Bigbird7

Looked at this a couple of weeks ago and the catalogue available seems very limited. I randomly checked 50 or so books from our library and not one was available!

Absolutely a DPIA should be carried out and it should have been thought of as part of the procurement process not an afterthought. Not only is this a new system, but also one that will process high volumes of data and special category data.

In the DfE guidance on mass testing in secondary schools it mentions a template privacy notice specifically for testing. Has anyone managed to find this?

I've heard good things about the Evolve accident book system http://www.edufocus.co.uk/pages/evolve/accidentbook.asp

The ICO have recently published a couple of audit reports on academy trusts, available here https://ico.org.uk/action-weve-taken/audits-advisory-visits-and-overview-reports/ They are only summary reports but interesting reading nonetheless. A couple of key points come through - staff training/awareness and data sharing practices.

Anybody with PR can put n a SAR for their child no matter their age. Who you should respond to depends upon the competency of the child (usually deemed to be over 12) but should be treated on a case by case basis. If you are confident the child understands their rights then the response should be to the child, however the child may give their consent or if it is evidently in the best interests of the child then the response is to the parent.

Yes, any personal information you hold where an individual is identified is requestable by a parent, no matter the source. Safeguarding records are not automatically discounted but you must go through a redaction process to remove anything that identifies another individual and anything that could cause harm by passing it on.

I read it as any close family member who is being tutored by a member of staff or any family of exams staff, so we will need to survey our staff to get the information and pass it on to the awarding bodies. The exam regs are a legal requirement so that’s our legal basis.

Does anyone have any thoughts on the JCQ general regs 2018-19, page 11 5.3 d) and the sharing of data to exam boards for family members of staff sitting exams, even if it’s not at your centre. https://www.jcq.org.uk/Download/exams-office/general-regulations/general-regulations-for-approved-centres-2018-2019 Whilst sharing of information with the exam boards will be covered in our privacy notices, this won't be extended to family members. As it’s extended to other centres we won’t even currently hold the information.

Possibly, they may also not have finished their review yet! I know of two breaches reported to the ICO back in June and July and the schools have heard nothing back yet.

I attended a Level 1 safeguarding course for a school that I'm a governor at last week, given by the LA safeguarding lead. At no less than three times the trainer stated that safeguarding overrides data protection. i tried to push the data protection is safeguarding point and that the two should always be considered together which did seem to be accepted. If this is a consistent message being given to schools by safeguarding trainers then DPOs face an uphill battle!

Contact is obviously very different to access to the child’s data which should be controlled by knowing who has PR. With regard to the original question it would be unmanageable to get consent from the additional contacts. Our solution was to add some wording on the data collection form to put the onus on the parent completing the form to ensure that they had told the contacts that their details were being passed to the school and why. We reduced the data we were collecting to just a name and mobile number. We also reduced the number of contacts we were asking for. It’s not a perfect solution but we’ve reduced risks as best we can.

Annex 8.1 of the DfE Toolkit has a summary report of an ICO advisory visit https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/747620/Data_Protection_Toolkit_for_Schools_OpenBeta.pdf

Apologies! In lots of schools in my area the catering company not only provides the food but also the staff to serve it. If that's the case then those staff need the allergy information.

If the catering company provide the service directly to the children, as is the case in many schools, then there would be a need to associate the medical information with the child