We look at some key data protection issues which schools have recently asked us to advise on.
DfE guidance provides that a school's first port of call would be to contact the health authorities through the DfE helpline. As such, we suggest treating such a request as a request to not share coronavirus (COVID-19) related information with health authorities more generally, not just Test and Trace.
Data protection law does not prevent a school from sharing information about pupils and parents with health authorities, even against their wishes. If a situation does in fact arise, any decision to pass information on should involve a balancing exercise based on the individual circumstances of the case, taking account of the wider benefits (for example, to public health) against individual data protection rights.
The school should look carefully at the reason for the objection and in many cases may well conclude that the balance lies in favour of disclosure. Any objection might count as a formal 'right to object' request under the GDPR.
Organisations in the hospitality sector are required to keep records relating to staff and customers and share those records with NHS Test and Trace if requested. This may be relevant to school commercial activities, as the requirements apply to a number of different settings including cafes and indoor sport and leisure centres.
See the Government's latest guidance on this.
This will require a careful judgement and should be considered on a case by case basis. Adopting a blanket rule that all staff will be informed is unlikely to be data protection compliant. There may be specific circumstances that would justify revealing the name of the pupil to specific staff members, for example, if a member of staff had been in close contact with the pupil and lived with a vulnerable individual.
This will engage with many of the issues that the school might have already considered when handling personal data relating to the pandemic:
There will also likely be a number of wider issues to consider. For example, how the testing fits in with the school's health and safety obligations, employment law and the school's rights and duties under the parent contract.
Data protection law does not prevent this in principle but such a policy would raise a number of additional legal and practical issues, particularly as DfE guidance states that pupils are not required to use the app. In addition, the app does not work on older devices and the school will also need to consider how such a policy would fit in with the school's existing mobile phone policies and practices.
Many of the points above in relation to using coronavirus testing equipment apply here as well.