Is Your School Fulfilling its Data Protection Obligation to Provide Privacy Notices?
Under data protection law, schools must be transparent with individuals about the data which is held about them.
As part of this, schools are required to make certain information available to individuals, including pupils, staff and parents. This includes information about what data is collected and what it might be used for. This information is usually provided to individuals in a document known as a privacy notice or a fair processing statement.
What are the benefits of having well drafted privacy notices?
As well as fulfilling your data protection obligations, privacy notices help to build trust and promote transparency. This can help to lessen the risk of complaints about how your school uses personal data.
Are we not covered by our data protection policies?
You may be wondering how this relates to your school's data protection policies. The DPA is not prescriptive about how a privacy notice should be provided. However, we would caution against including privacy notices within a data protection policy for two reasons:
- A privacy notice which is included within a policy would not be sufficiently accessible and is unlikely to be read.
- Data protection policies should provide practical guidance to staff on how to be data protection compliant when they are handling personal data. Policies therefore have a different purpose to privacy notices.
How does this relate to pupils and their parents?
Children are generally considered to have sufficient maturity to exercise their own data protection rights from and including the age of 12 years old. If your school has pupils of this age, they should be provided with a privacy notice which is age appropriate and easy to understand. We suggest that parents are asked to read this notice with their child.
When pupils are younger than 12 years old their parents will exercise their data protection rights for them. A privacy notice about pupil information should therefore be provided to the parents of these younger children.
We recommend having a separate privacy notice for parents because you will be processing information about them which does not apply to pupils, such as financial information.
How does the privacy notice requirement work alongside our contract with parents?
Our parent contract template includes a privacy notice for parents.
Should we give a privacy notice to staff?
Yes, staff should receive a privacy notice. This is commonly included in an employment manual or with other information that staff are expected to read when they join your school.
How can VWV help?
We have template privacy notices for staff, pupils and parents which we can tailor to your school.
In light of the importance of notices for children being accessible, we have 'road tested' our template privacy notice for pupils with a group of children. We were keen to ensure that they found our privacy notice easy to understand. We have used their feedback to develop our pupil privacy notice template.