Sixth form requests for info?

[jpryan]

Hi all , our local sixth form has asked for info on exam access arrangements for named Y11 pupils who have applied there for September. Can we send them the details if applicable? Is it ok if we send them securely? Thanks.

[Noxid_w]

Your DPO is the person to ask this question to. I would imagine that it would be ok as long as it's sent securely and encrypted, but still best to run that past your DPO.

[robintech]

Lot of schools use the same boilerplate one if you search online for "This data may relate to exam entries" saying they can provide it to local authorities, Department for Education (DfE), Schools or colleges that you attend after leaving , without a policy I'd guess the students (or in exceptional cases guardian, carer regardless of age) would need to provide permission.

[garbage46]

I am DPO for our MAT. We have a specific data sharing agreement with the local FE providers. This outlines the what and why (reasons) for sharing. I also checked to ensure the data shared wouldn't negatively affect any individuals enrolment/application.

They generally want the information to ensure they can put the right support in place for students who have applied for courses. Worth noting, only share personal data of students who have applied to the FE provider, do not send personal data on all students.

[FN-GM]

Not sure on the legal side but I have 2 personal issues with this.

 

1. They have applied but are not yet enrolled. So they might not actually need this data? It seems like sharing data unnecessarily.

 

2. Shouldn’t the student be consenting to this data to be shared? They are young adults and certainly will be of age ok sixth form. I wouldn’t be too happy about someone sharing my data without consent.

[garbage46]

There is a statutory guidance from the Department for Education which supports/encourages data sharing to careers guidance and monitoring FE and employment with training although the emphasis is clearly focussed on LA's, other public bodies are mentioned.

 

I have doubled checked the wording in our agreement document in relation to the points raised by FN-GM:

 

Sharing is only "for pupils who are leavers and have either enrolled at FE Provider or have confirmed their place to start at FE Provider within the next few months."

 

There is a legal expectation that young people under 18 are in formal education or employment with training. In our context data sharing is justified as it is intended facilitate a collaborative approach to the support young people in our local area and optimise their educational opportunities.

 

https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/1127489/Careers_guidance_and_access_for_education_and_training_providers_.pdf

 

https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/561546/Participation-of-young-people-in-education-employment-or-training.pdf

[jmak]

I think there's a strong case that it falls under one or other of these legal basis to process data:

 

(e) Public task: the processing is necessary for you to perform a task in the public interest or for your official functions, and the task or function has a clear basis in law.

 

(f) Legitimate interests: the processing is necessary for your legitimate interests or the legitimate interests of a third party, unless there is a good reason to protect the individual’s personal data which overrides those legitimate interests. (This cannot apply if you are a public authority processing data to perform your official tasks.)

 

What is necessary?

Many of the lawful bases for processing depend on the processing being “necessary”. This does not mean that processing has to be absolutely essential. However, it must be more than just useful, and more than just standard practice. It must be a targeted and proportionate way of achieving a specific purpose.

[/Quote]

 

I think it would be difficult to perform the function of providing an education without sharing that data.

 

But this is a decision for your DPO - it's not an IT thing.