Data Protection and Information Sharing - Schools

Schools, Local Authorities (LAs), the Department for Children, Schools and Families (DCSF)) , the Qualifications and Curriculum Authority (QCA), Ofsted, the Learning and Skills Council (LSC), Department of Health (DH), Primary Care Trusts (PCTs) and organisations that require access to data in the Learner Registration Scheme as part of the Managing Information Across Partners (MIAP) programme are all “data controllers” under the Data Protection Act 1998 in that they determine the purpose(s) for which “personal data” (ie data about living individuals from which they can be identified) is processed and the way in which that processing is done. This guidance deals specifically with personal data about pupils, although personal data may also be held on other groups such as teaching and non-teaching staff, and similar considerations with regard to “fair processing” will apply to them.

Data controllers have to provide “data subjects” (individuals who are the subject of personal data) with details of who they (the data controllers) are, the purposes for which they process the personal data, and any other information that is necessary to make the processing of the personal data fair, including any third parties to whom the data may be passed on. This is normally done by what is referred to as a “fair processing notice”.

The governing body of a maintained school in England is also required by law to supply basic information to ContactPoint (a directory that will help people who work with children and young people to quickly find out who else is working with the same child, making it easier to deliver more coordinated support). This only includes the name and address of the child, contact details for their parents or carers (with parental responsibility) and the contact details of the school.

Pupils, as data subjects, have certain rights under the Data Protection Act, including a general right to be given access to personal data held about them by any data controller. There is a presumption (endorsed by legal guidance issued by the Information Commissioner) that a child of twelve years of age and over has sufficient maturity to exercise their rights themselves, though in practice there will be exceptions to this.

The fair processing obligations on the data controller may appropriately be met by providing a fair processing notice to the parent (or the person with parental responsibility) where a child is younger than twelve, though the parent should be encouraged to share it with the child if the child has the maturity to understand it. However, where the child is aged twelve or more, the fair processing notice should be provided both to the child and to the parent. This acknowledges both the rights of the child and the parent’s need to be aware of how their child’s information is handled.

Separate Fair Processing Notices have been provided for Primary and Secondary Schools and both have been broken down into two layers:

Layer One is a brief one/two page notice, outlining simply the core fair processing information. Each school will issue a customised Layer One FPN to all parents, and children aged twelve and over.

You will need Adobe Acrobat Reader to view this information.

Durham Primary FPN Layer 1.pdf (1 page, 46kb)

Durham Secondary FPN Layer 1.pdf (2 pages, 47kb)

Layer Two is the full Fair Processing Notice.

Durham_Primary_FPNSC2009_LAYER2.pdf (3 pages, 63kb)

Durham_Secondary_FPNSC2009_LAYER2.pdf (4 pages, 69kb)

Further information about fair processing requirements, and guidance on the Data Protection Act generally, can be obtained from the Information Commissioner’s website (Information Commissioner's Office).

Further Information is available for accessing Education Records.