• Contact address
• Bookmark these: new DPO resources page and weblinks
• Online audit – DPO schedule for schools
• Somerset LA Data Sharing Agreement 2019-20
• Farewell Egress, hello Microsoft Azure Information Protection!
• DPO Case Files – The Confidentiality Conundrum
• ICO guidance on SAR timelines
• DfE Brexit data protection guidance
• Issues, questions or myth busting

Bookmark these: new DPO resources page and weblinks

• DPO resources: www.supportservicesforeducation.co.uk/p14603 (requires SSE login)
• Our main eLIM website page – free resources and information about the DPO service:
  http://bit.ly/elimgdpr
• DPO service details – the SSE webpage giving more information on how to order the DPO service: http://www.supportservicesforeducation.co.uk/Services/5254#  

Online audit – DPO schedule for schools

Under Article 39 of the GDPR, it is a statutory responsibility of the DPO to monitor the compliance of the organisation they are acting for. See the ICO’s tasks for Data Protection Officers.

This year, we will be issuing an online audit to all our subscribing schools. The audit will be rolled out on a scheduled basis, with schools contacted throughout the year. Priority will be given to subscribing schools who did not have a DPO visit last year, or schools who were visited in Autumn term 2018.

The online audit should be completed by the data protection lead in schools, and will take about an hour. When the audit is submitted to the DPO, we will read through your responses and arrange a time for a follow-up phone call. After the phone call, we will send you through a written report on your compliance and action points which can be shared with governors.

The first schools will be contacted in the next few weeks. Please contact us if you would like to be added to the priority schools.

Somerset LA Data Sharing Agreement 2019-20

The annual data sharing agreement for Somerset schools has been sent out to all education provider mailboxes, supporting the LA’s requirement to collect large-scale data from schools to fulfil its legal and statutory duties. The data sharing agreement:

• reduces the administrative burden on Education Providers – as data will only be inputted once but used many times for the benefit of children and employees
• provides better targeted services to all children and employees
• ensures the safety and wellbeing of individual children and employees
• ensures inclusion in the Overarching Information Sharing Protocols with the Avon and Somerset Police and the Local NHS CCG, Partnership and Trusts

The 2019-20 Somerset Data Sharing Agreement must be read and signed by all school settings - failure to sign may limit some of the LA services available to your school.

On Page 2 you will see a list of changes from the 2018-19 agreement. Click here to read the 2019-20 Data Sharing Agreement  

When you have read the agreement, complete the electronic form here 

Clicking Submit at the end of the form acts as your signature. Thank you to the 120 schools who have completed this promptly. Please contact us if you have any questions.

Farewell Egress, hello Microsoft Azure Information Protection!

DPO Case Files – The Confidentiality Conundrum

Each month, we will feature a data protection issue raised by a school. We will not identify the school, but share their dilemma and how it was resolved, so that other schools can consider their response in the same circumstances.

It’s a well-worn phrase, but your school’s data protection will only be as good as your weakest staff member. Data breaches occur when people don’t follow your procedures, either intentionally or unintentionally.

But what if you become aware that a member of staff has been discussing sensitive personal information of pupils and adults with a third party? Over the last year, we have had a number of reported data breaches involving staff sharing or accessing confidential information. For obvious reasons, we won’t be more specific!

These incidents will be dealt with as HR issues and appropriate disciplinary action will be taken. However, they are also data breaches and the school should assess the risk to individuals and record / report the breach in line with advice from their DPO.

If there is a high risk of harm to the rights of individuals, the school will need to inform the Information Commissioner’s Office. The school will need to prove that data protection is included in compulsory induction training, and that it regularly provides compulsory updates to all staff. It will also need to prove that staff agree to comply with the school’s data protection-related policies (e.g. data protection / signed code of conduct / signed staff acceptable use policy)

If data controller can demonstrate that they have robust policies and procedures in place, and that they have taken the breach seriously and acted appropriately then the ICO response should be proportionate. 

ICO guidance on SAR timelines

The ICO has updated its guidance on response times to Subject Access Requests. The 30 day deadline for responding is now calculated from the day of receipt, not the day after receipt.

"Following a Court of Justice of the European Union (CJEU) ruling, the ICO has updated its guidance around how long an organisation has to respond to a subject access request (SAR).

The guidance stated that SARs must be responded to within one calendar month, with the day after receipt counting as 'day one'. This has now changed.

'Day one' is now the day of receipt - for example, a SAR received on 3 September should now be responded to by 3 October."

This may be different for maintained schools responding to a parental request for the pupil record – contact your DPO for advice on this.

DfE Brexit data protection guidance

• Evaluate where you send data in / out of the EU for processing e.g. identify where online providers are storing your personal data by looking at the terms and conditions of your contracts. Is it in the UK or EU?
• Check that your contracts with these providers, which include the processing of personal data in the EU, “provide the additional safeguards required” – in most cases, you will be sharing some information with providers that counts as a ‘restricted transfer’ under GDPR and in the event of a no-deal Brexit, you should check whether there are standard contractual clauses which apply https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/international-transfers#ib6
• Review your privacy notices and data protection privacy impact assessments (PIAs) to ensure they are up to date and reflect any changes made to the way you work