Special category data policy

[Bigbird7]

We have covered special category data in our data protection policy, with details of what we process, our legal basis, retention, etc and extended this way beyond what is defined as special category to include all of the sensitive data we process (FSM, PP, etc). This is also covered in plain english on privacy notices. I've heard that following an ICO audit a school has been advised that it needs a separate policy for special category data, I don't know if the school had covered it in it's DP policy or not. Has anybody come across this, and if so does anybody have a policy I could have a look at.

[Ditto]

We cover special category data within our Data Mapping but in terms of the schools published statements, it isn't currently called out, but we have draft privacy notice that is being worked on that does reference it. Our 'Friend's of ...' refers to Medical Data as special category from a health risk point of view - nut allergies etc. for cake sales. They state they require explicit permission to use that data. Personally I'm not so sure they do, but the whole School to 'PTA' or 'Friends' of ...' is another can of worms which warrants its own thread. It would be fantastic to access an ICO audit - are they available in the public domain? It would be great to audit ourselves against any school audit.

[Bigbird7]

We cover special category data within our Data Mapping but in terms of the schools published statements, it isn't currently called out, but we have draft privacy notice that is being worked on that does reference it. Our 'Friend's of ...' refers to Medical Data as special category from a health risk point of view - nut allergies etc. for cake sales. They state they require explicit permission to use that data. Personally I'm not so sure they do, but the whole School to 'PTA' or 'Friends' of ...' is another can of worms which warrants its own thread. It would be fantastic to access an ICO audit - are they available in the public domain? It would be great to audit ourselves against any school audit.

 

The recommendations from an ICO audit are available in the DfE toolkit Annex 8.1 https://www.gov.uk/government/publications/data-protection-toolkit-for-schools

[jonathan.lees]

The DPA 2018 Schedule 1 part 4 requires an appropriate document in place if you are using one of the exclusions for processing special category data in Schedule 1 part 2. Since all schools process ethnicity as required by the DfE and also provide counselling services, these aren't covered under GDPR article 9 but you can use Schedule 1 part 2 as a legal basis. The ICO can ask for this document. Happy to share my one in a PM if interested.. Edited September 17, 2018 by jonathan.lees

[jonathan.lees]

This might be worth a read if you've time https://ico.org.uk/media/for-organisations/documents/2258303/ico-introduction-to-the-data-protection-bill.pdf - Schedule 1 part 2 - processing in the substantial public interest and part 4 (page 23) Appropriate documentation and additional safeguards