Claireashton

Understanding the difference between controllers and processors will also help you here and there is plenty of information online about this. Here is a blog that might help and the ICO has lots of information on this: https://www.itgovernance.co.uk/blog/the-gdpr-everything-you-need-to-know-about-data-controllers-and-data-processors Also understanding the lawful basis for processing, as other people have mentioned. Most of the processing of personal data in school does not need the consent of the individual. Here is a checklist to work through to see where you might need to focus your compliance activities: https://www.itgovernance.co.uk/blog/is-your-school-gdpr-compliant-checklist

Oh brilliant, thanks Claire

Hi Can anyone recommend any free Moodle training or webinars please? Thanks Claire

There's an article from the BBC about this very thing: https://www.bbc.co.uk/news/technology-52033217 The article explains a chequered history and that ..."some experts still think that the firm has a rather blase attitude to security."

We delivered a webinar about DSARs last week, now available on YouTube: Hopefully some useful tips for everyone. Claire

Chorus Advisers offers a nice service for schools at a good price. Definitely worth adding to your list: https://chorusadvisers.co.uk/

Hope you manage to get it all sorted soon! As well as looking at your retention policies there's an opportunity to train staff in what's appropriate to write in emails, even when initials and codes are used to identify people, which you are already looking at. The IRMS toolkit is helpful for retention: https://irms.org.uk/page/SchoolsToolkit and some organisations offer support with SARs. Good luck! Claire

Sorry, should have been more precise, yes school website. Each process needs to be looked at to see which is more manageable for the school. If contacting parents, pupils or staff each time you want to use a photograph is easier than being specific in the consent form then do that. The DfE states 'specific informed consent' which is not specific about what specific means. Ultimately, everyone is interpreting the Regulation and until there is case law this is all we can do. But it needs to work for your school and be documented as to why decisions have been made

That's right, they need to opt in and not opt out - this should always be the case where consent is the lawful basis for processing. Each potential use of the personal data should also be separated out, so if you use photographs on the website, as displays in the school, send them to the newspaper, add them to social media - each of these is a separate option. So people may say yes to the website and no to social media for example. The form should also explain how they withdraw their consent which needs to be easy, so maybe a specific email address. Also silence is now interpreted as a no and not a yes.

I am glad it is useful. This is an example of one of many processes in school that should be looked at to see if there's a better way. A risk assessment helps everyone to see what the risks are and if they are worth taking, can be reduced or can be removed. Has anyone heard anything from the suppliers of systems using biometric data around GDPR?

Yes, you need their consent in the same way. You will need to ask all staff if you use their photos on the website or send them to the press for whatever reason. One thing to be careful of with staff contracts is that they don't contain consent for the lawful basis of processing their data for the employment - they tend to. On May 25th, this would invalidate the contract. They need to be checked and updated to the lawful basis of performing the contract - as in, without their details you wouldn't be able to employ and pay them, it's not optional. Biometric now fall under special category data and need special treatment. Here's a blog about it: https://www.itgovernance.eu/blog/en/gdpr-things-to-consider-when-processing-biometric-data The ICO also issues information about this and they explain what kinds of biometric data is classed in this way: https://www.itgovernance.eu/blog/en/gdpr-things-to-consider-when-processing-biometric-data

Any system you choose needs to be manageable for the organisation and this is written in the GDPR. Some schools, such as special schools, may decide that their students will never have the capacity to understand their data protection rights and will always refer to their parents. In all instances, the consent must be explicit and freely given - so opt in and not opt out. Once you have it, a record needs to be kept so if they are not returning the forms, they are not giving their consent. Applies to staff too. On the mention of consent and staff contracts, if these currently say something along the lines of, 'I give my consent for the school to use my data...' then this needs changing as the lawful basis for using personal data to employ people will no longer be consent, but to perform a contract. All decisions made about how you manage consent need to be documented as this forms part of the accountability principle.

Does anyone know if other suppliers are providing a way to download the data about an individual for a subject access request? Similar to how SIMS has introduced their Person Data Output report? Is this in the data mapping information? Thanks