synaesthesia Posted July 5, 2019 Posted July 5, 2019 (edited) Some good reading from an El Reg post today, very on topic! https://www.theregister.co.uk/2019/07/05/kings_university_breached_gdpr_by_sharing_list_of_activist_students_with_cops/ Reported as a straight breach of GDPR as it wasn't requested in writing. Edited July 5, 2019 by synaesthesia 2
enjay Posted July 8, 2019 Posted July 8, 2019 Some good reading from an El Reg post today, very on topic! https://www.theregister.co.uk/2019/07/05/kings_university_breached_gdpr_by_sharing_list_of_activist_students_with_cops/ Reported as a straight breach of GDPR as it wasn't requested in writing. Concerning to note someone declined giving further information because it would "raise flags". If you suspect a flag would get raised, maybe that's because you think you're doing something you shouldn't!
jimmy_2k Posted July 9, 2019 Posted July 9, 2019 I notice that you're based in Episkopi Cyprus. (I lived there a long time ago) Are you on the SBA and subject to UK law? Is the request from the Republic Police or SBA, RMP, SFP etc?
Bill8 Posted July 9, 2019 Author Posted July 9, 2019 I notice that you're based in Episkopi Cyprus. (I lived there a long time ago) Are you on the SBA and subject to UK law? Is the request from the Republic Police or SBA, RMP, SFP etc? I am, we are (as well as military law) and it's from the RMP. Interestingly enough, after I gave our Assistant Head the awesome advice from you guys have given, they've not been back in touch. I'm thinking someone had a "good idea" but wasn't expecting us to question them back.
jimmy_2k Posted July 9, 2019 Posted July 9, 2019 I am, we are (as well as military law) and it's from the RMP. Interestingly enough, after I gave our Assistant Head the awesome advice from you guys have given, they've not been back in touch. I'm thinking someone had a "good idea" but wasn't expecting us to question them back. The RMP have no jurisdiction over civilians as far as i'm aware (which the students would be classed as) so i'm surprised they're pursuing this matter. I'm the son of a civil servant who was based in Episkopi in the late 90's early 00's. I was in boarding school but my brother did attend SJS until year 10. :-)
GrumbleDook Posted July 9, 2019 Posted July 9, 2019 The RMP have no jurisdiction over civilians as far as i'm aware (which the students would be classed as) so i'm surprised they're pursuing this matter. I'm the son of a civil servant who was based in Episkopi in the late 90's early 00's. I was in boarding school but my brother did attend SJS until year 10. :-) The phrase “it depends” applies here ... there are a range of circumstances where they would require information and can reasonably request it. OP - If you are an overseas school dealing with military families, I would strongly suggest that legal services are employed to support this, especially if there is challenge against the request. 1
jimmy_2k Posted July 10, 2019 Posted July 10, 2019 The phrase “it depends” applies here ... there are a range of circumstances where they would require information and can reasonably request it. OP - If you are an overseas school dealing with military families, I would strongly suggest that legal services are employed to support this, especially if there is challenge against the request. That's true. To be honest if CBF was to get involved (CBF's have in the past become involved with incidents involving dependent children) then you would have to hand it over. 1
garbage46 Posted July 17, 2019 Posted July 17, 2019 (edited) I realise I am late to the party but thought this was worth sharing.... hopefully someone finds this useful. When the police make a request for personal data in relation to the prevention and detection of a crime, the prosecution of offenders or to protect the vital interests of a person then GDPR does not apply an exemption rule can be used to disclose personal data without breaching DPA or GDPR***edit: see post below***. BUT there is an official form that must be completed stating the name of the data subject, reasons why personal data is requested (see above) and then the personal data required. The request should explicitly state the request is in relation to one for the above reason (prevention, detection, prosecution or safeguarding). I believe, even with the form completed, it would be a school decision to release the information - but the release would be lawful. The form used by Lancashire Police is called a DP1 form, I will attempt to attach some screenshots of a blanked out version along with the guidance notes. Edited July 17, 2019 by garbage46 correction edit: see post below 2
GrumbleDook Posted July 17, 2019 Posted July 17, 2019 @petem46 Just to clarify things … GDPR does apply to all personal data sharing from schools to third parties, but there are exemptions and criteria for those exemptions … I know it sounds pretty much the same as "GDPR doesn't apply", but if people say it doesn't apply they forget to ensure they know why there is an exemption. Language helps to change the mindset. 1
garbage46 Posted July 17, 2019 Posted July 17, 2019 (edited) Indeed! A poor choice of words there.... I think I'll make an edit to the previous post to emphasise exemption. This paragraph from the DP1 guidance helps further explain the exemption element; In effect the exemption means that an organisation can provide personal data to the police where necessary for the prevention or detection of crime or the apprehension or prosecution of offenders without fear of breaching the GDPR or Data Protection Act 2018. Edited July 17, 2019 by garbage46 1
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now