Sharing Pupil Data North Yorkshire County Council Schools Conference Robert Beane and Louise Jackson

Sharing Pupil Data What do the law and guidance require? What do pupils and parents reasonably expect? Who makes the decisions?

Data Protection Act 1998 sets out the web of cultural and social expectations about privacy in a legally enforceable form

DPA: how it works four main features: rights of data subjects obligations on data controllers exemptions enforcement

Rights: access to one’s own personal data right to prevent processing (Section 10) compensation for damage and distress request for assessment

children Children are data subjects with all the privacy rights of an adult A parent can exercise those rights if the child does not have the capacity to do so....And it is in the child’s interests

children The various education acts give rights and duties to parents Children Act and others impose duty on schools and councils to protect children

Obligations: Eight data protection principles

1.lawful, fair, and fulfil a condition 2.not used for new, incompatible, purposes 3.adequate and not excessive 4.accurate and up-to-date 5.not retained longer than necessary 6.rights of data subject respected 7.secure 8.not transferred beyond scope of adequate protection

Fair processing…. subject must know the identity of the data controller how to contact the data controller the purpose or purposes of processing anything else to make it fair –especially routine disclosures to other data controllers

Exemptions Crime prevention (Section 29) Disclosures required by law or made in connection with legal proceedings (Section 35)

Data sharing Means disclosure of personal data to another data controller

Data sharing Must be consistent with Data Protection Act: Info Commissioner’s Statutory code of practice Checklists for –Ad-hoc or one-off requests –Routine or systematic disclosures

Group exercise

Case study 1 The police have launched an initiative where they pick certain dates and try to support schools getting absent students in to school. They ask for a list of students who were absent without explanation or who had a high level of absenteeism and weren't in that day

Case study 2 A father, separated from his former wife and children, asks for information about them and their educational progress. His former wife writes to say she does not wish any information about her children to be disclosed to their father. One child is 8 and the other 14

Making decisions have a system for making decisions at a suitable level of seniority take advice and recording each decision –each point in the checklist a written agreement for routine sharing will save some of the recording

More information Information Governance Office – Veritau Information Commissioner ta_protection/topic_guides/data_sharing ta_protection/topic_guides/data_sharing

More information Schools information governance manual Guide to Data Protection otection/the_guide.aspx Sector specific guidance - Education guides/education.aspx