Data Protection Policy

1. JOHN THE BAPTIST’S COLLEGE PORTADOWN

 

Data Protection and Privacy Notice                                September 2021

School Mission Statement

St John the Baptist’s College (SJBC) is an inclusive, caring Catholic school which is committed to delivering high quality education for all its students. Through close collaboration and positive relationships with parents and a variety of contributory/partner agencies, the college offers enriching learning experiences and equips all students with the skills, knowledge and mind set to achieve their full academic potential. The highly pastoral, warm and nurturing ethos of the SJBC family permeates all aspects of school life and is central to all decision making within the college. In SJBC, we value the personal, moral, social and spiritual development of each of our students, encouraging respect for self and others including the core values of honesty, kindness, empathy, integrity and compassion.

 

School Vision

Our vision is to educate and develop our students to the highest possible standard, providing equality of opportunity to a broad, enriching and balanced curriculum that is both relevant in today’s world and challenging to all learners. We aim to promote and grow a culture of life-long learning among students and staff within the college. We endeavour to develop wider life skills and personal capabilities to help our students grow into healthy, well-rounded and successful adults capable of making informed and responsible choices. As a faith based community we are committed to awakening a devotion to God and daily prayer within our young people, challenging them to live out Christian values in their dealings with others according to our Catholic faith.

 

Policy Status

Statutory

St. John the Baptist’s College collects and uses personal information about staff, pupils, parents and other individuals who come into contact with the school. This information is gathered in order to enable it to provide education and other associated functions. In addition, there may be a legal requirement to collect and use information to ensure that the school complies with its statutory obligations.

Schools have a duty to be registered, as Data Controllers, with the Information Commissioner’s Office (ICO) detailing the information held and its use. These details are then available on the ICO’s website. Schools also have a duty to issue a Privacy Notice to all pupils/parents, this summarises the information held on pupils, why it is held and the other parties to whom it may be passed on.

 

Aims and Objectives

This policy is intended to ensure that personal information is dealt with correctly and securely and in accordance with the Data Protection Act 1998, and other related legislation. It will apply to information regardless of the way it is collected, used, recorded, stored and destroyed, and irrespective of whether it is held in paper files or electronically.

All staff involved with the collection, processing and disclosure of personal data will be aware of their duties and responsibilities by adhering to these guidelines.

 

What is Personal Information?

Personal information or data is defined as data which relates to a living individual who can be identified from that data, or other information held.

 

Data Protection Principles

The Data Protection Act 1998 establishes eight enforceable principles that must be adhered to at all times:

1. Personal data shall be processed fairly and lawfully;
2. Personal data shall be obtained only for one or more specified and lawful purposes;
3. Personal data shall be adequate, relevant and not excessive;
4. Personal data shall be accurate and where necessary, kept up to date;
5. Personal data processed for any purpose shall not be kept for longer than is necessary for that purpose or those purposes;
6. Personal data shall be processed in accordance with the rights of data subjects under the Data Protection Act 1998;
7. Personal data shall be kept secure i.e. protected by an appropriate degree of security;
8. Personal data shall not be transferred to a country or territory outside the European Economic Area, unless that country or territory ensures an adequate level of data protection.

General Statement

The school is committed to maintaining the above principles at all times. Therefore, the school will:

• Inform individuals why the information is being collected when it is collected
• Inform individuals when their information is shared, and why and with whom it was shared
• Check the quality and the accuracy of the information it holds
• Ensure that information is not retained for longer than is necessary
• Ensure that when obsolete information is destroyed that it is done so appropriately and securely
• Ensure that clear and robust safeguards are in place to protect personal information from loss, theft and unauthorised disclosure, irrespective of the format in which it is recorded
• Share information with others only when it is legally appropriate to do so
• Set out procedures to ensure compliance with the duty to respond to requests for access to personal information, known as Subject Access Requests
• Ensure our staff are aware of and understand our policies and procedures

 

 

 

 

 

 

 

 

Processing, Storing, Archiving and Deleting Personal Data:

 

• Personal data and school records about pupils are confidential to the child. The information can be shared appropriately within the professional working of the school to enable the school to make the best educational provision for the child. The law permits such information to be shared with other educational establishments when pupils change schools.
• School records for a child should be kept for 7 years after the child leaves the school or until the child reaches 25 years of age (whichever is greater) and examination records the same.
• Data on staff is sensitive information and confidential to the individual, and is shared, where appropriate, at the discretion of the Principal and with the knowledge, and if possible the agreement of the staff member concerned.
• Employment records form part of a staff member’s permanent record. Because there are specific legislative issues connected with these (salary and pension details etc.) these records should be retained as set out by the LA.
• Interview records, CV’s and application forms for unsuccessful applicants are kept for 6 months.
• All formal complaints made to the Principal or School Governors will be kept for a minimum period of six years in confidential files, with any documents on the outcome of such complaints. Individuals concerned in such complaints may have access to such files subject to data protection and to legal professional privilege in the event of a court case.

Privacy Notice of Personal Data: Data Which May Be Shared

Schools, local education authorities and the Department for Education (DE) all hold information on pupils in order to run the education system, and in doing so have to follow the Data Protection Act 1998. This means, amongst other things that the data held about pupils must only be used for specific purposes allowed by law. The school has a Privacy Notice which explains how personal data is used and with whom it will be shared.

