Fair processing guidelines for schools

Guidance to schools and LAs requirements with respect to 'Fair Processing' under the Data Protection Act 1998

To meet the requirements of the Data Protection Act (DPA) 1998, schools need to issue a Fair Processing Notice (FPN) to pupils and parents summarising the information held about pupils, why it is held, and the third parties to whom it may be passed on.

The DPA requires that data is only shared with the data subject (or their parents/carers in the case of children under 13. Many schools send out fair processing notices at the start of each academic year. As a minimum an FPN must be sent to parents/carers when the child starts school and also direct to the pupil when they reach the age of 13.  

In order to ensure that the data held about the pupil is correct, it is anticipated that schools will issue a data sheet setting out what data is held and what additional data is required.  The introduction, for ContactPoint, of providing contact details about parents, could impose a burden on schools in having to write to all parents and carers about whom they hold data.  However, they should write only to the principal parent/carer with a list of the data fields that are required for ContactPoint asking them to contact the school if they are aware that the details have changed.

The FPN needs to cover the rights of parents or pupils to opt out from the provision of information to the Connexions services under the Learning and Skills Act 2000..

In response to comments received since last year, the suggested FPN is broken down into two layers:

Layer One is a brief one-page notice to go to all parents;

Layer Two is the full FPN which gives information about the organisations who have access to information and the uses they make of it.  These notices can be made available via a School or LA website with hard copies available from schools for those parents without Internet access  

The text on both layers of FPN that relates to the work of Connexions and the Managing Information Across Partners (MIAP) Programme is only necessary for secondary schools.

The sections in Layer Two which refer to the Local Authority can be omitted for those City Technology Colleges, Academies and Non-Maintained Special Schools who do not have voluntary agreements to share information with their LAs.

The suggested text of the fair processing notice is provided, with guidance on issuing it to parents.  This notice and guidance supersede those issued in previous years.  

The footnotes in both layers provide instructions about text which the issuing school and/or LA should add to meet local circumstances (for example the school's address or website URL).

Layer One  48kb

Layer Two  76kb

The changes for 2009 are as follows:  

Additional Data Items in School Census 2009

• In Primary Schools, the number of hours of funded education received by 3 and 4 year olds
• Unique Learner Numbers
• For all pupils under 19, the names, addresses, and telephone numbers for all parents and carers to be used in the ContactPoint database – the footnote in Layer2 of the FPN details a definition of a parent or carer.  

Changes to the text

• Textual amendments and additions arising from comments on the previous notice/ guidance, legal advice and developments since September 2008.

In view of the statutory implications of ContactPoint, the revised fair processing notice needs to be sent to parents/pupils during Autumn Term 2008 together with a data sheet showing what information is currently held by the school about the pupil and a process to allow the parents to update their own data before the first data collection in January 2009.

If schools or LAs intend to share data outside the parameters of the fair processing notice they should ensure that they have the sanction of their own legal advisers to do so, that such sharing complies with the Data Protection Act 1998 and that they include the organisations they will be sharing with in the Fair Processing notice.

Action Required and due date:  LAs/Schools to ensure that the Fair Processing Notice is issued to parents during the Autumn Term 2008.  In view of the additional data being collected on parents/carers for ContactPoint, the importance of this cannot be emphasised too highly.

Background

Schools, Local Authorities (LAs), the Department for Children, Schools and Families (DCSF) , the Qualifications and Curriculum Authority (QCA), Ofsted, the Learning and Skills Council (LSC), the Department of Health (DH), Primary Care Trusts (PCTs) and organisations that require access to data in the Learner Registration Scheme as part of the Managing Information Across Partners (MIAP) programme are all “data controllers” under the Data Protection Act 1998 in that they determine the purpose(s) for which “personal data” (i.e., data about living individuals from which they can be identified) is processed and the way in which that processing is done.  This guidance focuses primarily on personal data about pupils, although personal data may also be held on other groups such as parents and carers, teaching and non-teaching staff, and similar considerations with regard to “fair processing” will apply to them.

Data controllers have to provide “data subjects” (individuals who are the subject of personal data) with details of who they (the data controllers) are, the purposes for which they process the personal data, and any other information that is necessary to make the processing of the personal data fair, including any third parties to whom the data may be passed on.  This is normally done by what is referred to as a “fair processing notice”.

Pupils and parents, as data subjects, have certain rights under the Data Protection Act 1988, including a general right to be given access to personal data held about them by any data controller.  There is a presumption (endorsed by legal guidance issued by the Information Commissioner) that children of twelve years of age and over have sufficient maturity to exercise their rights themselves, though in practice there will be exceptions to this

The fair processing obligations on the data controller may appropriately be met by providing a fair processing notice to the parent (or the person with parental responsibility) where a child is younger than twelve, though the parent should be encouraged to share it with the child if the child has the maturity to understand it. However, where the child is aged twelve or more, the fair processing notice should be provided both to the child and to the parent.  This acknowledges both the rights of the child and the parent’s need to be aware of how their child’s information is handled.

