Additional Data Protection information
In addition to the Privacy Notices published here we have also published some additional information through High Notes. These articles are published here for ease of access:
New data protection laws (GDPR)
First published in High Notes 4 May 2018
In recent weeks we have all been receiving email messages from companies that want to continue sending us marketing emails. New laws coming into force on May 25th mean that these companies are now forced to get our consent properly before they can send us marketing emails. If you choose not to respond to these emails then, at least in theory, your inbox should be a lot less cluttered after May 25th.
We will not be asking your permission to send you emails because the emails that we send are not for marketing purposes, but are part of how we fulfil our duty as a school. We send you emails in order that we can do our job as a school and educate your child effectively, and to help you to play your role in supporting that. We therefore need to keep you informed about what is happening in school, upcoming educational events (such as parents’ evenings) that you might need to attend and other important news, like this, so that we can work together to support your child.
The new data protection laws do mean that will need to monitor the messages we send out and, if they are ever not strictly relevant to our business as a school, we may have to consider asking for your explicit permission to use your contact information for this new purpose. Currently we take the view that the content of publications such as this one is sufficiently relevant to our core business as a school that we are simply fulfilling our public duty by sending it to you.
Email and SMS communication is only one aspect of the new legislation, however. We have a number of other tasks to complete before May 25th in order to ensure that we are compliant with the new legislation.
- We will soon be publishing new privacy notices that explain, for example, how we process students’ and home contacts’ data, what data we process, and who we share it with.
- We are changing the way we ask permission to take and use photographs and videos of our students. In doing so we are seeking to ensure that we can celebrate the great variety of students’ achievements whilst being compliant with the law and not creating a bureaucratic.
- GDPR compliance has prompted us to encourage whether we really need portable hard drives in school any longer. USB drives are a cause of many problems in school, particularly when they are lost or corrupted and students then lose important work. These devices should no longer be necessary because of the cloud computing tools we make available to students, so we are planning to stop students and most staff from using them from September onwards.
Some of these themes will feature as articles in the forthcoming editions of High Notes. In the meantime, we would encourage you to discuss data privacy with your children when it comes up in the news, and show them how they can check what information they are sharing publicly on the Internet and what information companies such as Facebook are able to access about them and pass on to other organisations.
We also need to process data in school to educate your child. For example, we keep assessment results, contact details, attendance records and so on. Because these are needed for the job we are expected to do, we do not need to seek consent to hold this data. If we decided we wanted to use this information for other purposes like selecting students to target a commercial promotion, or passing the information to a company that wanted to do this, then we would have to have your explicit consent to do so. We can’t imagine ever wanting or needing to do that.
However, we are planning to ask students for their consent to use photographs and videos of them for the purpose of publicity and marketing. We do want to make sure parents of prospective students know about the great things that our students get involved in, and we want to celebrate the many different things that our students give to the community and achieve in competitions. However, this is not part of the essential function that you would expect us to perform – it’s an extra. It is therefore right that we check that you are happy for us to use your image for these purposes, and if at any time you change your mind that’s fine. We will be in touch with students in due course about this. We expect that the law will require us to get parents’ permission until students are around 13 years of age, and from then on we will need permission instead from the students themselves. There may be some exceptions to this and our understanding is that we can treat the whole year group in the same way even though there will be a difference in age between the oldest and youngest. It is important that we do this efficiently so we are looking at building this consent into an existing process like the data checking process or the Key Stage 4 options process.
There are still some cases in which we will use images without consent. For example, we will still need to keep a copy of their photograph in our school database for identification and administrative purposes. Teachers and pastoral staff use the photographs to help them to learn the names of their students, for example, and this is a legitimate use of such data within a school. We will also sometimes need to use videos of lessons for staff training purposes within school, or images of performances for assessment purposes. For these purposes also, we would not normally ask for consent as we have a legitimate interest in using these images within school to perform our function as a school.
New data protection laws (GDPR)
First published in High Notes 11 May 2018
This is the second in a series of articles about changes that we are making in response to the imminent changes of law in relation to data protection. Last week I wrote about emails and the basis on which we process data. This week’s article is about something that will affect students directly.
Although most of the changes we are making in response to GDPR are administrative and will not be noticed by most students, one area in which students will notice a definite change is that we will be phasing out the use of portable drives for storing files. This is happening for a variety of different reasons, and GDPR is simply the one which tipped the balance in favour of making a definite change.