(See Appendix 2)

The Local Education Authority uses information about pupils to carry out specific functions for which it is responsible, such as the assessment of any additional educational needs the pupil may have. It also uses the information to derive statistics to inform decisions on (for example) the funding of schools, and to assess the performance of schools and set targets for them. The statistics are used in such a way that individual pupils cannot be identified from them.

 

Contacts

If you have any enquires in relation to this policy, please contact Mrs N. Murray, Principal, who will also act as the contact point for any subject access requests.

 

Complaints

Complaints should be made to the Chairman of the Governing Board who will decide whether it is appropriate for the complaint to be dealt with in accordance with the school’s complaint procedure.

Complaints which are not appropriate to be dealt with through the school’s complaint procedure can be dealt with by the Information Commissioner.

Further advice and information is available from the Information Commissioner’s Office, www.ico.gov.uk/for-organisations/guide-to-data-protection/

 

Review

This policy will be reviewed as it is deemed appropriate, but no less frequently than every 2 years. The policy review will be undertaken by the Principal, or nominated representative.

Appendix 1

 

St. John the Baptist’s College

Procedures for responding to subject access requests made under the Data Protection Act 1998

 

Rights of access to information

There are two distinct rights of access to information held by schools about pupils.

1. Under the Data Protection Act 1998 any individual has the right to make a request to access the personal information held about them.

1. The right of those entitled to have access to curricular and educational records

These procedures relate to subject access requests made under the Data Protection Act 1998.

 

Subject Access Request (SAR)

1. Requests for information must be made in writing; which includes email, and be addressed to Mrs N. Murray, Principal. If the initial request does not clearly identify the information required, then further enquiries will be made.

1. The identity of the requestor must be established before the disclosure of any information, and checks should also be carried out regarding proof of relationship to the child. Evidence of identity can be established by requesting production of:
   • passport
   • driving licence
   • utility bills with the current address
   • Birth / Marriage certificate
   • P45/P60
   • Credit Card or Mortgage statement

This list is not exhaustive.

1. Any individual has the right of access to information held about them. However, with children, this is dependent upon their capacity to understand (normally age 12 or above) and the nature of the request. The Principal would discuss the request with the child and take their views into account when making a decision. A child with competency to understand can refuse to consent to the request for their records. Where the child is not deemed to be competent an individual with parental responsibility or guardian shall make the decision on behalf of the child.

1. The school may make a charge for the provision of information, dependent upon the following:

• Should the information requested contain the educational record then the amount charged will be dependent upon the number of pages photocopied

• If the information requested is only the educational record viewing will be free.

1. The response time for subject access requests, once officially received, is 40 days (not working or school days but calendar days, irrespective of school holiday periods). However, the 40 days will not commence until after receipt of fees or clarification of information sought

1. The Data Protection Act 1998 allows exemptions as to the provision of some information; therefore, all information will be reviewed prior to disclosure.

1. Third party information is that which has been provided by another, such as the Police, Local Authority, Health Care professional or another school. Before disclosing third party information consent must be obtained, and would be provided within the 40-day statutory timescale.

1. Any information which may cause serious harm to the physical or mental health or emotional condition of the pupil or another would not be disclosed, nor should information that would reveal that the child is at risk of abuse, or any information relating to court proceedings.

1. If there are concerns over the disclosure of information then additional advice may be sought by the Principal.

1. Where redaction (information blacked out/removed) has taken place then a full copy of the information provided will be retained in school in order to establish, if a complaint is made, what was redacted and why.

1. Information disclosed will be clear, any codes or technical terms will be clarified and explained. If information contained within the disclosure is difficult to read or illegible it may be retyped.

1. Information can be provided at the school with a member of staff on hand to help and explain matters if requested, or provided at a face to face handover meeting. The views of the applicant will be taken into account when considering the method of delivery. If postal systems have to be used, then registered/recorded mail must be used.

 

 

 

 

 

 

 

 

 

Appendix 2

 

Privacy Notice - Data Protection Act 1998

St. John the Baptist’s College is a data controller for the purposes of the Data Protection Act. We collect information from you and may receive information about you from your previous school and the Learning Records Service. We hold this personal data and use it to:

• Support your teaching and learning;

• Monitor and report on your progress;

• Provide appropriate pastoral care, and

• Assess how well your school is doing.

This information includes your contact details, national curriculum assessment results, attendance information and personal characteristics such as your ethnic group, any additional educational needs and relevant medical information. If you are enrolling for post 14 qualifications, we will be provided with your unique learner number (ULN) by the Learning Records Service and may also obtain from them details of any learning or qualifications you have undertaken.

 

We will not give information about you to anyone outside the school without your consent unless the law and our rules allow us to.

We are required by law to pass some information about you to the Local Authority and the Department for Education (DE)

If you want to see a copy of the information about you that we hold and/or share, please contact Mr P. Rath, School Data Manager.

If you require more information about how the Education Authority (EA Southern Region) and/or DE store and use your information, then please go to the following websites:

http://www.eani.org.uk/about-us/think-data/data-protection-resources-for-schools/

If you are unable to access these websites we can send you a copy of this information. Please contact the EA (Southern Region) or DE as follows:

Armagh Office

Address 
3 Charlemont Place, The Mall,
Armagh, BT61 9AX 

Contact 
Tel: +44 (0)28 3751 2200
Email: info@eani.org.uk 

Contacts

Rathgael House
Balloo Road
Rathgill
Bangor
BT19 7PR

Telephone: 028 9127 9279
Email: DE.DEWebMail@education-ni.gov.uk