Powys Schools Privacy Notice
In accordance with General Data Protection Regulation (GDPR) this notice sets out what your School, Ysgol Gynradd Llanidloes, the Local Authority (Powys County Council) (LA) and the Welsh Government (WG) does with the education related information that they receive about Children and Young People.
Covid-19 – please note that under Regulation 3 of the Health Protection (Local Authority Powers) (Wales) Regulations 2010, the headteacher of a school is required to provide the names, addresses and contact telephone numbers of all pupils in their school, or any group of pupils attending that school, when certain circumstances apply. For example, when there is reason to believe that there is or has recently been a person on the school’s premises who is or may be infected. Therefore, if your child is absent from school with suspected Covid-19 then this information will be passed on to Powys County Council for them to monitor any possible cluster areas.
The school collects information about children and young people and their parents or legal guardians when children and young people enrol at the school. The school also collects information at other key times during the school year and may receive information from other schools or early years providers when children and young people transfer.
The school processes the information it collects to administer the education it provides to children and young people:
- the provision of educational services to individuals;
- monitoring and reporting on pupils’ educational progress;
- the provision of welfare, pastoral care and health services;
- the giving of support and guidance to children and young people, their parents and legal guardians;
- the organisation of educational events and trips and to inform you about events and other things happening in school;
- to keep pupils safe (food allergies or emergency contact details);
- the planning and management of the school.
The LA(Powys County Council)collects information about children and young people and their parents or legal guardians when children and young people apply for admission to the school. The LA also has access to data collected by the school for the same reasons listed above and for the following additional purposes:
- to monitor, challenge and provide support to schools to improve performance and set credible targets;
- to support schools in the services delivered to children and young people;
- to inform and support services provided by the Children and Young People’s Partnership (CYPP) and the Powys Youth Service to young people and their families;
- to carry out research and inform policy decisions including funding for schools;
- to monitor the quality and scope of data held by schools and provide support to ensure the data held about children and young people is accurate and up-to-date.
Upon receipt of the information from your school the LA also becomes the Data Controller. Our lawful basis for collecting and processing pupil information is defined under Article 6, and the following sub-paragraphs in the GDPR apply:
a) data subject gives consent for one or more specific purposes;
b) processing is necessary to comply with the legal obligations of the controller;
c) processing is necessary to protect the vital interests of the data subject;
d) processing is necessary for tasks in the public interest or exercise of authority vested in the controller (provision of education)
Our lawful basis for collecting and processing pupil information is also further defined under Article 9, in that soe of the information we process is deemed to be sensitive or special, and the following sub-paragraphs in the GDPR apply:
a) the data subject has given explicit consent;
b) it is necessary to fulfil the obligations of the controller or data subject;
c) it is necessary to protect the vital interests of the data subject;
d) processing is carried out by a foundation or no-for-profit organisation;
e) reasons of public interest in the area of public health;
f) it is in the public interest.
As data controllers, the school and LA use the information received for the purposes listed above to enable them to carry out data processing necessary for the performance of a task carried out in the public interest and in the exercise of official authority.
In addition, the WG receives information on pupils directly from schools normally as part of statutory data collections:
- Pupil Level Annual School Census (PLASC);
- Educated other than at school (EOTAS) pupil level collection;
- National data collection (NDC);
- Attendance collection;
- Welsh National Tests (WNT) data collection.
In addition to the data collected as part of PLASC, the WG and LA also receive information regarding National Curriculum assessments and attendance data at individual pupil level which comes from schools.
2. What information is held by the school and LA?
The sort of personal information that will be held includes:
- personal details (name, address, date of birth, child identifiers, contact details for parents/guardians, photographs);
- characteristics (ethnicity, language, free school meal entitlement);
- details about children’s immigration status (used only to prepare summary statistical analyses);
- safeguarding information (court orders and professional involvement);
- additional learning needs (including the needs and ranking);
- medical and administration (doctors information, child health, dental health, allergies, medical and dietary requirements);
- attendance (sessions attended, number of absences, absence reasons, previous schools attended);
- assessment and attainment (key stage and results);
- behavioural information (exclusions and any alternative provision put in place);
- information about the involvement of social services with individual children and young people where this is needed for the care of the child/young person;
- we may also hold data about pupils that we have received from other organisations (others schools, LAs and WG).
