Powys Schools Privacy Notice
In accordance with General Data Protection Regulation (GDPR) this notice sets out what your School, Ysgol Gynradd Llanidloes, the Local Authority (Powys County Council) (LA) and the Welsh Government (WG) does with the education related information that they receive about Children and Young People.
The school collects information about children and young people and their parents or legal guardians when children and young people enrol at the school. The school also collects information at other key times during the school year and may receive information from other schools or early years providers when children and young people transfer.
The school processes the information it collects to administer the education it provides to children and young people. For example:
- the provision of educational services to individuals;
- monitoring and reporting on pupils’ educational progress;
- the provision of welfare, pastoral care and health services;
- the giving of support and guidance to children and young people, their parents and legal guardians;
- the organisation of educational events and trips and to inform you about events and other things happening in school;
- to keep children safe (food allergies or emergency contact details);
- the planning and management of the school;
- making use of photographic images of pupils in school publications and on the school website;
- security purposes, including CCTV.
The LA (Powys County Council) collects information about children and young people and their parents or legal guardians when children and young people apply for admission to the school. The LA also has access to data collected by the school for the same reasons listed above and for the following additional purposes:
- to monitor, challenge and provide support to schools to improve performance and set credible targets;
- to support schools in the services delivered to children and young people;
- to inform and support services provided by the Children and Young People’s Partnership (CYPP) and the Powys Youth Service to young people and their families;
- to carry out research and inform policy decisions including funding for schools and early years providers;
- to monitor the quality and scope of data held by schools and provide support to ensure the data held about children and young people is accurate and up-to-date.
Upon receipt of the information from your school the LA also becomes the Data Controller. Our lawful basis for collecting and processing pupil information is defined under Article 6, and the following sub-paragraphs in the GDPR apply:
- data subject gives consent for one or more specific purposes;
- processing is necessary to comply with the legal obligations of the controller;
- processing is necessary to protect the vital interests of the data subject;
- processing is necessary for tasks in the public interest or exercise of authority vested in the controller (the provision of education).
Our lawful basis for collecting and processing pupil information is also further defined under Article 9, in that some of the information we process is deemed to be sensitive, or special information and the following sub-paragraphs in the GDPR apply:
- the data subject has given explicit consent;
- the processing is necessary for the purposes of carrying out the obligations of the data controller (the school) or the data subject in the field of social protection law;
- it is necessary to protect the vital interests of the data subject;
- reasons of public interest in the area of public health;
- for the provision of Social Care;
- it is in the public interest.
As data controllers, the school and LA use the information received for the purposes listed to enable them to carry out data processing necessary for the performance of a task carried out in the public interest and in the exercise of official authority.
In addition, the WG receives information on pupils directly from schools normally as part of statutory data collections which consists of the following:
- post-16 data collection
- Pupil Level Annual School Census (PLASC)
- Educated Other Than At School (EOTAS) pupil level collection
- National data collection (NDC)
- attendance collection
- Welsh National Tests (WNT) data collection
In addition to the data collected as part of PLASC, the WG and LA also receive information regarding National Curriculum assessments, public examination results, and attendance data at individual pupil level which comes from schools and /or Awarding Bodies (e.g. WJEC).
2. What information is held by the school and LA?
The sort of personal information that will be held includes:
- personal details such as name, address, date of birth, child/young person identifiers and contact details for parents and guardians; photographs (including images of pupils engaging in school activities);
- characteristics (such as ethnicity, language, and free school meal eligibility);
- details about children’s and young people’s immigration status (used only to prepare summary statistical analyses);
- safeguarding information (such as court orders and professional involvement);
- additional learning needs (including the needs and ranking);
- medical and administration (doctors’ information, child health, dental health, allergies, medication, dietary requirements);
- attendance (such as sessions attended, number of absences, absence reasons and any previous schools attended);
- assessment and attainment (such as key stage and results, post-16 courses enrolled for and any relevant results);
- behavioural information (such as exclusions and any relevant alternative provision put in place);
- information about the involvement of social services with individual children and young people where this is needed for the care of the child/young person;
- data about pupils that we have received from other organisations, including other schools, LAs and WG;
- CCTV Images*.
*We have CCTV systems in key locations for the purposes of safety and prevention and detection of crime. We will only disclose CCTV images to third parties for the purposes of public safety and the prevention and detection of crime. CCTV images will not be released to the media for entertainment purposes or placed on the internet. Images captured by CCTV will not be kept for longer than necessary.
