Powys School / Early Years Provider Privacy Notice

In accordance with General Data Protection Regulation (GDPR) this notice sets out what your School, (The School) the Local Authority (Powys County Council) and the Welsh Government does with the education related information that it receives about Children and Young People.

Covid-19 – Please note that under Regulation 3 of the Health Protection (Local Authority Powers) (Wales) Regulations 2010, the head teacher of a school is required to provide the names, addresses and contact telephone numbers of all pupils in their school, or any group of pupils attending that school, when certain circumstances apply. For example, when there is reason to believe that there is or has recently been a person on the school’s premises who is or may be infected. Therefore, if your child is absent from school with suspected Covid-19 then this information will be passed on to Powys County Council for them to monitor any possible cluster areas.

Background

The School collects information about children and young people and their parents or legal guardians when children and young people enrol at the School. The School also collects information at other key times during the school year and may receive information from other schools or early years providers when children and young people transfer.

The School processes the information it collects to administer the education it provides to children and young people. For example:

the provision of educational services to individuals;
monitoring and reporting on pupils’/children’s educational progress;
the provision of welfare, pastoral care and health services;
the giving of support and guidance to children and young people, their parents and legal guardians;
the organisation of educational events and trips and to inform you about events and other things happening in the school
to keep children safe (food allergies, or emergency contact details)
the planning and management of the school
Making use of photographic images of pupils in school publications, on the school website and on social media channels;
Security purposes, including CCTV;

Powys County Council collects information about children and young people and their parents or legal guardians when children and young people apply for admission to the School. The local authority also has access to data collected by the School for the same reasons listed above and for the following additional purposes:

to monitor, challenge and provide support to schools to improve performance and set credible targets
to support schools in the services delivered to children and young people
to inform and support services provided by the Children and Young People’s Partnership (CYPP) and the Powys Youth Service to young people and their families
to carry out research and inform policy decisions including funding for schools and early years providers
to monitor the quality and scope of data held by schools and provide support to ensure the data held about children and young people is accurate and up-to-date

Upon receipt of the information from your School the Local Authority (Powys County Council) also becomes the Data Controller.

Our lawful basis for collecting and processing pupil information is defined under Article 6, and the following sub-paragraphs in the GDPR apply:

Data subject gives consent for one or more specific purposes.
Processing is necessary to comply with the legal obligations of the controller.
Processing is necessary to protect the vital interests of the data subject.
Processing is necessary for tasks in the public interest or exercise of authority vested in the controller (the provision of education).

Our lawful basis for collecting and processing pupil information is also further defined under Article 9, in that some of the information we process is deemed to be sensitive, or special, information and the following sub-paragraphs in the GDPR apply:

The data subject has given explicit consent.
The processing is necessary for the purposes of carrying out the obligations of the data controller (the School) or the data subject in the field of social protection law.
It is necessary to protect the vital interests of the data subject.
Reasons of public interest in the area of public health
For the provision of Social Care
It is in the public interest

As data controllers, the School and Powys County Council use the information received for the purposes listed to enable them to carry out data processing necessary for the performance of a task carried out in the public interest and in the exercise of official authority.

In addition, the Welsh Government receives information on pupils directly from schools normally as part of statutory data collections which consists of the following:

Post-16 data collection
Pupil Level Annual School Census (PLASC)
Educated other than at school (EOTAS) pupil level collection
National data collection (NDC)
Attendance collection
Welsh National Tests (WNT) data collection

In addition to the data collected as part of PLASC, the Welsh Government and Local Authorities also receive information regarding National Curriculum assessments, public examination results, and attendance data at individual pupil level which comes from Schools and /or Awarding Bodies (e.g. WJEC).

What information is held by the School and Powys County Council?

The sort of personal information that will be held includes:

personal details such as name, address, date of birth, child/young person identifiers and contact details for parents and guardians; photographs (including images of pupils engaging in school activities)
characteristics (such as ethnicity, language, and free school meal eligibility)
details about children’s and young people’s immigration status (this is used only to prepare summary statistical analyses);
safeguarding information (such as court orders and professional involvement)
special educational needs (including the needs and ranking)
medical and administration (such as doctors information, child health, dental health, allergies, medication and dietary requirements)
attendance (such as sessions attended, number of absences, absence reasons and any previous schools attended)
assessment and attainment (such as key stage and results, post 16 courses enrolled for and any relevant results)
behavioural information (such as exclusions and any relevant alternative provision put in place)
information about the involvement of social services with individual children and young people where this is needed for the care of the child/young person
We may also hold data about pupils that we have received from other organisations, including other schools, local authorities and the Welsh Government.

Who does the School and Powys County Council share your information with?

