Sharing of addresses

[DrCheese]

Hi -

 

Just want to run this by the forum -

 

Our local social housing company has in past funded a school trip for students we have who are in one of their homes - However to do this they ask us to send over all our addresses (No names or identifiable info) which they then match up with their own records and then we've made contact with those parents to ask if they'd like to go on this funded school trip.

 

They've asked us to sign a data sharing agreement for this but I'm concerned this violates the GDPR as by sending all of our addresses, you could potentially see which houses students live in & who lives there by matching up with the electoral register/phonebook. Also as we have no way of knowing who is in social housing, we'd be sending info over that they have no legal basis to know.

 

Spoke to the ICO who said we'd need a legal basis to do this, but I can't see any other than consent, which we don't naturally have.

 

I don't want to be the no person for this, but is this right?

[pete]

Can you approach it a different way? Make parents aware funding is available for the trip if they meet $criteria and that said criteria will be treated in strictest confidence and only for the purposes of securing funding? The finance dept at your school may have a good idea who's likely to be eligible.

 

If it was a subset of students (in social housing) who'd already signed up to the trip it could be fulfilment of a contract (funding for going on the trip), provided they're OK with you passing on the details.

 

But I can't think of a valid reason for you to send address data on several hundred students when (or even a subset, absent consent) the vast majority are unnecessary for the task and it's not really a core school function.

[mikeprice]

I'm not totally up to date on GDPR - but I believe that is an individual is identifiable then it would contravene the law. And remember that in the event that only one adult lives here then simple searches on public data would show that the adult who lives there has a child at that school - so you are in breach of the law based on info about the child (probably) AND the adult.

[Edu-IT]

Why can't the people living in the social housing contact the housing company, company then record list of eligible people, and provide the school with appropriate funding and name of people the payment is for?

[enjay]

To check I'm reading your post correctly, are you saying the housing company would like a list of addresses of all your students so they can cross-check them against a list of their tenants in order to find out which of their tenants attend your school?

 

If so, that would be a "hell no" from me.

 

Could you include something in the trip info to parents saying "if you live in a house provided by X Housing Company, there may be additional funding available. Please contact your housing company for more details"?

[GrumbleDook]

This should be based on 3 things.

1 - a marketing / comms programme by the school and the social housing ... raising awareness of what is going on. This could be targetted to groups of parents if the school knows who is 'likely' to be involved.

2 - The school and the social housing group both having mechanisms for parents / residents to grant permission for data to be shared (you have a purpose ... the lawful basis could be Consent, but could even be public task ... but getting the information first is an important factor)

3 - this data is shared (securely) on a regular basis so that they have a matching list that is updated and accuracy maintained. Privacy Notices for both of them should be updated and a Data Sharing Agreement should be in place (School and Social Housing Group are likely to be Joint DCs)