Coronavirus (COVID-19)
Pupils, Parents and Staff Privacy Notice
This Privacy Notice has been written to inform pupils, parents and staff of Sutton in Craven CP School about how we are using your information in light of the measures that have been introduced in response to the Coronavirus (COVID-19) pandemic.
This Privacy Notice should be read in conjunction with our standard Pupils and Parents, and Employees Privacy Notices.
Who are we?
Sutton in Craven CP School is a ‘Data Controller’ as defined by Article 4 (7) of GDPR. This means that we determine the purposes for which, and the manner in which, your personal data is processed. We have a responsibility to you and your personal data and will only collect and use this in ways which are compliant with data protection legislation. The school has appointed Veritau Ltd to be its Data Protection Officer (DPO). The role of the DPO is to ensure that the school is compliant with GDPR and to oversee data protection procedures.
Veritau’s contact details are:
Schools Data Protection Officer
Veritau Ltd
County Hall
Racecourse Lane
Northallerton
DL7 8AL
schoolsDPO@veritau.co.uk 01609 53 2526
*Please ensure you include the name of the School in all correspondence with the DPO
What information are we collecting?
The categories of information that we collect, hold and share include the following:
- Basic personal information (e.g. name, pupil number, DOB and address) (pupils,
- parents and staff)
- Safeguarding information (pupils)
- Job role and evidence of employment in this role (parents)
- Attendance information (pupils and staff)
We will also process information which may include ‘special category’ data about our pupils including:
- Information which identifies children that are ‘vulnerable’ (those who have a social worker, such as children in the care of the Local Authority and those children and
- young people up to the age of 25 with education, health and care (EHC) plans)
- Relevant medical information (pupils and staff)
Why do we process your personal data?
We are processing this information to facilitate the provision of care for vulnerable children and the children of critical workers.
This involves:
- Processing pupil information to facilitate their learning and meet any care requirements that they have.
- Processing parents’ employment information to confirm their status as a critical worker.
- Processing the information of staff members who have been redeployed in order to meet resourcing needs.
Any personal data that we process about our pupils and parents is done so in accordance with Article 6 and Article 9 of GDPR:
- Article 6 (c) legal obligation
- Article 6 (d) public task
- Article 6(b) contract (for staff)
- Article 9 (b) Employment, social security and social protection (for staff)
- Article 9 (g) Reasons of substantial public interest
Please refer to our standard Pupils and Parents and Employees Privacy Notices for further information about the lawful basis we rely upon to process your data.
Who do we obtain your information from?
Much of the information we process will be obtained directly from you. We will also process information received from:
- Department for Education (DfE)
- Local Education Authority. If your child is attending our school as a result of the
- COVID-19 pandemic response and your child’s previous school was in a
- neighbouring LEA, then we may need to obtain information from this LEA.
- Previous schools attended
Who do we share your personal data with?
We are obliged to share attendance data with the Department for Education during this time.
The following information will be shared:
- The names of all children who are in attendance on each day
- If the child is not enrolled at our school, the name of the school where the child is enrolled
- Whether the child is present on each day
- Whether the child has parents who are critical workers
- If the child is vulnerable e.g. they have on an education health and care plan (EHCP),
- have a social worker (CiN), or are looked after children
- If the child is on an EHCP
- If the child has a social worker
- The time the child signed into the school
- The time the child signed out of the school
- The number of children or staff members that are ill, isolating, shielding and whether there is a suspected or confirmed case of COVID-19.
- The number of children or staff members who have been asked to self-isolate by the NHS Test and Trace system.
- The number of children or staff members living with a clinically extremely vulnerable person.
We may also be required to share information with neighbouring Local Education Authorities if your child is attending our school as a result of the COVID-19 pandemic response and your child’s previous school was in a neighbouring LEA.
For further details about who we share information with, please see our full Pupil and Parents and Employees Privacy Notices.
How long do we keep your personal data for?
We will only retain your data for as long as it is necessary to do so. In respect of parents, we will not retain a copy of the evidence that you provide to us to prove that you are a critical worker. For further details about retention of your data, please refer to our full Pupils and Parents and Employees Privacy Notices.
What rights do you have over your data?
Under GDPR data subjects have the following rights in relation to the processing of their personal data:
to be informed about how we process your personal data. This notice fulfils this obligation
- to request access to your personal data that we hold, and be provided with a copy of it
- to request that your personal data is amended if inaccurate or incomplete
- to request that your personal data is erased where there is no compelling reason for its continued processing
- to request that the processing of your personal data is restricted
- to object to your personal data being processed
If you have any concerns about the way we have handled your personal data or would like any further information, then please contact our DPO on the address provided above.
If we cannot resolve your concerns you may also complain to the Information Commissioner’s Office (the Data Protection Regulator) about the way in which the school
has handled your personal data. You can do so by contacting:
First Contact Team
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow Cheshire
SK9 5AF
casework@ico.org.uk // 0303 123 1113