SIMS - 'Other' Student contacts

[ataylor]

My data manager has raised a question about our admissions form, currently the admissions form has a field for 'other' contacts that parents can add. This might be a close neighbour or a family friend, this person could be potentially unaware that this information has been put on the form by a parent and thus we would be holding data on people without their consent.

 

I assume adding a field for a signature on our admissions form from said person would solve this issue but is this necessary? This would also complicate our parent platform as they are also allowed to add contacts on there.

Edited November 16, 2018 by ataylor

[howartp]

We just reduced from asking for 4 contacts to asking for 2 contacts, following a GDPR training session our DPO went on.

 

Our form is online so we can’t take signatures; not sure what we’re doing about that yet but we have recently fallen foul of the situation with someone not knowing they were a contact.

 

Parent 1 gave their friend (also a parent - parent 2) as contact.

Parent 2 as well as their own child is step-parent of child 3, so our own rules require us to tick a UDF to allow Parent 2 access to Child 3’s reports etc.

 

 

Unfortunately that also gave Parent 3 access to Parent 1’s child because the logical rules all matched. They complained why they could see this child as they didn’t know mum had named them as a contact.

[David44]

In your example, surely Parent 3 shouldn't have parental responsibility for Parent 1's child? Why aren't you using the parental responsibility field to determine who sees reports etc. rather than a UDF?

[ataylor]

We use priority field for the order of who we should contact first and parental responsibility for who gets access to information remotely.

[howartp]

In your example, surely Parent 3 shouldn't have parental responsibility for Parent 1's child?

Correct.

 

We have several split families where the separated parent, usually the Dad, does not have parental responsibility - and therefore we don't tick that box - but Mum or the court has granted them rights to log onto our Parent Portal and see attendance, behaviour, reports.

 

Only Priority 1 parents get access to the Portal by default.

 

We have a UDF for "override priority" which means a separated parent in P2 or P3 can be given access without making them P1.

 

Sadly in this case, Parent 2 had "override priority" for their step-child, but the UDF is global for the parent so it also gave them override for Parent 1's child.

[Bigbird7]

Contact is obviously very different to access to the child’s data which should be controlled by knowing who has PR.

 

With regard to the original question it would be unmanageable to get consent from the additional contacts. Our solution was to add some wording on the data collection form to put the onus on the parent completing the form to ensure that they had told the contacts that their details were being passed to the school and why. We reduced the data we were collecting to just a name and mobile number. We also reduced the number of contacts we were asking for. It’s not a perfect solution but we’ve reduced risks as best we can.

[AndrewSharp]

GDPR Article 14, which covers information to be provided when data is processed which was not obtained direct from the data subject, sets out what you should notify to the "other contact" so that they become aware that you're holding about them.

 

If the contact details include an email address, this would be relatively straightforward and you could point them towards your privacy notice to explain what data you hold and why. A text message with a link to the privacy policy might also be practical for mobile numbers without email too. The nominated contacts then wouldn't be surprised to get a call or message from the school when it's important and will know that they need to keep their details with you up to date.

 

The provisions don't apply where the data subject already has all the information required, which you might hope the parent has conveyed to them when they agree to be an emergency contact, but I wouldn't rely on that if it's practical to provide a privacy notice.

 

Nobody seems to be doing this yet, though - I've not had a single Article 14 notice personally and I don't believe that there are no organisations who hold data not collected from me.

[GrumbleDook]

Nobody seems to be doing this yet, though - I've not had a single Article 14 notice personally and I don't believe that there are no organisations who hold data not collected from me.

 

I’ve had a few but they are non-school environments (emergency contacts for work or medical contacts) which has been interesting to see.

 

It’s been interesting to see where safeguarding and data protection overlap here ... where parents are agreed contacts for taking children home and so on. This has been a frequent question from some of our schools ... and it is interesting to see in other forums how some schools don’t have any formal record of where agreements are

in place to have parents of other children can take certain children home. @elsiegee40 ... something to chat about soon.

[enjay]

This is on my list to discuss with HT and DPO.

 

A related thing to consider is what information might you be giving to the non-resident parent? For example: Mr and Mrs A get divorced but both are P1 contacts in SIMS for Child A. Mr A moves out and Child A remains living with Mrs A. Mrs A later remarries and becomes Mrs B. As Child A now lives with Mr B, it is entirely reasonable Mr B would also be a P1 contact for Child A. As P1 contacts, Mr A and Mr B can now see each other's contact details. You probably don't want that to happen.