what's the potential outcome? I can't see much risk or harm there.

 

If you have a looked after child on the other hand, who perhaps is in potential danger, there is a risk. Its possible that some might see the name and pass on that a child by that name is in your school. It might get back to the wrong person etc.

 

Something I am trying to drill into people here is that its risk, risk, risk!

[elsiegee40]

There are also things that can be done to reduce risk such as not using the child’s full name.

 

A piece of work labelled “Sophie S - 9G” or “Jake K - Robins” is far less identifiable

[enjay]

A piece of work labelled “Sophie S - 9G” or “Jake K - Robins” is far less identifiable

 

Depends on the name - we have some students with distinctive names (some very distinctive!)

[elsiegee40]

Depends on the name - we have some students with distinctive names (some very distinctive!)

 

Like I said - reduce. Common sense and risk assessment required.

[enjay]

Indeed. Of course, initials would make it even safer but probably ensure even the school community can't figure out whose work it is!

[peej2k]

I have been informed that a school was advised that having a child's name on a piece of work on the school wall is breaking GDPR.

 

Does anyone know if this is true or been advised the same?

 

Well, that's a complicated one.

First of all, as the child owns the copyright of the work produced, you need permission to use that work for display.

If you've got that, then you could and probably should pseudonymise the name by using a single name and initial for the surname, especially if its in an area that the public can regularly access.

 

I've been asked the same regarding children's names on drawers and I've suggested first name and initial would be better than removing the name entirely.

[Gongalong]

Resurrecting the thread. I've been asked the same thing but was unsure so asked the ICO Helpline. They say that if you're displaying a student's full name it's considered a disclosure, and you shouldn't be doing it without specific consent.

[GrumbleDook]

Resurrecting the thread. I've been asked the same thing but was unsure so asked the ICO Helpline. They say that if you're displaying a student's full name it's considered a disclosure, and you shouldn't be doing it without specific consent.

 

Which shows ICO still have limited understanding of schools.

 

This will be a Sir Humphrey job. It depends on how you ask the question. Ask it one way and they will say that it is a disclosure and you are the spawn of Satan for suggesting it ... ask another way and they will say that you have identified the purpose, the lawful basis, measured the risks and taken appropriate action where needed.

 

Context is everything with this, and that is why you may need to do a risk assessment.

[enjay]

you have identified the purpose, the lawful basis, measured the risks and taken appropriate action where needed.

 

And what basis would that be? Displaying work certainly isn't essential to the delivery of a public service, so do we actually have a lawful basis for displaying work? I'm sure consent could be used, I can't imagine many parents objecting to their child's work being displayed, and it would give those who had a genuine reason an opportunity to express that. I can certainly think of safeguarding contexts in which you might not want to disclose you have a particular student at the school, as well as security and privacy ones if the student/parents are celebrities for any reason.

[synaesthesia]

Nearly all student data forms I've seen specifically ask for permission covering displaying of work in this fashion - this school and both my children's schools certainly do.

Granted one of them (secondary) only just stops short of asking permission for the teacher to use my son's name out loud in the classroom, there's about 60 tickboxes!

[enjay]

Granted one of them (secondary) only just stops short of asking permission for the teacher to use my son's name out loud in the classroom, there's about 60 tickboxes!

 

I wonder if the school adheres to the requests, it must be very difficult to keep track of them. We have 4 or 5 different media use permissions, and those are hard enough to keep track of (plus the usual "fun" which happens when you tell a child they can't be in a group photo they want to be in because their parents said no!)

[dmj]

And what basis would that be? Displaying work certainly isn't essential to the delivery of a public service, so do we actually have a lawful basis for displaying work?

 

The lawful basis would happily fit within the remit of education. Displaying children's work improves their self esteem and encourages them. I really can't imagine a hefty fine for this one.

Nearly all student data forms I've seen specifically ask for permission covering displaying of work in this fashion - this school and both my children's schools certainly do.Granted one of them (secondary) only just stops short of asking permission for the teacher to use my son's name out loud in the classroom, there's about 60 tickboxes!

 

Sounds like an unnecessary bureaucratic burden that probably isn't even followed up.

 

*edit: caveat - high profile student who's wanted by the mafia. Mafia puts spies in schools, student get abducted, school gets the blame.

Edited October 7, 2020 by dmj

[Gongalong]

Which shows ICO still have limited understanding of schools.

 

This will be a Sir Humphrey job. It depends on how you ask the question. Ask it one way and they will say that it is a disclosure and you are the spawn of Satan for suggesting it ... ask another way and they will say that you have identified the purpose, the lawful basis, measured the risks and taken appropriate action where needed.

 

Context is everything with this, and that is why you may need to do a risk assessment.

In all fairness to the helpline they were very straightforward about it. We've been putting student names up on our website and social media pages, had a couple of parents query it, and so I thought it worth checking. The name is a bit of data, and because we don't have that legal basis to disclose it, we'd need consent to do it. Note this is separate to the part about displaying artwork etc., this was purely about displaying a full student name.

 

Edit: This is separate to the safeguarding aspect, which I think is more to do with the parents concerns. (Of course safeguarding and data protection do have an inherent connection)

Edited October 7, 2020 by Gongalong

[Ditto]

... (plus the usual "fun" which happens when you tell a child they can't be in a group photo they want to be in because their parents said no!)

Yes, had this at a primary when the local press were in for the year group photos. Tears, panic in the office, rapid phone calls and requests from parents to email so they have evidence, all because a parent hadn't completed a electronic form. And yes, the parent that did say no, but then were up in arms when they were excluded from the photo for the class group, because of course that didn't mean those sort of photos. I'm all for GDPR and the protection is aims to bring, but it does bring a lot of challenges.

[blueday]

Displaying full names on websites or social media is VERY different to displaying within school.

 

I also think the answers you get from the ICO very much depends who you happen to get on the helpline/chat. If you use the live chat, you tend to get generic copied and pasted answers, whereas when you talk to someone it can be more nuanced (although they still tend to sit on the fence).

 

Lawyers never agree either - some say get permission for every photo no matter where shared, but one said, no you don't need consent at all, even on website, social media etc.!!

[GrumbleDook]

And what basis would that be? Displaying work certainly isn't essential to the delivery of a public service, so do we actually have a lawful basis for displaying work? I'm sure consent could be used, I can't imagine many parents objecting to their child's work being displayed, and it would give those who had a genuine reason an opportunity to express that. I can certainly think of safeguarding contexts in which you might not want to disclose you have a particular student at the school, as well as security and privacy ones if the student/parents are celebrities for any reason.

 

And how do you know it is not part of a public service? Have you discussed with teachers why they display work that children have completed? About why they are displaying that particular child's piece of work? Is it linked with work that is going on to provide confidence to particular children? Is it in an area that may inherently have a low likelihood of those from outside of school seeing it?

 

Yes, consent could be a lawful basis ... but that doesn't mean it is the only one. And yes, even if a different lawful basis is used, there is still the right to object.

[GrumbleDook]

In all fairness to the helpline they were very straightforward about it. We've been putting student names up on our website and social media pages, had a couple of parents query it, and so I thought it worth checking. The name is a bit of data, and because we don't have that legal basis to disclose it, we'd need consent to do it. Note this is separate to the part about displaying artwork etc., this was purely about displaying a full student name.

 

Edit: This is separate to the safeguarding aspect, which I think is more to do with the parents concerns. (Of course safeguarding and data protection do have an inherent connection)

 

Website and social media is different to a school display. I get what you are saying, it is just the blanket "it is a disclosure to do it" that I have an issue with ICO saying.