3. Who does the school and LA share your information with?
Information held by the school and LA on children and young people, their parents or legal guardians may be shared with other organisations when the law allows providing all appropriate steps are taken to keep the information secure, for example:
- other education and training bodies, including schools, when children and young people are applying for courses or training, transferring schools or seeking guidance on opportunities;
- bodies doing research for the WG, LA and schools as long as steps are taken to keep the information secure;
- central and local government for the planning and provision of educational services;
- social services and other health and welfare organisations where there is a need to share information to protect and support individual children and young people (including Police Forces, Courts and security organisations);
- Management Information System providers in order to ensure that system functionality and accuracy is maintained;
- The LA’s approved supplier of the schools ‘cashless’ system to ensure all pupils, parents, guardians and school staff are able to use it as appropriate;
- Powys Teaching Health Board to support the provision of an effective School Nurse Service and other related health services for young people and their families;
- FFT Education Research Trust (https://fft.org.uk/about-fft/) for the maintenance of the secure on-line FFT Aspire resource for schools enabling thorough self-evaluation using extensive progress measures and effective target-setting for pupil achievement;
- GL Assessment (https://www.gl-assessment.co.uk/about-us/) for the administration of annual cognitive ability tests (CATs) and other similar diagnostic tools to support individual learning;
- The South West and Mid-Wales Education Consortium to support regional statistical analysis as required by WG;
- various regulatory bodies, such as ombudsmen and inspection authorities, where the law requires that information be passed on so that they can do their work;
- The Office of National Statistics (ONS) in order to improve the quality of migration and population statistics.
Sharing personal information with curriculum-based software suppliers
The school may provide limited personal (but not sensitive) information to external companies providing a curriculum-based resource (which may be on-line) which is deemed to have educational value. In these circumstances the school will ensure that all reasonable precautions are taken to preserve the security of the data in line with current legislation and that the external supplier meets all legal requirements regarding the handling of this data as specified in a formal written agreement between the school and the supplier.
The school will endeavour to ensure that information is kept accurate at all times. Personal information will not be sent outside the UK unless it is protected by the enhanced security arrangements associated with WG’s digital learning platform, Hwb. Details are available at: http://gov.wales/topics/educationandskills/publications/guidance/information-governance-guidance-for-schools/?lang=en
A list of companies and their applications currently used by the school in this way is held at school.
Sharing information with other suppliers
The school may provide limited personal (but not sensitive) information to external companies. In these circumstances the school will ensure that all reasonable precautions are taken to preserve the security of the data in line with current legislation and that the external supplier meets all legal requirements regarding the handling of this data as specified in a formal written agreement between the school and the supplier.
The school will endeavour to ensure that information is kept accurate at all times. Personal information will not be sent outside the UK unless it is protected by the enhanced security arrangements associated with the WG’s digital learning platform, Hwb. Details are available at: http://gov.wales/topics/educationandskills/publications/guidance/information- governance-guidance-for-schools/?lang=en
Companies and their applications currently used by the school in this way are:
- Teachers2Parents (text messaging service)
- Colorfoto (photography provider)
4. What information is received by Welsh Government?
Personal and special category information that will be collected and held includes:
- Some personal information, such as:
- date of birth
- ethnic group
- disability status
- other health information
- Information on any Additional Learning Needs;
- Information on performance in national assessments and examinations;
- Information from your child’s school about their education;
- Information on attendance
5. How long will this data be kept?
Your school, LA and WG will keep this data until the pupil’s 25th birthday or for the duration of the criteria which underpin the statutory regulation. After this point the data will be anonymised in line with best practices and used only for statistical and research purposes.
6. Your rights under the GDPR
Under data protection legislation, parents and pupils have the right to request access to information about them that we hold, through a Subject Access Request (SAR). Parents and guardians can make a request with respect to their child’s data where the child is not considered mature enough to understand their rights over their own data (usually under the age of 12), or where the child has provided consent.
Parents also have the right to make a SAR with respect to any personal data that the school holds about them.
If you make a SAR and we hold information about you or your child, we will:
- give you a description of it;
- tell you why we are holding and processing it and how long we will keep it for;
- tell you who it has been, or will be, shared with;
- let you know whether any automated decision-making is being applied to the data and any consequences of this;
- give you a copy of the information in an intelligible form.
You also have the right to:
- require the school or LA to rectify any inaccuracies in that data;
- object (in some circumstances) to processing on grounds relating to your particular situation;
- restrict processing (in some circumstances);
- lodge a complaint with the Information Commissioner who is the independent regulator for data protection.
For further details about the information which your school and the LA holds and its use, or if you wish to exercise your rights under the GDPR, please see contact details below:
School:- Ysgol Gynradd Llanidloes, Llangurig Road, Llanidloes SY18 6EX
Telephone:- 01686 412603
Local Authority:- Data Protection, Information Compliance Team, County Hall, Llandrindod Wells LD1 5LG
To contact the Information Commissioner’s Office:
ICO:- Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Telephone helpline:- 029 2067 8400 (Wales helpline) or 0303 123 1113 (UK helpline)