Details of Former Pupils

[enjay]

Is anyone up on the current Data Protection Act guidelines/requirements regarding how long we can keep data on pupils, and at what point we should destroy it? A conversation about contacting former pupils and inviting them a reunion has sparked some concern here...

 

I've seen How long should school records be retained? : North Yorkshire County Council, but am not sure the source of that, i.e. whether it is legal or just their recommendation.

[philwaud]

Its the Freedom of Information act that applies here and your school should have a schedule of publication which lists how long each kind of data is retained for.

 

It could be until the students are twenty one, but in the case of students with a statement, it may be much longer (might even be for their lifetime!)

 

Phil

[jdoyle]

Its the Freedom of Information act that applies here and your school should have a schedule of publication which lists how long each kind of data is retained for.

 

It could be until the students are twenty one, but in the case of students with a statement, it may be much longer (might even be for their lifetime!)

 

Phil

 

nope. It's the DP Act that applies here re personal data not the FoI Act.

[creese]

The problem here is the reason the communication is being sent. The school could be on rocky ground using contact details for this, unless the ex-students opted into a mailing list for this type of communication.

[jdoyle]

a good holding page re the DP Act in schools (with a document on retention dates) can be found at

 

http://www.usethekey.org.uk/administration-and-management/record-keeping/keeping-personal-records-for-students-and-staff

[philwaud]

OK, I think we are both right!

 

DPA says the data shouldn't be kept longer than necessary but the FOI says it must be kept for a period when a request may reasonably be made. As I said, this is until 21 (when a majority od students could reasonably be expected to finish their education), or life in the case of certain statemented pupils.

 

Im referring to data in the form of school records rather than data in the students user area.

 

Phil

[enjay]

FOI doesn't apply to independent schools though, right?

 

Age 21 was what our Bursar said too, something about statutes of limitation on liability claims, however there was some uncertainty over how much we had to destroy at age 21 and how much we could keep - like many older schools, we have pupil lists going back in to the mists of time, and are asked for information from these with surprising frequency by people who are trying to trace family members.

 

Pupils do opt-in/out when they leave, however it is anyone's guess what was said to people in 2000 (the current year of interest).

[enjay]

a good holding page re the DP Act in schools (with a document on retention dates) can be found at

 

Personal records for pupils and staff: storage and retention — The Key

Can't get that page to work - do I need to be a member before I can expand those pages in the contents section, or is my browser having a moment?

[jdoyle]

it was open to view until last night when they did some site maintenance. I should have downloaded the document they'd produced ;-(

[enjay]

From what it says in the header, I think it is just a wrap-up of ICO regulations, so I'll see if I can find it on there before paying to access this site.

[enjay]

I've just looked at the ICO's website, and they don't go into any of the detail which that North Yorks site does, so I think that must just be their own policy. The ICO basically seems to be saying to keep it for as long we deem necessary and no longer.

 

Before we get much further down this road, does anyone know how easy it is to selectively prune SIMS, so we could remove attendance data but keep other data?

[AngryTechnician]

There are actually a collection of different laws that relate to this, not just DP and FOI (and enjay is right that FOI does not generally apply to independent schools).

 

The Records Management Society has a 'Toolkit for schools' with a LOT of information on this here:

Toolkit for Schools - May 2008 | Information and Records Management Society

 

It may be slightly out of date now as it was last revised in 2008, but the Retention Guidelines document in particular is very thorough and makes an excellent starting point.

[enjay]

Thanks AngryTechnician. According to that, we should be destroying everything when the pupil is 25 - if that is the case, then there are lots of schools out there who are in breach of that, as the more historic/prestigious ones keep pupil records for decades if not centuries...

[jdoyle]

I'm into the site again and the resourse re retention is from the IRMS

 

http://www.irms.org.uk/download/789

[enjay]

Thanks jdoyle, AngryTechnician beat you to it though.

[jdoyle]

no prob. So long as you got the info.

[enjay]

So, as I see it, the ICO don't go into specifics, and just say we should assess what we have and not keep it longer than necessary; various organisations then interpret this how best suits them in terms of what to keep and for how long, and documents like the ones in this thread from IMRS and North Yorks are produced, but have no legal bearing on us.

 

Put brutally, we can do what we want so long as we have thought about it first (and probably documented it somewhere)...

 

Does anyone have any DfE stuff on this? I tried searching their site, but it is somewhat impenetrable...

[GrumbleDook]

The stuff for schools used to be either on teachernet or Becta ...

 

One way around keeping data for longer is to include it in your retention schedule and DP Register entry ... and you have to have a reason for it. Alumni associations is one of them. If you agree to hold the data up until the 10 year period after leaving Year 11 or Year 13 (depending on how many stay on, etc) then the final close down of destroying data.

 

Retention of information related to the school for school historical data is another reason. This does not have to be extensive personal information and can also be another justified reason.

 

Simply ... what ever you do has to be for a reason, you need to let people know what it is and let them know of any changes.

[philwaud]

Yeah, the statute of limitation thingy rings a bell - and is why statemented pupils stuff has to be kept longer as they would potentially have a claim when they were much older. Unrelated but similar are some of the crazy retention rules re asbestos (100 years?) and nuclear incidents.

[enjay]

Unrelated but similar are some of the crazy retention rules re nuclear incidents.

I hope we'll never need that one! :-)

[AngryTechnician]

You mean you don't power all your servers using dynamos driven by lightly irradiated gerbils?

[enjay]

You mean you don't power all your servers using dynamos driven by lightly irradiated gerbils?

I did consider that as a fail-over measure, but bought a UPS instead :-)

[creese]

I did consider that as a fail-over measure, but bought a UPS instead :-)

 

We are sorry we could do your backup, but we've left a card instead.