GDPR docs
1 | P a g e
GDPR Privacy Notice for Pupils and their Families
‘We work, we play, we care, we pray’
Who processes your information?
St Bernard’s Catholic Primary School is the data controller of the personal information you provide to us. This means the school determines the purposes for which, and the manner in which, any personal data relating to pupils and their families is to be processed. The Governing Body acts on behalf of the school community and has designated Mr Craig Stilwell (Judicium Education) the role of data processing officer (DPO). It is the Governing Body’s responsibility to manage all data storage, policies and procedures; they can be contacted via the school email: enquiry@st-bernards.bham.sch.uk. The school on-site data liaison officer is Mr Stephenson.
The categories of pupil information that St. Bernard’s Catholic Primary School collect, hold and share include:
• personal information (such as name, unique pupil number and address)
• characteristics (such as ethnicity, nationality, country of birth and free school meal eligibility)
• attendance information (such as sessions attended, number of absences and absence reasons)
• assessment information • relevant medical information,
• special educational needs information • exclusions / behavioural information
Why St. Bernard’s Catholic Primary School collects and use this information?
We use the pupil data:
• to support pupil learning • to monitor and report on pupil progress • to provide appropriate pastoral care • to assess the quality of our services • to comply with the law regarding data sharing
The lawful basis on which St. Bernard’s Catholic Primary School use this information
St Bernard’s Catholic Primary School holds the legal right to collect and use personal data relating to pupils and their families, and we may also receive information regarding them from their previous school, Local Authority and/or the Department For Education (DfE). We collect and use personal data in order to meet legal requirements and legitimate interests set out in the GDPR (General Date Protection Regulation) and UK law, including those in relation to the following:
• Article 6 and Article 9 of the GDPR • Education Act 1996
• Section 3 of The Education (Information About Individual Pupils) (England) Regulations 2013
Collecting pupil information at St. Bernard’s Catholic Primary School
Whilst the majority of pupil information you provide to us is mandatory, some of it is provided to us on a voluntary basis. In order to comply with the General Data Protection Regulation, we will inform you whether you are required to provide certain pupil information to us or if you have a choice in this. St. Bernard’s Catholic Primary School General Data Protection Regulation GDPR
GDPR docs
2 | P a g e
STORING PUPIL DATA AT ST. BERNARD’S CATHOLIC PRIMARY SCHOOL
How long is your data stored for?
Personal data relating to pupils at name of school and their families is stored in line with the school’s GDPR Data Protection Policy. In accordance with the GDPR, the school does not store personal data indefinitely; data is only stored for as long as is necessary to complete the task for which it was originally collected.
Who do we share pupil information with?
We routinely share pupil information with:
• schools that the pupil’s attend after leaving us • our local authority
• Department for Education (Dfe) • Archdiocese of Birmingham
St. Bernard’s Catholic Primary School will not share your personal information with any third parties without your consent, unless the law allows us to do. The school routinely shares pupils’ information with:
• Pupils’ destinations upon leaving the school • Local Authority • The National Health Service
• School Insight Tracking Assessment System • CMIS – Schools Management System
The information that we share with these parties includes the following:
• Full Names • Gender • Date of Birth • Special Educational Needs Status
• Address • Email Address • Phone Numbers
WHY DO WE SHARE PUPIL INFORMATION?
As stated previously we do not share information about our pupils with anyone without consent unless the law and our policies allow us to do so.
We share pupils’ data with the Department for Education (DfE) on a statutory basis. This data sharing underpins school funding and educational attainment policy and monitoring.
We are required to share information about our pupils with our Local Authority (LA) and the Department for Education (DfE) under section 3 of The Education (Information About Individual Pupils) (England) Regulations 2013.
GDPR docs
3 | P a g e
Data Collection Requirements: to find out more information about data collection requirements placed on us by the DfE go to https://gov.uk/educational/data-collection-and-censuses-for-school
The National Pupil Database (NPD)
The NPD is owned and managed by the Department for Education and contains information about pupils in schools in England. It provides invaluable evidence on educational performance to inform independent research, as well as studies commissioned by the Department. It is held in electronic format for statistical purposes.
Importantly this information is securely collected from a range of sources including schools, local authorities and awarding bodies. We are required by law, to provide information about our pupils to the DfE as part of statutory data collections such as the school census and early years’ census. Some of this information is then stored in the NPD. The law that allows this is the Education (Information About Individual Pupils) (England) Regulations 2013.
To find out more about the NPD, go to https://www.gov.uk/government/publications/national-pupil-databaseuser-guide-and-supporting-information
The department may share information about our pupils from the NPD with third parties who promote the education or well-being of children in England by:
• conducting research or analysis
• producing statistics
• providing information, advice or guidance
The Department has robust processes in place to ensure the confidentiality of our data is maintained and there are stringent controls in place regarding access and use of the data. Decisions on whether DfE releases data to third parties are subject to a strict approval process and based on a detailed assessment of:
• who is requesting the data
• the purpose for which it is required
• the level and sensitivity of data requested: and
• the arrangements in place to store and handle the data
To be granted access to pupil information, organisations must comply with strict terms and conditions covering the confidentiality and handling of the data, security arrangements and retention and use of the data.
