Sharing dietary requirements with catering company

[enjay]

We've been discussing sharing information about dietary requirements - allergy information, Halal, etc. - with our catering company. This is special category data so we'd need consent (please correct me if I'm wrong on either of those statements). There's a part of me that thinks the logistics of that don't merit the work involved so just giving the caterers broad information, e.g. letting them know how many gluten-free or Kosher meals are required but not saying for whom, and leaving the children to ask for their specially-prepared meals (assuming they can't eat from the menu anyway, that is).

 

Thoughts?

[FN-GM]

I don't see why there needs to protected in any way. A meal isn't personal data. Just make a list of required meals for the company without any names. When it comes to eating it I am sure people will know what they have ordered.

 

IE: Don't use personal data and there won't be any problems.

[enjay]

I don't see why there needs to protected in any way. A meal isn't personal data.

 

A meal isn't personal data, but the medical information (nut allergy) or religious information (Halal) are personal data.

[FN-GM]

A meal isn't personal data, but the medical information (nut allergy) or religious information (Halal) are personal data.

 

My point is you don't need to associate that with a person. Just order a list of required meals and don't give them any names. The catering company don't need to know the name of the people who are eating the food. When you order a takeaway you don't let them know who is eating what meal.

Edited October 25, 2018 by FN-GM

[Bigbird7]

If the catering company provide the service directly to the children, as is the case in many schools, then there would be a need to associate the medical information with the child

[enjay]

If the catering company provide the service directly to the children, as is the case in many schools, then there would be a need to associate the medical information with the child

 

I don't think I understand what you mean. Could you clarify please.

[Bigbird7]

I don't think I understand what you mean. Could you clarify please.

 

Apologies! In lots of schools in my area the catering company not only provides the food but also the staff to serve it. If that's the case then those staff need the allergy information.

[christhetech]

FN-GM is absolutely spot on with his answer. The catering company don't need to know who will be eating the meals, just how many they need to prepare.

If you are requesting 1,000 meals, with 10 of them Kosher, 50 Gluten Free, 30 Halal, and a further 30 for people with nut allergies, you have not given the catering company any personally identifiable data there, just the very basic information that they require in order to deliver the service for which they are being paid. They don't need to know any more than that. If you treat GDPR as information given on a NEED TO KNOW basis, you won't go too far wrong. Generally speaking, if somebody requires PII, they will have a specific reason for requiring the information. As long as you are not handing over more information than the requester actually NEEDS to perform their duty, then you are normally ok. I always challenge any request for PII and find out the reason for the request, what the requester is going to use the data for, how they will store it and for how long, how they intend to use it, and what they will do with the data when they are finished with it to ensure that I am not handing over any more than is absolutely required to complete the task for which it is intended and ensure that we have an absolute undertaking from the requester that any data provided will not be at risk of falling into the wrong hands.

[enjay]

Apologies! In lots of schools in my area the catering company not only provides the food but also the staff to serve it. If that's the case then those staff need the allergy information.

 

One could counter-argue the catering staff don't need to know the specifics, as the student should be responsible for asking about ingredients or requesting their specially-prepared meal.

[hardtailstar]

One could counter-argue the catering staff don't need to know the specifics, as the student should be responsible for asking about ingredients or requesting their specially-prepared meal.

 

Not sure what type of school @enjay works at but can counter argue that and say that a lot of primary kids would probably not know what they eat and just pick up the food for everyone.

 

I know this happened a lot with the primary I used to work at.

[Katy]

We've got the same thing being discussed at the moment, although I'd have expected something like "legitimate interest" to apply for sharing the name and allergy details, to the contracted catering company providing meals for children? (Or as it's contracted out, the one about contracts?)

 

Don't know really, maybe we will have to get a tick box to share food allergies with the catering company on our consent forms. But then what happens if somebody dies over an unticked box?

[enjay]

Not sure what type of school @enjay works at but can counter argue that and say that a lot of primary kids would probably not know what they eat and just pick up the food for everyone.

 

I work for a secondary school, I totally agree primary students couldn't be expected to self-manage their allergies.

 

Don't know really, maybe we will have to get a tick box to share food allergies with the catering company on our consent forms

 

Since the responses in this thread were both "yes" and "no", I asked our DPO. They said even though this is special category data, the parent would expect us to share the information therefore we probably wouldn't need specific consent. I think that covers it, but I'd feel happier if their response hadn't included the word "probably"!

[Opendium_Steve]

I always challenge any request for PII and find out the reason for the request, what the requester is going to use the data for, how they will store it and for how long, how they intend to use it, and what they will do with the data when they are finished with it to ensure that I am not handing over any more than is absolutely required to complete the task for which it is intended and ensure that we have an absolute undertaking from the requester that any data provided will not be at risk of falling into the wrong hands.

 

And indeed, if you're handing over PII to another company, you need a data processing agreement with them that establishes exactly the things you mentioned.

[GrumbleDook]

The catering company are a Data Processor of the school and, as such, there should be a Data Sharing Agreement in place (within the contract, T&Cs or as a separate document) ... and they process what is agreed by the school.

