So I have my lawful basis but were do I find the relevant legislation?

[pmp4]

Bit of a long shot and this may not be appropriate for this forum.

 

I am writing my Privacy notices and I have come up with the ;awful basis I need to process the data. The thing is, where I have chosen a lawful if legal obligate, I have to say what the legal obligation is. where do I find this?

 

TIA

[jdoyle]

might be of help.

 

http://www.edugeek.net/forums/data-protection-information-handling/185580-data-protection-information-handling-resources.html#post1638574

[pmp4]

You are a star.

 

Thank you. I will have a look.

[garbage46]

This is what I put in our privacy notice for parents/carers:

 

Our legal basis for using this data

We only collect and use pupils’ personal data when the law allows us to. Most commonly, we process it where:

• We need to comply with a legal obligation

• We need it to perform an official task in the public interest

Less commonly, we may also process pupils’ personal data in situations where:

• We have obtained consent to use it in a certain way

• We need to protect the individual’s vital interests (or someone else’s interests)

Under the General Data Protection Regulation (GDPR), the lawful bases we rely for processing information will be:

Article 6 Paragraph 1

(a) the data subject has given consent to the processing of his or her personal data for one or more specific purposes;

© processing is necessary for compliance with a legal obligation to which the controller is subject;

(d) processing is necessary in order to protect the vital interests of the data subject or of another natural person;

or

(e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller

In addition, concerning special category data:

Article 9 Paragraph 2

© processing is necessary to protect the vital interests of the data subject or of another natural person where the data subject is physically or legally incapable of giving consent;

 

(g) processing is necessary for reasons of substantial public interest, on the basis of Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject;

 

(j) processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) based on Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject.

Where we have obtained consent to use pupils’ personal data, this consent can be withdrawn at any time. We will make this clear when we ask for consent, and explain how consent can be withdrawn.

Some of the reasons listed above for collecting and using pupils’ personal data overlap, and there may be several grounds which justify our use of this data.

 

Data sharing

We do not share information about pupils with any third party without consent unless the law and our policies allow us to do so.

Where it is legally required, or necessary (and it complies with data protection law) we may share personal information about pupils with:

• Our Local Authority – to meet our legal obligations to share certain information with it, such as safeguarding concerns and exclusions

• The Department for Education (DfE)

• Our Multi-Academy Trust (MAT)

• The pupil’s family and representatives

• Educators and examining bodies

• Suppliers and service providers – to enable them to provide the service we have contracted them for

• Health authorities

• Health and social welfare organisations

[Edutech98]

This link may also be useful, its a copy of the GDPR cross-referenced with the recitals which give you the context of the articles and further explanations.

 

Lawful bases is under Article 6.

 

https://ico.org.uk/media/about-the-ico/disclosure-log/2014536/irq0680151-disclosure.pdf

[pmp4]

Thank you guys. Much appreciated.