Internal Audit Data Protection St Helens Council Internal Audit Data Protection

Data Protection The Principles It’s as broad as it can get Act is huge - it is underpinned by 8 guiding principles These are: Our customers should know what information is being collected and why We cant collect data “just in case” - We have a Retention Schedule which ensures we comply with required timescales for both retention and destruction of info We don’t pass on without permission or legislation, someone has the right (for a small fee) to see all the information we hold on them Covered in more detail later It’s not legal to transfer personal data outside the EU without taking appropriate steps to protect it (ie Dropbox, Google docs)

The three most important aspects when sharing data are: Data Protection The three most important aspects when sharing data are: • Making sure you are allowed to share it • Ensuring adequate security (taking into account the nature of the information) is in place to protect it • Providing an outline in a fair processing notice of who receives personal information from the school

Data Protection Important!!!! HM Guidance March 2015 – The DPA is not a barrier to sharing information where the failure to do so would result in a child being placed at risk of harm Outcomes from Rotherham child exploitation Information sharing - Advice for practitioners providing safeguarding services to children, young people, parents and carers March 2015

When Can/should you share Data Protection When Can/should you share Schedule 2 Conditions Consent Functions of a public nature exercised in the public interest (Legislation) Protect the vital interests of the data subject The administration of justice Implied consent Not necessarily under legislation Safeguarding Police/Courts etc but they should request in writing

When Can/should you share Data Protection When Can/should you share Schedule 3 Conditions (Sensitive data) Consent Function conferred under enactment (Legislation) Protect the vital interests of the data subject The administration of justice Explicit consent Requires legislation Safeguarding Police/Courts etc but they should request in writing

Data Protection Secure Sharing Email – When is it secure Post – Recorded or more secure depending on content Fax – Last resort, ensure number/recipient Microsoft 365 to Transport Layered Security Postal system not infallible, be careful with confidential info Faxes being removed from the Council unless no other option. Fax to email options

Fair Processing Notice (Privacy Notice) Data Protection Fair Processing Notice (Privacy Notice) The important thing is what personal information you are collecting and why Control access to personal information mentions the purpose and use of any CCTV and the use you may make of photos of staff and pupils Previously supplied by Council however now responsibility of each School Guidance on ICO website for schools on all matters Be clear/transparent about how you will use the personal information you collect to comply with the first and second principles. Important thing is to tell parents and pupils what personal information you are collecting and why. Mentions purpose and use, unless properly managed, issues can arise from putting identifiable images of pupils on a website/school publication – a form of processing personal data. Fair processing and avoiding unauthorised processing requires you control access, giving it only to people (staff and governors) who need particular information to do their jobs, and only when they need it. This covers access to written/electronic staff and pupil records and recorded CCTV images. Need systems and procedures in place to control access to paper and electronic records containing personal information.

Other Issues to consider Data Protection Other Issues to consider CCTV Freedom of Information/Environmental Information Regulations Subject Access Requests CCTV – Have you got any, are their signs (contact details, purpose), retention periods FOI/EIR – Understand your responsibilities SAR – Process for handling

Data Protection Any Questions ???

Data Protection Andy Paton Extn 3474 andrewpaton@sthelens.gov.uk