Pupil Calendars.GDPR

[MrBitey]

Hi all

 

This is probably a really silly one and I feel like I am maybe being too picky/inflexible so I thought I'd share here.

 

Our PTA is organising a special calendar to be sold at Christmastime. All of the children and staff in the school have drawn a self-portrait with their name on.

Each month of the calendar will have the self-portraits of the children who have a birthday in that month.

 

So. The PTA asked the school office for a set of class lists with dates of birth for all of the children.

Initially these had first names/surnames and dates of birth. They wanted to take these home to organise the pictures.

I said no to this as I don't want that info leaving the school.

 

They then asked if they could just have first names and months of birth to do the organising. This seems fairly reasonable.

However, the problem I have with this is that we are using data we have collected for one specific set of reasons (ie SIMS/statutory school functions) for another unrelated reason (ie passing to the PTA so they can pass it to the calendar printers). We are also putting some (albeit very limited) information into the public domain - namely, first name and month of birth.

 

I feel that we are ok to put that info on the calendar but that we need to get permission to do this from each child's parents. We can easily ask for permission using a 'Parentmail' form. The powers that be don't seem to want to do this as it's extra work for the office staff. PTA aren't happy and I feel like I'm being a jobsworth.

 

Hivemind, what do you think?

[sigma]

I think you should get parental permission for the reasons you state.

[deano3693]

I agree with my DPO hat on - Parental Permission required. It's an extra job for a member of the Admin team but that's far safer than the consequences of a parent complaining to the ICO etc.

[GrumbleDook]

Partly agree with all the above that parental consent is needed ... however ...

 

This is transfer to a separate data controller for a non-statutory reason ...

 

Nope. Get them to collect the information and consent.

Edited October 12, 2018 by GrumbleDook

[sigma]

Partly agree with all the above that parental consent is needed ... however ...

 

This is transfer to a separate data controller for a non-statutory reason ...

 

Nope. Get them to collect the information and consent.

 

Wondering if all parents are automatically members of the PTA and all communications are blanket "Dear parent" or if the PTA maintains membership lists and corresponds as "Dear Mr and Mrs X". In the latter, the PTA needs to be registered in it's own right but in the former it's probably unnecessary save for this exercise. Schools also need to consider if they host the PTA on their own website, which type of PTA it is and ensure that the school's website privacy policy takes this into consideration.

 

That said, I agree with Grumbledock. Let the PTA do the work and register if they have not already done so. It is not their place to generate extra work for what is likely to be an already overpressed school office even if it is well intentioned.