Data Protection Concerns for Schools

Data Sharing

You should be mindful of data protection issues when sharing personal data. This is the case even where such sharing takes place in order to comply with mandatory regulatory or legal requirements, for example when reporting a concern to Children's Services or sharing data with the ISI in connection with an inspection.

In particular, you should ensure that you are complying with the information security requirements of data protection law.

Many organisations will provide platforms to enable information to be shared confidentially, for example a secure file transfer service or secure email. Although this is the case, a school must still be satisfied that the method used by the academy is robust. In most cases, we would expect schools to conclude that what is offered is sufficiently secure, but if in doubt, the data should be encrypted before it is transferred. This will help ensure that the data remains secure, even if there is a security breach (for example if the secure email platform is accessed by a hacker).

Subject Access Requests

Individuals can make a request for a copy of the information held about them, and in some cases, a copy of information held about their child (a subject access request - SAR). As any person who has had to deal with such a request will know, SARs can take up a lot of time and effort and are often used by individuals to 'fish' for information that may be relevant to an ongoing dispute or claim.

Schools have 40 calendar days to respond to a SAR. Unlike Freedom of Information Act requests, which are relevant to academies and maintained schools, there is no exemption for non-school days when it comes to SARs.

This means that if a school receives a request shortly before the start of the summer holidays it cannot wait until the new term starts in September before responding. You should therefore ensure that your staff are trained to spot SARs so that they can be dealt with promptly and in good time before the school breaks up.

Our eLearning Solutions platform includes two data protection courses for staff. The first covers data protection essentials and the second focuses on information security. The courses provide practical guidance to staff on a wide range of data issues including those set out above.

To find out more about eLearning Solutions, please complete the below form or call Imogen Street on 07384 545998.

If you have any questions or concerns about data protection, please contact Andrew Gallie in our Data Protection team on 0117 314 5623.