School privacy notice

Being transparent and providing accessible information to individuals about how we use personal information is a key element of the Data Protection Act and the General Data Protection Regulation (Regulation (EU) 2016/679).

This data is collected in a number of ways but namely via the Department for Education (DfE) School Census Data and via a secure automated link (B2B) with a School’s Information Management System.  The document provides information on the data collected and how it is used.

The information being processed

The Council is collecting information such as

  • Basic Student Details
    • Name, DOB, gender, address, language, NCY, Religion, Ethnicity
  • Special Educational Needs & Disability and Looked After Status
  • Exclusions
  • Attendance Records
  • Free School Meal Status
  • Parents/Carer Details

This information enables Plymouth City Council to fulfil its Statutory Data Collection Requirements in accordance with DFE guidance (census collection), to keep accurate and timely records in accordance with GDPR and to ensure the Safeguarding of children. The Local Authority’s (LA) and School’s responsibility is to keep the data that they/we hold on children up to date, appropriate and accurate. This joint sharing of information is vital for safeguarding and to keep School and Local Authority processes effective and efficient. This includes working within Children Missing Education (CME) guidelines, data protection regulations, Admission & Transfer (A&T) processes and DfE guidelines.

Plymouth City Council uses information about children for whom it provides services, to enable it to carry out specific functions for which it is responsible, such as the assessment of any special educational needs the child may have. It also uses the information to derive statistics to inform decisions on, for example, the funding of schools, and to assess the performance of schools and set targets for them. The statistics are used in such a way that individual children cannot be identified from them.

Information Sharing 

To ensure that the council provides you with an efficient and effective service we will need to share your information between teams within the council as well as with our partner organisations that support the delivery of the service you may receive. In this case, the information collected will be shared when appropriate with:

  • Child Health Information Service (CHIS)
    • School Nursing Service
    • School immunisation Providers
  • University Hospitals NHS Trust Orthoptic Team
  • Families with a Future Programme (see below)
  • Youth Support Services (Careers South West) (see below)
  • Children, Young People & Family Service
  • Electoral Services (16 & 17 year olds)

We will only ever share your information if we are satisfied that our partners or suppliers have sufficient measures in place to protect your information in the same way that we do.  

We will never share your information for marketing purposes. 

Retention Periods

We will only keep and update your information to carry out our statutory obligations by law. The information will not be kept longer than necessary and in line with statutory retention periods.

Purpose of Processing Personal information

As a local authority, the council delivers services to you. In order to do this in an effective way we will need to collect and use personal information about you.

The Data Protection Act 2017 and the EU General Data Protection Regulation ensure that we comply with a series of data protection principles. These principles are there to protect you and they make sure that we:

  • Process all personal information lawfully, fairly and in a transparent manner.
  • Collect personal information for a specified, explicit and legitimate purpose.
  • Ensure that the personal information processed is adequate, relevant and limited to the purposes for which it was collected.
  • Ensure the personal information is accurate and up to date.
  • Keep your personal information for no longer than is necessary for the purpose(s) for which it was collected.
  • Keep your personal information securely using appropriate technical or organisational measures.

Your Rights

You have certain rights under the Data Protection Act and the EU General Data Protection Regulations (GDPR), these are:

  • The right to be informed via Privacy Notices such as this.
  • The right of access to any personal information the council holds about yourself.
  • The right of rectification, we must correct inaccurate or incomplete data within one month.
  • The right to erasure. You have the right to have your personal data erased and to prevent processing unless we have a legal obligation to process your personal information.
  • The right to restrict processing. You have the right to suppress processing. We can retain just enough information about you to ensure that the restriction is respected in future.
  • The right to data portability. We can provide you with your personal data in a structured, commonly used, machine readable form when asked.
  • The right to object. You can object to your personal data being used for profiling, direct marketing or research purposes.
  • You have rights in relation to automated decision making and profiling, to reduce the risk that a potentially damaging decision is taken without human intervention.

Consent

During your contact with the council you will be informed of how you, or your children's information will be used and shared with other services or organisations.

Consent is not sought in relation to sharing basic data (name, address, DOB) with the Child Health Information Service (CHIS) and University Hospitals NHS Trust Orthoptic Team as their use of the data is in the public interest as it directly benefits patient and public health.  An opportunity to provide consent will be made available under the specific initiatives co-ordinated by the health care providers eg Child Measurement Programme. School Immunisations and Eye Test for 4 & 5 year old children.

We will usually seek your consent prior to processing or sharing your information, If you object you must inform the council, however, if there is a legal reason, as outlined under the Data Protection Act, we may not require your consent, for example

  • To protect a child, a vulnerable adult, or member of the public
  • Where the disclosure is necessary for the purposes of the prevention and/or detection of crime.
  • Tax or duty assessment
  • Required by court or law

Where we need to disclose sensitive or confidential information such as medical details to other partners, we will do so only with your prior explicit consent or where we are legally required to. We may disclose information when necessary to prevent risk of harm to an individual. 

Details of transfers to third country and safeguards 

Your personal and sensitive data will only be stored and processed on servers based within the United Kingdom.

Data Controller

Plymouth City Council is registered as a data controller with the Information Commissioner's Office (registration number: Z7262171).

Contact details for the council's data controller are:

Data Protection Officer, Plymouth City Council, Ballard House, West Hoe Road, Plymouth Pl1 3BJ.

Email: dataprotectionofficer@plymouth.gov.uk

Youth Support Services

For pupils aged 13 years and over, the school is legally required to pass on certain information to the provider of Youth Support services in their area. This is the local authority support service for young people aged 13 to 19 in England. For Plymouth City Council this service is delivered by Careers South West.

The school must provide the name and address of the pupil and their parents and any further information relevant to the support services' role. In addition, the date of birth of the pupil is supplied.

Youth Support services pass on some of the information they collect to the Department for Education (DfE) to enable them to assess the local authorities’ performance and determine the destinations of young people after they have left compulsory education. If you require more information about how the DfE store and use your information then please go to the DfE website.

Data may also be shared with post 16 providers to secure appropriate support on entry to post 16 provision.

Until pupils are aged 16 or older, their parent(s) can ask that no information beyond their children’s name, address and date of birth (and their own name and address) be passed to the youth support services provider. This right transfers to the pupil on their 16th birthday. Pupils and/or parents will need to inform the school if this is what they wish.

Families with a Future privacy notice

The national Troubled Families Programme is known locally as Families with a Future. Plymouth City Council is one of the many partners involved in the programme – please see our statutory privacy notice.

Privacy notices

 Privacy notice - pupils [Word, 36KB]

 Privacy notice - school workforce [Word, 32KB]