- USB drives are notoriously unreliable and frequently lost by students; this is a big issue for students when they lose their coursework or crucial notes as they do with monotonous regularity
- USB drives are a potential source of transmission of malware and viruses
- We have a reliable cloud drive service available to all students (Office 365’s OneDrive) which means they do not need USB drives to make their files portable; One Drive is also properly backed up so that earlier versions of files can be recovered when needed
- We want to ensure that we do everything we can to reduce or remove the possibility of data being lost by our staff
Our staff are not storing students’ personal data on their USB drives at the moment, but we want to remove the possibility of accidents happening and get everyone used to accessing OneDrive, so we will be taking steps to force this issue and by September the computers in school will not recognise USB drives when they are plugged in.
Privacy Notices
We have revised our privacy notices and are waiting for legislation to complete its journey through parliament before finalising them and sharing them with students, staff and parents/ carers. These documents set out, as simply as possible, what data we hold, who we share it with and what sort of purposes we put it to. Very little of this will be surprising to anyone, but the privacy of our data is an increasingly important issue and something that we need our children to be aware of and concerned to protect. The process of implementing GDPR (General Data Protection Legislation) is therefore a good opportunity for conversations to take place with students, both at home and at school, about who has access to our data and whether they are using it for purposes with which we are happy.
GDPR: photographs and videos and other information used in school publicity
This is a fuller version of the article published in High Notes on 25 May 2018
In a previous article we explained that most of the data we use in school is processed in order for us to perform our public duty as a school. There are, however, some things that we want to do that are not essential for the purpose of educating children and we therefore need to ensure that we are clear about why we are doing them. One of those is the way we publicise students’ activities and achievements on our website, in High Notes and other ways.
We are very proud of the varied and rich curriculum that our students benefit from. We love to see coverage of our students rising to a wide range of challenges, both in the classroom and beyond. Our students take part in a huge range of opportunities on educational visits, expeditions, work experience placements, sporting, legal and other competitions. We believe that our students and parents/ carers are proud to see these documented in High Notes and are happy when local journalists take these stories and publicise them more widely. However, we do feel that we need to ensure that students and their parent understand that we only want to include children in these things when they are happy for us to do so. We therefore need to ensure we have consent in some appropriate form.
If we went about this in the wrong way, we could make it an incredibly difficult exercise for everyone involved and effectively put a stop to the celebration of students’ achievements. High Notes would quickly become a very dry publication and it would be a rare occasion when our students’ photographs made it into the local media. We don’t want to stop doing something that we believe you are happy with and we therefore plan to continue publishing these photographs but adjust how we get consent in future to ensure we are compliant with data protection rules.
- For students in Year 7 and 8 it seems likely that we will need to ask for permission from parents and carers to publish information, photographs and videos for publicity purposes. This is because students are not considered to be competent to make this choice for themselves until they are 13. We will be in touch about this in due course but, in the meantime, we will continue to publish information where we feel confident that students and their parents will be happy for us to do so. If you would prefer us to take a more cautious approach for your child then please let our Data Protection Officer, Mr Haigh know by emailing him at dhaigh@wilmslowhigh.cheshire.sch.uk
- For students in Year 9 to Year 13 we will continue to publish publicity information where we are confident that they are happy for us to do so. At this age students’ consent is needed rather than that of their parents or carers. We already routinely explain to students why we are taking a photograph and students are never obliged to be included. Consent can be given in different ways; agreeing to be in a photograph can be informed consent provided students understand what the purpose of the photograph is and they are not placed under pressure to take part.
We do not plan to ask for retrospective permission for the photographs we have already published in High Notes and on our website generally: we have always invited students to volunteer to be in these photographs and we believe that they understood what the intended purpose of the photograph was at the time. However, if we have published pictures that students would rather were no longer on our website, they should let us know (more details of how below).
We prefer the approach of giving students an informed choice at the time photographs are taken because it is the best way to ensure they know what they are giving permission for, and the simplest way for us to handle things.
Students may be very happy to be photographed in certain situations and less so in others; it seems reasonable that they should make this choice at the time rather than having to change their privacy settings somewhere. However, we do need to make sure that both staff and students are clear that there is a choice.
We therefore propose to involve our students in the training process, through assemblies and other means, so that they can help us to ensure that we are doing what they want with their images.
There are some exceptions to this process. Where photographs or videos are taken as part of normal school business, e.g. for learning or assessment purposes, or as part of staff development then consent is not necessarily appropriate or required. Also, where a photograph is taken to illustrate an ongoing activity and individual students are not easily identifiable in the photograph then we will not treat this as personal data but will still be careful to use the image appropriately.
If we ever publish an image that a student or parent has any concerns about then we would want to hear about the concerns as soon as possible so that we can address them. Students and parents will often know who best to contact about this but if in doubt they can always email school reception or contact the school’s Data Protection Officer. Contact details for the Data Protection Officer are available in our newly published Privacy Notice on the school website at: http://www.wilmslowhigh.com/about-us/school-policies/