Pupil Data Collection and GDPR

[sarahstacey]

Good Morning,

 

We have, in the past, sent printed sheets home detailing the contact details etc of pupils for parents to amend and send back.

 

I am a bit nervous of doing this again with regards to GDPR. We are not a SIMS school so cannot use the app.

 

How do other schools deal with this?

 

I have seen the use of google forms mentioned, has anyone used that method?

 

Any guidance would be great, many thanks

 

Sarah

[Jawloms]

You do it the same way you always have and make sure it's in an envelope.

[Oaktech]

We just send blank forms with spaces for all the required information and leave it up to the office staff processing to determine whether information provided is new/updated.

[PD1279]

I would do the same as 'Oaktech'

Send a form with blanks for the Childs name & missing information, then you are covered as you have not sent any Pupil data out from the school. Until they hand the form back to you/the office they parents are liable for the information and get the teachers/office to use a tick sheet for when it comes back, like a register abeit a large one :-)

[jmak]

If you ask parents whether anything has changed, they'll almost always say no. Best to ask for everything from scratch.

[enjay]

Blank forms would be an enormous admin overhead to process when they come back. Also, where does the liability lie if a parent has put a new medical condition or contact number on the form but the school fails to act accordingly because the information hadn't yet been uploaded to SIMS?

[sarahstacey]

Thank you all for your comments, I like the idea of a blank form but as enjay said it would be a huge task for our admin staff.

I did see somewhere a suggestion that parents are asked to review their details during parents evening. We may go with that and just send forms to those that do not attend.

[DSapseid]

Could you use a google form and then do an export of the data from your MIS and then use the formatting tools to highlight any cells that dont match.

 

eg: column 2 is parent name from google, column 15 is parent name from mis and then get it to match the data between col 2 & 15 and highlight red if different.

 

I know this might throw up some spelling or space differences but i suppose you could split the boxes to forename, surname on both.

[localzuk]

GDPR is not something that is supposed to prevent your organisation operating - just because it exists does not mean everything you do must change. To me, this is one of those times. There is nothing wrong with sending home a data checking sheet like normal. The only change I would make is ensuring it is in an envelope when it is handed to the child to take home.

[enjay]

GDPR is not something that is supposed to prevent your organisation operating - just because it exists does not mean everything you do must change. To me, this is one of those times. There is nothing wrong with sending home a data checking sheet like normal. The only change I would make is ensuring it is in an envelope when it is handed to the child to take home.

 

Student post is notoriously unreliable though. Also, I once found printed a data collection sheet in the playground where a child obviously dropped it (before you say to put it in an envelope, this was the completed one coming back)

[localzuk]

Student post is notoriously unreliable though. Also, I once found printed a data collection sheet in the playground where a child obviously dropped it (before you say to put it in an envelope, this was the completed one coming back)

These are risks, yes, but there are risks with any solution - if you use an electronic solution, the method of signing up could be breached etc... Schools have used data checking sheets in this way for decades, and I am yet to hear of any significant issue with them.

 

Realistically, its 2018, schools should all have an MIS solution of one form or other, and as far as I know there are electronic solutions to this for pretty much all of them. I'd say speak to your MIS provider and ask what solutions are available.

[sigma]

Student post is notoriously unreliable though. Also, I once found printed a data collection sheet in the playground where a child obviously dropped it (before you say to put it in an envelope, this was the completed one coming back)

 

Once the parent has received the form, it is their responsibility to get it back to you and therefore the returning data in transit is not your problem.

[enjay]

Once the parent has received the form, it is their responsibility to get it back to you and therefore the returning data in transit is not your problem.

 

Given how Morrisons have been made to pay out after an employee with legitimate access to data chose to misuse it (http://www.edugeek.net/forums/data-protection-information-handling/200271-morrisons-appeal-data-breach-ruling.html) I don't share your confidence the school would be blameless if a sheet printed by the school were later mishandled by the parent or child.

[localzuk]

Given how Morrisons have been made to pay out after an employee with legitimate access to data chose to misuse it (http://www.edugeek.net/forums/data-protection-information-handling/200271-morrisons-appeal-data-breach-ruling.html) I don't share your confidence the school would be blameless if a sheet printed by the school were later mishandled by the parent or child.

The major difference there would be that it affected 100,000 people. Any data controller should have something in place to prevent the easy download of all that data without secondary controls etc...

[Bigbird7]

Many schools are now facilitating this on a parents evening, that way the forms never leave the school. You won’t get everyone but it’s a more reliable way of updating as many details as possible.

[enjay]

Many schools are now facilitating this on a parents evening, that way the forms never leave the school. You won’t get everyone but it’s a more reliable way of updating as many details as possible.

 

We're looking at this option too, which is what we did at my last school.

 

It is a real shame the access code for the SIMS Parent App can only go out via email. We've had some instances of mis-keyed email addresses, so I would prefer to send the codes via a more secure/trusted method. If we could physically hand the codes to the parents, or even to the children, I'd be happier. I wonder why Capita made it email only not printable.

[sigma]

Given how Morrisons have been made to pay out after an employee with legitimate access to data chose to misuse it (http://www.edugeek.net/forums/data-protection-information-handling/200271-morrisons-appeal-data-breach-ruling.html) I don't share your confidence the school would be blameless if a sheet printed by the school were later mishandled by the parent or child.

 

Its quite different. The Morrisons case concerned an employee mishandling other people's data. Once a data collection sheet has arrived in a sealed envelope to a parent, it is most unlikely that a school could then be responsible for a parent mishandling their own data.

[jmak]

The two checks we have for email addresses now are:

 

1) From the admissions team (or ATF for us) - if the email on there is incorrect, the offer of a place at the school wouldn't have reached the parent.

2) On our parents evening booking system. You can either validate against it, in which case the parent wouldn't be able to book an appointment and would hopefully get in touch, or you can have them fill it in, in which case you get a copy of it in a report.

[deano3693]

We use Edulink One provided by Overnet Data and they have a Data Collection feature which we are in the process of rolling out currently.

[Love_Sausage]

Print the sheet out with an address and use a window envelope. We had an issue with the wrong sheet going in an addressed envelope, self reported to ICO and they were happy with this being a straightforward, sensible solution.

[AndrewSharp]

As others have pointed out, the risk to data in transit is likely to be one pupil at a time with a paper system, but bear in mind also that keeping records on paper makes it harder to protect the information against accidental loss and harder to ensure that you know what information you hold and where. There's a risk of duplicate records getting out of step and of difficulty in responding to an access request.

 

Whatever route you end up choosing, keep a record of how you reached the decision by considering the risks and methods to address them and seek advice from your Data Protection Officer.