 

Where catering and medical data is needed then remember the following ...

 

1) the catering staff need to be able to tie the child to the allergy. They are front line when it comes to making sure children do not eat food that could harm them. If they not know, then problems occur.

 

2) choosing the Lawful Basis depends on the type of data and the purpose. For special category personal data you need a reason from both Article 6 and Article 9.

In this case you could look at Legal Obligation (H&S), Public Task (Safeguarding of children) or even Vital Interests ...

 

For article 9, you would look at 9.2© (Vital Interest) or 9.2(g) (Substantial Public Interest) in all likelihood. You could always use Explicit Consent, but that probably is not the best option.

 

3) it is a risk assessment. Not everyone in the catering firm will need to know the information so ask what safeguards are in place so that only key people have and use it.

[enjay]

For article 9, you would look at 9.2© (Vital Interest) or 9.2(g) (Substantial Public Interest) in all likelihood. You could always use Explicit Consent, but that probably is not the best option.

 

Thanks @GrumbleDook I wasn't sure about 9.2© as that says "processing is necessary to protect the vital interests of the data subject or of another natural person where the data subject is physically or legally incapable of giving consent" and our students are legally capable. Substantial public interest fits, though.

 

1) the catering staff ... are front line when it comes to making sure children do not eat food that could harm them. If they not know, then problems occur.

 

I don't think I agree with that for secondary children, and I know our SBM doesn't agree. Any secondary-age child* with an allergy should take responsibility for asking about ingredients themselves, I don't think it is down to the catering staff to ensure they eat safely, and it certainly shouldn't be the catering staff's job to ensure compliance with vegetarian or religious preferences.

 

* with exception of those students with profound learning difficulties, etc. for whom special provision could be made

[GrumbleDook]

H&S will not allow you to completely put off a risk to health to others.

 

Minors can increasingly take on responsibility but not own the whole risk.

 

Also remember that should a child suffer from anaphylaxis then the first responder may be one of the kitchen staff.

[enjay]

H&S will not allow you to completely put off a risk to health to others.

 

So if I go to a restaurant and eat dairy or meat, that's the restaurant's fault? Madness.

 

Also remember that should a child suffer from anaphylaxis then the first responder may be one of the kitchen staff.

 

Not here, but I concede some schools would need to factor that into the decision.

[GrumbleDook]

So if I go to a restaurant and eat dairy or meat, that's the restaurant's fault? Madness.

 

A) you are not a minor and b) this is why the type of data and purpose for processing matters.

 

There are different risks when processing different types of data. The DPIA might say it is more efficient / effective to deal with it all at the same (i.e. often the most restrictive) level and methods ... and that will differ from school to school, restaurant to restaurant.

 

In the case of allergies, there is a risk to health (often a risk to life) and H&S will day you need to apply ALARP... and has a large effect on what processing takes place. If there is a need to process data and you have lawful basis (in this case Art. 6 could be considered Legal Obligations to comply with H&S laws) then you do so.

 

It is not a surprise that H&S and Data Protection are heavily based on risk assessments and have to take into account a lot of other laws / statutory guidance.

[enjay]

A) you are not a minor and b) this is why the type of data and purpose for processing matters.

 

True, but the point stands the same - if a 15-year-old went into a restaurant and ate something they react to or religion dictates they shouldn't, that's not on the restaurant.

[GrumbleDook]

True, but the point stands the same - if a 15-year-old went into a restaurant and ate something they react to or religion dictates they shouldn't, that's not on the restaurant.

 

The restaurant is not a public body with a duty of care.

 

The school is and they work with external parties (in this case the caterers) to deliver this.

[Katy]

True, but the point stands the same - if a 15-year-old went into a restaurant and ate something they react to or religion dictates they shouldn't, that's not on the restaurant.

If they go in and say "I'm allergic to peanuts" and get sold food containing peanuts, that'd be on the restaurant though?

 

Pupils (or parents) have a contract with the school which includes data such as food allergies, it's not for the pupil to have to think "is this in-house catering or outsourced? Do I need to tell them my allergy daily when it is already on the data held by the school?"

[enjay]

Pupils (or parents) have a contract with the school which includes data such as food allergies, it's not for the pupil to have to think "is this in-house catering or outsourced? Do I need to tell them my allergy daily when it is already on the data held by the school?"

 

Hmm, fair point.

 

But on the positive side, from this thread and conversation with our DPO, it would appear consent for sharing is not required despite it being special category.

[AndrewSharp]

GDPR Article 9(2) provides that special category data can be processed for the purposes of preventive medicine in some cases - that might apply here, but check with your DPO.

Vital Interest can only be used when the data subject is incapable of giving consent, so doesn't fit this situation as the parents could give consent in advance.

If in doubt, do a Data Protection Impact Assessment to record how you will share the data and how it will be protected and to record how you reached a conclusion. Make sure that this provision of data and requirement to protect it is reflected in the contract with the caterer. Check also that use of data in this way is included in your privacy policy too so that parents know how you will use it.

Edited October 29, 2018 by AndrewSharp