Safeguarding information and GDPR

[mjk]

Suppose our college data retention policy states that email is kept for 12 months and internet logs are kept for 3 months.

Safeguarding information is kept until the childs age is 25 based upon historic 19yrs old + 6 (I understand this could be much longer and keeping the data for 35ys is acceptable).

 

Our DSL has been advised that all suspected safeguarding information must be recorded as such, but if it is investigated not to be safeguarding information would be within our rights to hold the data ?

 

In the hypothetical situation, somebody 'catches' a child searching for a safeguarding trigger word eg 'suicide'.

Should this be recorded as a safeguarding incident if it is a false positive?

 

Please discuss

[synaesthesia]

No, absolutely not IMO. Otherwise PSHE lessons will lead to entire cohorts having false positives flagged up because they're researching teenage pregnancy, contraception, drugs, racism, suicide etc etc.

[GrumbleDook]

Your logs / filters are step one. Information may be processed automatically be step two, recording as data of interest or to be sectioned, is done via the relevant safeguarding / behaviour system ... and that is a human decision. That data is then kept for the relevant and longer period.

 

Emails and logs should not be used for long term retention. If you are then you need to look at retention facilities that are commercially available and do this properly.

[mjk]

Your logs / filters are step one. Information may be processed automatically be step two, recording as data of interest or to be sectioned, is done via the relevant safeguarding / behaviour system ... and that is a human decision. That data is then kept for the relevant and longer period.

 

I think this is the issue, that the human processing is done by the IT dept and the training we were given is simply to refer any issues to the safeguarding team. The new process (MyConcern) means that ALL data we forward to them is kept for a long period. MyConcern tell us that the data cannot be deleted. To my mind this could become a GDPR issue. DSL is happy that we publicly say we might hold internet content and email data for a longer period, but I've not heard back from DPO if this is acceptable.

[WelshOne]

You might be interested in an article we have posted about this exact issue. https://www.myconcern.co.uk/data-protection-v-child-protection/

 

Admin - please delete if not allowed but thought it relevant.

[GrumbleDook]

You might be interested in an article we have posted about this exact issue. https://www.myconcern.co.uk/data-protection-v-child-protection/

 

Admin - please delete if not allowed but thought it relevant.

 

I’ve just been reading this on my way home from holiday and was going to point folk to it.

 

I’ve continued the discussion from other threads around safeguarding and data protection, and retention is another aspect.

 

The important thing to always ask yourself is “what data do we need?” If that is something for a long term reason then you ask yourself to justify the limits, if you find there are legislative reasons or cases giving credence to your actions, then you have your answer ... but be prepared to justify it.

[mjk]

You might be interested in an article we have posted about this exact issue. https://www.myconcern.co.uk/data-protection-v-child-protection/

 

Thanks. I think MyConcern really does need a way of deleting data that is not related to safeguarding.

I appreciate we can keep non safeguarding data for a long time if we chose to, but we also have to inform parents and students that we are doing it, which causes issues in itself. One of the reasons we want to delete irrelevant data is also to lower the running costs of the organisation and simplify Subject Access Requests. I think it is difficult to justify we we are keeping the fact that a child searched for a 'kermit suicide' meme when they were 11yr's old if an investigation concluded it was innocuous, and the IT team had been over-cautious in reporting it via myconcern. The ability to delete certain data in Myconcern would be a benefit to schools and myconcern alike.