Information held by Franksbridge School and Powys County Council on children and young people, their parents or legal guardians may also be shared with other organisations when the law allows and providing all appropriate steps are taken to keep the information secure, for example:

other education and training bodies, including schools, when children and young people are applying for courses or training, transferring schools or seeking guidance on opportunities;
bodies doing research for the Welsh Government, LA and schools as long as steps are taken to keep the information secure;
central and local government for the planning and provision of educational services;
social services and other health and welfare organisations where there is a need to share information to protect and support individual children and young people; including Police Forces, Courts and Tribunals and security organisations.
Management Information System (MIS) providers in order to ensure that system functionality and accuracy is maintained;
The Council’s approved suppliers of the schools ‘cashless’ system to ensure all pupils, parents & guardians with parental responsibility and school staff are able to use it as appropriate;
Powys Teaching Health Board to support the provision of an effective School Nurse Service and other related health services for young people and their families;
FFT Education Research Trust (https://fft.org.uk/about-fft/) for the maintenance of the secure on-line FFT Aspire resource for schools enabling thorough self-evaluation using extensive progress measures and effective target-setting for pupil achievement;
GL Assessment (https://www.gl-assessment.co.uk/about-us/) for the administration of annual cognitive ability tests (CATs) and other similar diagnostic tools to support individual learning;
The South West and Mid-Wales Education Consortium (ERW) to support regional statistical analysis as required by Welsh Government;
various regulatory bodies, such as ombudsmen and inspection authorities, where the law requires that information be passed on so that they can do their work;
The Office of National Statistics (ONS) in order to improve the quality of migration and population statistics.

Information is also shared with Careers Wales in accordance with the provisions laid down in The Education Act 1997 (Section 43 & 44) and The Learning & Skills Act 2000 (Sections 123 & 138).

Sharing personal information with curriculum-based software suppliers

The School may provide limited personal (but not sensitive) information to external companies providing a curriculum-based resource (which may be on-line) which is deemed to have educational value. In these circumstances the School will ensure that all reasonable precautions are taken to preserve the security of the data in line with current legislation and that the external supplier meets all legal requirements regarding the handling of this data as specified in a formal written agreement between the School and the supplier.

The School will endeavour to ensure that information is kept accurate at all times. Personal information will not be sent outside the United Kingdom unless it is protected by the enhanced security arrangements associated with the Welsh Government’s digital learning platform – ‘Hwb’. Details are available at: https://hwb.gov.wales/privacy

Companies and their applications currently used by Franksbridge School in this way are:

TTRockstars – maths programme
Nessy – spelling and reading programme
Wordshark – spelling and reading programme
Class Dojo – class reward system
HWB – online learning platform
CATs – assessment tool used by all pupils across Wales in Year 4

How long will this data be kept?

Franksbridge School, Powys County Council and Welsh Government will keep this data until the pupil’s 25^th birthday or for the duration of the criteria which underpin the statutory regulation. After this point the data will be anonymised in line with best practices and used only for statistical and research purposes.

Your rights under the GDPR

Under data protection legislation, parents and pupils have the right to request access to information about them that we hold, through a Subject Access Request (SAR). Parents/carers can make a request with respect to their child’s data where the child is not considered mature enough to understand their rights over their own data (usually under the age of 12), or where the child has provided consent.

Parents also have the right to make a subject access request with respect to any personal data the school holds about them.

If you make a subject access request, and we hold information about you or your child, we will:

Give you a description of it
Tell you why we are holding and processing it, and how long we will keep it for
Explain where we got it from, if not from you or your child
Tell you who it has been, or will be, shared with
Let you know whether any automated decision-making is being applied to the data, and any consequences of this
Give you a copy of the information in an intelligible form

You also have the right to:

Require the School or Powys County Council to rectify any inaccuracies in that data;
The right (in some circumstances) to object to processing on grounds relating to your particular situation;
The right to restrict processing (in some circumstances)
Lodge a complaint with the Information Commissioner who is the independent regulator for data protection.

For further information about the information which your school and Powys County Council holds and its use, or if you wish to exercise your rights under the GDPR, please see contact details below:

Your School:	Franksbridge Primary School
Phone:	01982 570275
Email Address:	office@franksbridge.powys.sch.uk
Powys County Council:	Data Protection Officer for Schools Information Compliance Team County Hall Llandrindod Wells Powys LD1 5LG

To contact the Information Commissioner’s Office, please see details below:

Information Commissioner’s Office:	Wycliffe House Water Lane Wilmslow, Cheshire SK9 5AF
Telephone – Helpline:	029 2067 8400 (Wales helpline) or 0303 123 1113 (UK helpline)
Website:	www.ico.org.uk