3. Who does the School and LA share your information with?
Information held by the school and LA on children and young people, their parents or legal guardians may also be shared with other organisations when the law allows and providing all appropriate steps are taken to keep the information secure, for example:
- other education and training bodies, including schools, when children and young people are applying for courses or training, transferring schools or seeking guidance on opportunities;
- bodies doing research for the WG, LA and schools as long as steps are taken to keep the information secure;
- central and local government for the planning and provision of educational services;
- social services and other health and welfare organisations where there is a need to share information to protect and support individual children and young people; including Police Forces, Courts and Tribunals and security organisations;
- Management Information System (MIS) providers in order to ensure that system functionality and accuracy is maintained;
- the LA’s approved suppliers of the schools’ cashless system to ensure all pupils, parents, guardians with parental responsibility and school staff are able to use it as appropriate;
- Powys Teaching Health Board to support the provision of an effective School Nurse Service and other related health services for young people and their families;
- FFT Education Research Trust (https://fft.org.uk/about-fft/) for the maintenance of the secure on-line FFT Aspire resource for schools enabling thorough self-evaluation using extensive progress measures and effective target-setting for pupil achievement;
- GL Assessment (https://www.gl-assessment.co.uk/about-us/) for the administration of cognitive ability tests (CATs);
- the Mid-Wales Education Partnership to support regional statistical analysis as required by WG;
- various regulatory bodies, such as ombudsmen and inspection authorities, where the law requires that information be passed on so that they can do their work;
- the Office of National Statistics (ONS) in order to improve the quality of migration and population statistics.
Information is also shared with Careers Wales in accordance with the provisions laid down in The Education Act 1997 (Section 43 & 44) and The Learning & Skills Act 2000 (Sections 123 & 138).
Sharing personal information with curriculum-based software suppliers
The school may provide limited personal (but not sensitive) information to external companies providing a curriculum-based resource (which may be on-line) which is deemed to have educational value. In these circumstances the school will ensure that all reasonable precautions are taken to preserve the security of the data in line with current legislation and that the external supplier meets all legal requirements regarding the handling of this data as specified in a formal written agreement between the school and the supplier.
The school will endeavour to ensure that information is kept accurate at all times. Personal information will not be sent outside the United Kingdom unless it is protected by the enhanced security arrangements associated with the WG’s digital learning platform, Hwb. Details are available at: https://hwb.gov.wales/privacy.
A list of companies and their applications currently used by the school in this way are:
- White Space; Word Shark
- Nessy Learning; Nessy reading, writing and fingers
- Boolino; Fiction Express
- Maths Circle Ltd; Times Tables Rock Stars and NumBots
- Pearson; Rapid Reading and Active Learn
- GL Assessment; PhAB
- All Wales Reading Test
Sharing information with other suppliers
The school may provide limited personal (but not sensitive) information to external companies. In these circumstances the school will ensure that all reasonable precautions are taken to preserve the security of the data in line with current legislation and that the external supplier meets all legal requirements regarding the handling of this data as specified in a formal written agreement between the school and the supplier.
The school will endeavour to ensure that information is kept accurate at all times. Personal information will not be sent outside the UK unless it is protected by the enhanced security arrangements associated with the WG’s digital learning platform, Hwb.
Companies and their applications currently used by the school in this way are:
- Teachers2Parents (text messaging service)
- Colorfoto and Wooden Door Photography (photography providers)
- MyConcern (safeguarding)
4. How long will this data be kept?
Your school, LA and WG will keep this data until the pupil’s 25th birthday or for the duration of the criteria which underpin the statutory regulation. After this point the data will be anonymised in line with best practices and used only for statistical and research purposes.
5. Your rights under the GDPR
Under data protection legislation, parents and pupils have the right to request access to information about them that we hold, through a Subject Access Request (SAR). Parents and guardians can make a request with respect to their child’s data where the child is not considered mature enough to understand their rights over their own data (usually under the age of 12), or where the child has provided consent.
Parents also have the right to make a subject access request with respect to any personal data the school holds about them.
If you make a subject access request, and we hold information about you or your child, we will:
- give you a description of it;
- tell you why we are holding and processing it, and how long we will keep it for;
- explain where we got it from, if not from you or your child;
- tell you who it has been, or will be, shared with;
- let you know whether any automated decision-making is being applied to the data, and any consequences of this;
- give you a copy of the information in an intelligible form.
You also have the right to:
- require the school or LA to rectify any inaccuracies in that data;
- object (in some circumstances) to processing on grounds relating to your particular situation;
- restrict processing (in some circumstances);
- lodge a complaint with the Information Commissioner who is the independent regulator for data protection.
For further details about the information which your school and the LA holds and its use, or if you wish to exercise your rights under the GDPR, please see contact details below:
School: Ysgol Gynradd Llanidloes, Llangurig Road, Llanidloes SY18 6EX
Telephone: 01686 412603
Local Authority: Data Protection Officer for Schools, Information Compliance Team, County Hall LD1 5LG
To contact the Information Commissioner’s office:
ICO: Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Telephone: 029 2067 8400 (Wales helpline) or 0303 123 1113 (UK helpline)