Introduction
To teach children the skills necessary in the ever-changing world, many parents are choosing private school education in Europe as well as around the globe. For instance, a total of 32,163 schools provided educational services in the United Kingdom in 2021, of which 2,461 were privately funded.
As an education provider we respect the privacy of our students, their parents, our guests, partners and our staff and all who visit our school and website Their personal information is never sold, leased, rented, or otherwise disclosed in any manner to any entity without prior consent unless otherwise required by law or as may be necessary as part of a regulatory compliance.
We take our obligations to safeguarding children and young people’s personal data seriously and appreciate that they have the right to say how their information is used. ROBUS Data Governance gave us a clear map of all our business processes that involve our student’s data and allowed us to act on best practice by assessing if the data relevant, accurate and processed in a manner that ensures security and confidentiality.
The GDPR makes schools and any other educational organisations more accountable for the data they collect and maintain and provides individuals with guaranteed rights concerning their personal data.
Efficient management of third-party data
Any relations with third parties and pupils handled by school employees or personal data of guests must have data processing agreements in place. As most of the data managed by schools is related to the pupils who are children, requirements for data safety and proper maintenance are even higher compared to adult data.
Subject request processing
Any data subject can exercise certain rights with regards to personal data, i.e. to ask a school to provide all the data related to an individual or to delete it within 28 days from the date of request.
Data protection impact assessment (DPIA)
DPIAs are required if data processing activities of an organisation could pose a risk to the rights and freedoms of individuals.
Mitigation of non-compliance risks
GDPR compliance is crucial for preventing data breaches, which in turn is paramount to the security and safety of pupils and staff alike. Moreover, if a school does not comply with the GDPR legislation, it runs a number of risks. A serious GDPR data breach can result in warnings and reprimands, increased fines, temporary or permanent bans on data processing, rectification, restriction, or deletion of data.
Reporting a breach
If a personal data breach takes place, a DPO may need to inform the Information Commissioner’s Office (ICO). Under serious circumstances, the DPO has to inform the individuals whose data has been put at risk.
Transparency policy
Organisations must have a privacy policy that transparently explains how they collect and use customer personal data.
Why is it Important?
Under Article 8 of the GDPR, processing of the personal data of a child shall be lawful if the child is at least 16 years old. Where the child is below the age of 16 years, consent to data processing must be given or authorised by the parents.
Most data breaches happen in schools due to such simple human mistakes as forgetting to put emails of the parents in BCC that makes all contacts visible to others. More tangible cases could also occur, involving more sensitive data. Regardless of the reasons, a breach must be investigated immediately.
The process should involve determining whether the breach should be reported to the supervisory authority. Simply put, it is the case when an individual may face social problems (including bullying), economic issues, financial or reputation losses, and fraud.
Efficient management of third-party data
A pupil or an unauthorised employee finds a teacher’s laptop unlocked and accesses personal files.
Deliberate or accidental action
A member of staff sends an old PC to be destroyed without wiping the hard drive.
Accidental disclosure
An administrator sends an email containing personal data to a wrong recipient.
Alteration
Someone accesses the school’s payroll system and enters incorrect information about staff pay grades.
Loss of availability
The school faces a power cut that shuts down access to the information available only electronically.
Client Specific Needs?
GDPR compliance
Being an establishment that cares for not only the education but also the safeguarding of young people, the school processes a large amount of diverse special category data (both on paper and electronically) that needs to be kept secure and compliant.
Unification of the personal data collection and storage
The school has several departments that risk having siloed data repositories with no holistic overview. It is critical to have clear guidelines on the collection, risk assessment, processing, and storage of special category data.
Secure data sharing with third parties
The school shares a significant amount of data with the central government’s education department, health and social services, as well as other schools. Data sharing has to be performed lawfully and documented correctly.
