Who is the data controller?

[Bigbird7]

In a maintained community primary school where the LA is the legal employer and determines things such as who the school uses to run it's payroll, who is the data controller? Is it the school, the LA or are they joint data controllers? Im thinking of a particular scenario where there is a breech involving pay slips and who is responsible for reporting that breech.

[GrumbleDook]

It is the legal entity ... in this case, the school.

 

The LA are a Data Processor, following instructions given by the school.

[Bigbird7]

It is the legal entity ... in this case, the school.

 

The LA are a Data Processor, following instructions given by the school.

 

That was my view too. What I can’t get my head around is that the school has no choice but to use whoever the LA says for particular services, such as payroll. It is therefore not determining the manner of processing

[GrumbleDook]

Where there is no choice whatsoever (and you’ll be surprised about getting choice ... it is not always as cut and dried as the LA tells you) then you have the option of Joint DC, but a Data Sharing Agreement between you covers who does what with what, etc.

[sparkeh]

such as payroll.

Just on that point, I’m pretty such that’s not true and schools are free to choose whatever payroll service they want. On a wider point it’s worth checking out where you stand with this kind of thing as you need to know what services the school is buying into by choice. Of course the LA is not going to correct any misconceptions about what schools think that they are obliged to use [emoji6]

[Bigbird7]

Just on that point, I’m pretty such that’s not true and schools are free to choose whatever payroll service they want. On a wider point it’s worth checking out where you stand with this kind of thing as you need to know what services the school is buying into by choice. Of course the LA is not going to correct any misconceptions about what schools think that they are obliged to use [emoji6]

 

I think you are probably right they are free to choose, but I get the impression that many don’t realise it.

[elsiegee40]

Just on that point, I’m pretty such that’s not true and schools are free to choose whatever payroll service they want. On a wider point it’s worth checking out where you stand with this kind of thing as you need to know what services the school is buying into by choice. Of course the LA is not going to correct any misconceptions about what schools think that they are obliged to use [emoji6]

Very common misconception with primary schools on particular. They don't have the manpower to do it themselves or the business manager with time to argue with the LA. These arrangements were made decades ago as am easy solution for the LA schools that was undoubtedly intended to save costs. To be fair on the primaries that are aware, they do also have to consider whether changing from the LA is worth the upheaval.

 

The LA, desperate to earn as much income as possible, is not going to disabuse anyone of this idea... and, in some cases, there are probably LA staff who don't realise the school can actually change of they wish.

[jmak]

We're a maintained school and there's no way it would be sustainable to employ sufficient staff to run HR properly. We're technically employed by the LA, but all of our HR is outsourced to a third party supplier and as far as I can tell, most of the local primaries do the same.

 

When it's a third party, it's possibly easier to see that they're only a processor. The data is collected/created by the school. Although technically employed by the LA, they don't interview, recruit, set salaries or job descriptions or run payroll. This would be the same if administration of payroll etc was outsourced to any provider, including the LA.

[enjay]

As others have said, in this instance you're joint controllers at best, probably you're the controller and LA are processor but I'm not sure on the ins and outs of how maintained schools interact with LA (we're an Academy).

 

One question though - if you're able to answer, what was the breach / where did it occur? Did it occur as a result of LA action or school action? E.g., if LA securely delivered payslips to the school and then someone at school left them lying around, that is the school's breach; if LA put the payslip in the wrong envelope, that's the LA's breach. Still your ultimate responsibility, but you can possibly pass some of the blame/liability on to them.

[Bigbird7]

One question though - if you're able to answer, what was the breach / where did it occur? Did it occur as a result of LA action or school action? E.g., if LA securely delivered payslips to the school and then someone at school left them lying around, that is the school's breach; if LA put the payslip in the wrong envelope, that's the LA's breach. Still your ultimate responsibility, but you can possibly pass some of the blame/liability on to them.

It's a hypothetical one based around something that happened in the past and came up in a discussion around a DPIA for the current system. The LA process the payroll, then print and deliver payslips to school via Royal Mail(!), on one occasion these were lost and never found. This would now be a reportable breech hence the original question on who is the data controller and therefore responsible for reporting to the ICO.

 

As a side note the process of going through the risk assessment has made the school think about it's practices and will hopefully get the LA to improve it's systems or perhaps look elsewhere

[AndrewSharp]

Your payroll processing agreement with the LA should state clearly whether they see themselves as Processor or joint Controller. In the hypothetical scenario mentioned, printed payslips lost in the pos to the school, data was in transit when lost and the schools is the party able to detect the loss and, as controller, would need to log this and decide whether to report to the ICO based on the risk to individuals. If the LA became aware of a breach then, if they're your Processor, they must report this to the school as Controller.