Collecting/Checking non-parent contact info for SIMS

[MrBitey]

Hi all,

 

We've been having an interesting chat in the Office just now.

They are about to send out forms checking the info that we have on SIMs re. contact details etc. is correct.

 

Now, I noticed that we store 'emergency' contact info (name, address, telephone number) for non-parents.

These are the 3rd or 4th contact details associated with children.

Often these are friends, neighbours etc.

 

This info was originally on forms filled in by the parents.

I feel that we need to contact these individuals themselves to check that their addresses, phone numbers etc are correct rather than sending the form to the child's parents to check. After all, we are processing data about individuals and therefore need permission to do so.

 

Or is these some exemption in this case?

 

What do we think DP hive-mind?

Edited December 11, 2018 by MrBitey

[bobsmith]

Interesting, I was tending to think along the lines that the person who filled the form in had sought the permission of that individual.

 

The other thing I would consider is the principle of least data held to get the job done, for a 3rd contact that could just be a name and a phone number.

[MrBitey]

Yes, I guess if we just have Name and telephone number we could check that by phone (hopefully there are not too many!)

The query initially came up as we have details for a pair of parents who are not allowed to know each others' addresses. The office noticed this before the standard SIMS generated form (which had both sets of details on it) went out! So I am looking into setting up a new procedure to make sure everything is checked in a way which gets a thumbs up for safeguarding, data privacy and ease of implementation!

[AndrewSharp]

GDPR (Article 14)says that you should notify people from whom you did not obtain data directly about what you hold and why - broadly the same kind of transparency notice that you would provide to a data subject when collecting data, plus details of the source of the data. Contacting them regularly to check accuracy would also be a good test that ensure you have up to date information which will work when really needed.

 

ICO guidance: https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/right-to-be-informed/

 

Worrying to hear that the SIMS default is to share personal data with all primary contacts and that it took school office intervention to protect against what could have been a very serious breach. That needs analysis and remediation. You might log it as a near miss breach and then review how to minimise the risk, perhaps via a Data Protection Impact Assessment.

Edited December 11, 2018 by AndrewSharp

[Sylv3r]

We only issue a blank template to all parents and let them fill the information in - we no longer provide a data collection form with the information we currently hold incase the information goes missing !

 

Hadn't really thought about the notifying the third and fourth contacts to seek their permission to store such data.

[enjay]

Worrying to hear that the SIMS default is to share personal data with all primary contacts and that it took school office intervention to protect against what could have been a very serious breach. That needs analysis and remediation. You might log it as a near miss breach and then review how to minimise the risk, perhaps via a Data Protection Impact Assessment.

 

That's a really good idea, thanks. Conscious of how SIMS Parent App would share information, we contacted a few non-resident parents where we knew their details had come directly from them and not from the resident parent / their ex-partner.

[enjay]

Worrying to hear that the SIMS default is to share personal data with all primary contacts

 

I don't think that is the default. By default, the SIMS Parent App only shares the information with Priority 1 contacts who reside at the same address as the student. Generally speaking, that is who would have completed the old-fashioned hard copy data check anyway. The point where this falls down is where a non-resident parent has given their contact information to the school but doesn't want the other parent to know it.

 

Sharing all data with all contacts would lead to a world of breaches, as you would share details of neighbours/aunt and most critically step-parents with the non-resident parent.

[AndrewSharp]

That's a really good idea, thanks. Conscious of how SIMS Parent App would share information, we contacted a few non-resident parents where we knew their details had come directly from them and not from the resident parent / their ex-partner.

An approach which may help, borrowed from marketing segmentation, is to consider what "persona" groups exist within your data subjects. Rather than seeing data subjects as roles (parent, student, staff member, governor, etc) and assuming that all people playing a role have the same needs and vulnerabilities, break it down in more detail in to groups for whom the need for transparency is different or for whom the impact of a breach is different. Seeing "separated parents" as a group then helps to focus consideration of risks and impacts for that group, just as seeing those with learning difficulties as a group aids the preparation of appropriate transparency notices. Some marketing segmentation models go as far as giving each persona a name and pen portrait - this helps discussion, as you can visualise the persona more easily and consider how your processing and notices affect them. I'm not suggesting that you label individuals, just make sure that you identify what persona groups exist within your data subjects and ensure that all relevant persona groups are considered when writing notices, carrying out impact analysis, implementing privacy by design etc. For any new processing, ask yourself whether this might impact different persona groups in different ways and whether any new groups are needed to match the possible impact of the processing.

Edited December 13, 2018 by AndrewSharp