For more information about the department’s data sharing process, please visit: https://www.gov.uk/dataprotection-how-we-collect-and-share-research-data
For information about which organisations the department has provided pupil information, (and for which project), please visit the following website:
GDPR docs
4 | P a g e
https://www.gov.uk/government/publications/national-pupil-databaserequests-received
To contact the DfE you can visit their educational website: https://www.gov.uk/contact-dfe
Requesting access to your personal data
Under data protection legislation, parents and pupils have the right to request access to information about them that we hold. To make a request for your personal information, you can put your request in writing to Mr Stephenson (Data Processing Officer) St. Bernard’s Catholic Primary School, Wake Green Road, Moseley, Birmingham, B13 9QE.
You also have the right to:
• object to processing of personal data that is likely to cause, or is causing, damage or distress
• prevent processing for the purpose of direct marketing
• object to decisions being taken by automated means
• in certain circumstances, have inaccurate personal data rectified, blocked, erased or destroyed; and claim compensation for damages caused by a breach of the Data Protection regulations
If you have a concern about the way St. Bernard’s Catholic Primary School is collecting or using your personal data, we request that you raise your concern with us in the first instance. The Governing Body will endeavour to sort out any issues/queries concerning data management. Alternatively, you can contact the Information Commissioner’s Office at https://ico.org.uk/concerns/
Contact
If you would like to discuss anything in this privacy notice or anything related to data protection, please contact Mr Craig Stilwell (DPO) via Judicium Education:
Company: Judicium Consulting Ltd
Address: 72 Cannon Street, London, EC4N 6AE
Email: dataservices@judicium.com
Web: www.judiciumeducation.co.uk
Telephone: 0203 326 9174
The Data Protection Officer (Mr Stilwell) is responsible for overseeing data protection within Saint. Bernard’s Catholic Primary School so if you do have any questions in this regard, please do contact him on the address stated above.
---------------------------------------------------------------------------------------------------------------------
To contact the on-site school liaison officer (Mr. Stephenson), the school office number is 0121 464 3795 or contact can be made via the school email enquiry@st-bernards.bham.sch.uk
Where the processing of your data is based on your consent, you have the right to withdraw this consent at any time.
GDPR docs
5 | P a g e
If you have a concern about the way St Bernard’s Catholic Primary School and/or the DfE is collecting or using your personal data, you can raise a concern with the Information Commissioner’s Office (ICO). The ICO can be contacted on 0303 123 1113, Monday-Friday 9am-5pm.
Where can you find out more information?
If you would like to find out more information about how we and/or the DfE collect, use and store your personal data, please visit our school website: www.st-bernards.bham.sch.uk or download our school GDPR Data Protection Policy.
GDPR docs
6 | P a g e
‘We work, we play, we care, we pray’
Parent Declaration Parent Declaration Parent Declaration
Child’s name (please fill in any names)
Year/Class
I fully understand:
St Bernard’s Catholic Primary School has the legal and legitimate interest to collect and process my personal data in order to meet statutory requirements.
How my data is used
St. Bernard’s has to share information with the DfE and Local Authority
St. Bernard’s uses information to contact me via the school mobile app and school parent mail
St. Bernard’s Catholic Primary School will not share my data with any third parties without my consent, unless the law requires the school to do so
St. Bernard’s Catholic Primary School will always ask for explicit consent where this is required, and I must provide this consent if I agree to the data being processed
My data is retained in line with the school’s GDPR Data Protection Policy
My rights to the processing of my personal data
Where I can find out more information about the processing of my personal data
Signed _____________________________________ Date ________________________________
DO NOT DETACH ----------------------------------------------------------------- DO NOT DETACH --------------_
St. Bernard’s Catholic Primary School – PARENT CONSENT Photographs/Videos
We currently ask parents in class assemblies not to upload any photographs to social media platforms. We will continue this policy because it gives parents the opportunity to take school photographs and videos of their children in assemblies/sports day events/school sporting fixtures. These pictures provide invaluable family memories.
Parents MUST NOT however upload photographs for any public viewing or the current school stance on media would have to change.
At the start of school assemblies STAFF will remind parents of this stance and expectations on filming/photography.
I _________________________________________ parent of the above named child/children give consent for my child’s photographs to be used in St. Bernard’s Catholic Primary School and on the school website.
Signed _______________________________________ Date ______________________________
Please sign and return the parent declaration form and parent consent.
If you DO NOT want to give your consent, please contact the school in WRITING and address the letter to Mr Stephenson (DPO)
Parent Declaration
&
Parent Consent
Thank you for your co-operation