The Data Protection Act 1998 (DP)
The DP act applies to anyone who handles or has access to information concerning individuals. Everyone in the workplace has a legal duty to protect the privacy of information relating to individuals. The act sets standards (eight data protection principles), which must be satisfied when processing personal data (information that will identify an individual). The act also gives rights to the people the information is about i.e. the right of subject access, lets individuals find out what information is held about them.
The eight principles are that personal data must be:
1. obtained and processed fairly and lawfully
2. held only for specified purpose(s)
3. adequate, relevant and not excessive
4. accurate and kept up-to-date
5. held no longer than necessary
6. processed in accordance with the rights of the data subject
7. subject to appropriate security measures
8. only transferred to countries that have suitable data protection controls.
Notification: To comply with these principles every school must register the reasons for processing personal information with the Information Commissioners office, this is called Notification. Failure to notify is a criminal offence.
For details on how to notify, visit the Information Commissioners website at the following link: http://www.ico.gov.uk/whatwecover/dataprotection/notification.aspx where you can complete an on-line form or telephone on 01625 545745 for a hard copy to be sent in the post. tThe fee is £35 payable annually.
Either method will enable you to request a standard template for schools, which has been designed to cover your specific activites. If you choolse to use the template the details provided should be checked, and any amendments made as necessary.
When completing the template try to consider every likely consequence of the information to be held, how it will be used and with whom it may be shared.
Pupil Referral Units (PRU) are considered to be Data Controllers in their own right and to comply with the above principles every PRU, like schools must register the reason for processing personal information with the Information Commissioners office. For details on how to notify click on the notification for schools link.
Determining if data is 'personal data' under the Data Protection Act 1998
Guidance:
- Data Protection Guidance for Staff
- Homeworking - Data Protection Guidance
- JAPAN Test
- Information Sharing
- Policy & Guidance for Kent Schools, Settings and KCC Services on the use of Photographic Images of Children (updated March 2009)
- Social Networking
Snap away on sports day, says ICO
22nd June 2009 Information Commissioners Office
Parents wishing to capture the moment their child crosses the finish line at their school sports day should not be deterred by data protection myths. The Information Commissioner's Office (ICO) is reminding parents that the Data Protection Act does not prevent them taking photographs of their children and friends participating in school events.
Full Press Release
http://www.ico.gov.uk/upload/documents/pressreleases/2009/photography_schools_sports_day220609.pdf