Lady Margaret Primary School is committed to protecting the privacy and security of personal information. This privacy notice explains how we collect, store and use personal data about pupils, in accordance with the General Data Protection Regulation (GDPR) section 537A of the Education Act 1996, and section 83 of the Children Act 1989.
Lady Margaret Primary School is the Data Controller is the Data Controller for the use of personal data in this privacy notice] This means that we decide how we are responsible for deciding how we hold and use personal information about pupils.
The personal data collected is essential, for the school to fulfil their official functions and meet legal requirements.
We collect and use pupil information, for the following purposes;
The categories of pupil information that we collect, hold and share include:
The categories of pupil information that we collect, hold and share include:
Collecting pupil information
We collect pupil information via registration forms at the start of the school year or Common Transfer File (CTF) or secure file transfer from previous school.
Pupil data is essential for the schools’ operational use. Whilst the majority of pupil information you provide to us is mandatory, some of it requested on a voluntary basis. In order to comply with the data protection legislation, we will inform you at the point of collection, whether you are required to provide certain pupil information to us or if you have a choice in this and we will tell you what you need to do if you do not want to share this information with us.
It is important that the personal information we hold about you is accurate and current.
Please keep us informed if your personal information changes during your working relationship with us.
The Lawful Basis on Which We Use This Information
Under the General Data Protection Regulation (GDPR), the lawful bases we rely on for processing pupil information are:
We need all the categories of information in the list above primarily to allow us to comply with legal obligations. Please note that we may process information without knowledge or consent, where this is require or permitted by law.
Storing pupil data
Lady Margaret Primary School keep pupil data on computer systems and also on paper.
Except as required by law, the School only retains information about pupils for as long as necessary in accordance with timeframes imposed by law and our internal policy.
The length of time for which we hold pupil data varies according to the type of data. More information can be found in our Information Management Policy, which can be found on our website.
We hold a pupil’s education records securely until they change school. Their records will then be transferred to their new school, where they will be retained until the pupil reaches the age of 25, after which they are safely destroyed.
There are strict controls on who can see this information. We will not share personal data if you have advised us that you do not want it shared unless it is the only way we can make sure you stay safe and healthy or we are legally required to do so.
Sharing data
We may need to share your data with third parties where it is necessary. There are strict controls on who can see your information. We will not share your data if you have advised us that you do not want it shared unless it’s the only way we can make sure you stay safe and healthy or we are legally required to do so.
We share pupil information with:
Information will be provided to those agencies securely or anonymised where possible.
The recipient of the information will be bound by confidentiality obligations, we require them to respect the security of your data and to treat it in accordance with the law.
We may transfer your personal information outside the EU. If we do, you can expect a similar degree of protection in respect of your personal information.
Why we share pupil information
We do not share information about our pupils with anyone without consent unless the law and our policies allow us to do so.
The Department for Education (DfE) collects personal data from educational settings and local authorities via various statutory data collections. We are required to share information about our pupils with the Department for Education (DfE) either directly or via our local authority for the purpose of those data collections, under section 3 of The Education (Information about Individual Pupils) (England) Regulations 2013.
All data is transferred securely and held by DfE under a combination of software and hardware controls, which meet the current government security policy framework.
For more information, please see ‘How Government uses your data’ section.
We may be required to share information about our pupils with the local authority to ensure that they can conduct their statutory duties under the Schools Admission Code, including conducting Fair Access Panels.
Data collection requirements:
To find out more about the data collection requirements placed on us by the Department for Education (for example; via the school census) go here.
Third Party Software Providers
Data is also shared with selected third party software providers. This enables pupils to access their own learning programmes from multiple providers in and out of school. All providers are checked by the school to ensure they comply with the GDPR and satisfy the criteria of the DfE’s guidance for Cloud software.
Security
We have put in place measures to protect the security of your information (i.e. against it being accidentally lost, used or accessed in an unauthorised way).
The National Pupil Database (NPD)
Much of the data about pupils in England goes on to be held in the National Pupil Database (NPD).
The NPD is owned and managed by the Department for Education and contains information about pupils in schools in England. It provides invaluable evidence on educational performance to inform independent research, as well as studies commissioned by the department.
It is held in electronic format for statistical purposes. This information is securely collected from a range of sources including schools, local authorities and awarding bodies. To find out more go to the NPD.
Sharing by the Department
The law allows the Department to share pupils’ personal data with certain third parties, including:
Organisations fighting or identifying crime may use their legal powers to contact DfE to request access to individual level information relevant to detecting that crime. Whilst numbers fluctuate slightly over time, DfE typically supplies data on around 600 pupils per year to the Home Office and roughly 1 per year to the Police.
For information about which organisations the Department has provided pupil information, (and for which project) or to access a monthly breakdown of data share volumes with Home Office and the Police please visit the following website.
How to find out what personal information DfE hold about you
Under the terms of the Data Protection Act 2018, you are entitled to ask the Department:
If you want to see the personal data held about you by the Department, you should make a ‘subject access request’. Further information on how to do this can be found within the Department’s personal information charter that is published at this address. Contact DfE here.
Requesting access to your personal data
Under GDPR, parents and pupils have the right to request access to information about them that we hold. To make a request for your personal information, or be given access to your child’s educational record, please contact Amanda Hancock, School Business Manager:
You also have the right to:
If you want to exercise any of the above rights, please contact Amanda Hancock, School Business Manager.
If you have a concern about the way we are collecting or using your personal data, you should raise your concern with us in the first instance or directly to the Information Commissioner’s Office here.
We may need to request specific information from you to help us confirm your identity and ensure your right to access the information (or to exercise any of your other rights). This is another appropriate security measure to ensure that personal information is not disclosed to any person who has no right to receive it.
Right to Withdraw Consent
Where we are processing your personal data with your consent, you have the right to withdraw that consent. If you change your mind, or you are unhappy with our use of your personal data, please let us know by contacting Amanda Hancock, School Business Manager.
Once we have received notification that you have withdrawn your consent, we will no longer process your information for the purpose or purposes you originally agreed to, unless we have another legitimate basis for doing so in law.
Contact
If you would like to discuss anything in this privacy notice or have a concern about the way we are collecting or using your personal data, re quest that you raise your concern with Amanda Hancock, School Business Manager.
We have appointed a data protection officer (DPO) to oversee compliance with data protection and this privacy notice. If you have any questions about how we handle your personal information which cannot be resolve by Amanda Hancock, then you can contact
the DPO on the details below:
Data Protection Officer Name: Craig Stilwell
Data Protection Officer Details: Judicium Consulting Ltd,
72 Cannon Street,
London,
EC4N 6AE
Data Protection Officer
Email: dataservices@judicium.com
If you need more information about how our local authority and/or DfE collect and use your information, please visit:
Our local authority online or The DfE website.
If you are unable to access these websites we can send you a copy of this information.
Please contact the LA or DfE as follows:
Data Protection Officer
Perceval House
14-16 Uxbridge Road
Ealing
London
W5 2HL
Tel: (020) 8825 8282
Email: dataprotection@ealing.gov.uk
Public Communications Unit
Department for Education
Sanctuary Buildings
Great Smith Street
London
SW1P 3BT
Telephone:0370 000 2288
Email: Here
You have the right to make a complaint at any time to the Information Commissioner’s Office, the UK supervisory authority for data protection issues here.