1. Sharing Pupil Data North Yorkshire County Council Schools Conference Robert Beane and Louise Jackson

2. Sharing Pupil Data What do the law and guidance require? What do pupils and parents reasonably expect? Who makes the decisions?

3. Data Protection Act 1998 sets out the web of cultural and social expectations about privacy in a legally enforceable form

4. DPA: how it works four main features: rights of data subjects obligations on data controllers exemptions enforcement

5. Rights: access to one’s own personal data right to prevent processing (Section 10) compensation for damage and distress request for assessment

6. children Children are data subjects with all the privacy rights of an adult A parent can exercise those rights if the child does not have the capacity to do so....And it is in the child’s interests

7. children The various education acts give rights and duties to parents Children Act and others impose duty on schools and councils to protect children

8. Obligations: Eight data protection principles

9. 1.lawful, fair, and fulfil a condition 2.not used for new, incompatible, purposes 3.adequate and not excessive 4.accurate and up-to-date 5.not retained longer than necessary 6.rights of data subject respected 7.secure 8.not transferred beyond scope of adequate protection

10. Fair processing…. subject must know the identity of the data controller how to contact the data controller the purpose or purposes of processing anything else to make it fair –especially routine disclosures to other data controllers

11. Exemptions Crime prevention (Section 29) Disclosures required by law or made in connection with legal proceedings (Section 35)

12. Data sharing Means disclosure of personal data to another data controller

13. Data sharing Must be consistent with Data Protection Act: Info Commissioner’s Statutory code of practice Checklists for –Ad-hoc or one-off requests –Routine or systematic disclosures

17. Group exercise

18. Case study 1 The police have launched an initiative where they pick certain dates and try to support schools getting absent students in to school. They ask for a list of students who were absent without explanation or who had a high level of absenteeism and weren't in that day

19. Case study 2 A father, separated from his former wife and children, asks for information about them and their educational progress. His former wife writes to say she does not wish any information about her children to be disclosed to their father. One child is 8 and the other 14

20. Making decisions have a system for making decisions at a suitable level of seniority take advice and recording each decision –each point in the checklist a written agreement for routine sharing will save some of the recording

21. More information Information Governance Office – Veritau information.governance@veritau.co.uk information.governance@veritau.co.uk Information Commissioner http://www.ico.org.uk/for_organisations/da ta_protection/topic_guides/data_sharing http://www.ico.org.uk/for_organisations/da ta_protection/topic_guides/data_sharing

22. More information Schools information governance manual Guide to Data Protection http://www.ico.gov.uk/for_organisations/data_pr otection/the_guide.aspx Sector specific guidance - Education http://www.ico.gov.uk/for_organisations/sector_ guides/education.aspx