Further information about fair processing requirements, and guidance on the Data Protection Act 1998 generally, can be obtained from the Information Commissioner’s website (http://www.ico.gov.uk).

In order the cut the burden on schools, and after consultation with the Information Commissioner, our suggested Fair Processing Notice (FPN) has been broken down into two layers.  Layer One is a brief one/two page notice, outlining simply the core fair processing information, to be sent to pupils and/or parents.  Layer Two is the full FPN.  Layer Two can be made available via a School or LA website with hard copies available from schools on demand from those parents without Internet access.

The footnotes in both layers provide instructions about text which the issuing school and/or LA should add to meet local circumstances (for example the school's address or website URL).

LAs and Schools should ensure that:

• they issue the fair processing notice (Layer 1) to all current pupils of the age of 13 and over and to the parents of all current pupils under the age of 13 as soon as possible, even if a fair processing notice has been previously issued to them; this is to ensure that all are informed of any additional data collection and any changes in the use of the data; Layer 2 can be made available via the school or LA websites but must be available as a hard copy if requested
• this notice covers processing carried out by DCSF QCA, Ofsted, the LSC, DH , PCTs and organisations that require access to data in the Learner Registration Scheme as part of the Managing Information Across Partners (MIAP) programme as well as by the school (rather than these organisations sending separate notices, which would be logistically very difficult and confusing for parents);
• schools should issue Layer 1 to new pupils and/or their parents as part of the enrolment process; together with a data sheet showing the data that will be held about the pupil and that will be shared with the LA or the DCSF.  Ideally the process should be repeated at the start of each academic year but as a minimum it must be reissued to pupils at the start of the academic year when they will be 13 and
• they should reissue Layer 1 to pupils at age 16, to draw to their attention that the right under the Learning and Skills Act to opt out from the passing on of information over and above name and address of pupil and parent to those providing Connexions services, passes from the parent to the pupil at that age.

Most of the FPN relates to all schools, except for the Learner Registration Scheme which is for schools with children aged 14 and over, or those under 14 registering for post-14 qualifications.  There is an additional section at the end of the FPN about pupils’ rights under the Data Protection Act and passing information to Connexions.

To reduce the burden on schools of having to issue separate FPNs to all parents and carers for each child, it is suggested that one letter is sent to the main parental/carer address and that parents are invited to check and update the information held about them by contacting the school direct.

Before issuing any of the FPN layers the LA and the school will need to consider the adequacy of the paragraph describing the uses of personal data by the school, and also insert contact details for the school’s Data Protection Officer.  If your school intends to share data with anyone else, you should ensure (through appropriate legal advice) that such sharing complies with the Data Protection Act 1998 and include details of the organisations with which you will be sharing the data in the FPN.

As well as issuing the notice directly to pupils and/or parents, schools may also include Layer 1 in other communications with parents (Eg the school prospectus, the governors’ annual report, the individual pupil report, or the annual data checking sheet), and/or display the text on a school website or in a prominent location in the school.  These are not however requirements, nor are they a substitute for the arrangements indicated above.

Passing information to Connexions

In addition to the obligation on schools to provide certain information to other schools, DCSF, QCA, Ofsted, the LSC, DH and PCTs and organisations that require access to data in the Learner Registration Scheme as part of the Managing Information Across Partners (MIAP) programme, there is a legal requirement under Section 117 of the Learning and Skills Act 2000 to pass information on request to those involved in the provision of Connexions services.  Connexions services are for pupils between the ages of 13 and 19 years.

The information which schools are required to provide consists of:

1. the names and addresses of pupils and their parents – which must be supplied to those providing Connexions services in any event;
2. other information requested relevant to the provision of Connexions services – in this case parents (or pupils themselves if aged 16 or over) have the right to instruct the school not to supply this information to those providing Connexions services.

Note that the provision in 2. is an opt-out, not an opt-in.  Until and unless the parent or pupil gives an instruction, the school remains under a statutory duty to provide information to those providing Connexions services on request.

For the Connexions Service, the fair processing notice given to the parent and the child needs to advise them of the passing on of information to Connexions, and must also advise them of the right to instruct the school not to provide information beyond name and address.

Note that the right to opt out from the passing on of information over and above name and address of pupil and parent to those providing Connexions services passes from the parent to the pupil at age 16.

Parents or pupils are entitled to register an opt-out at any time, in that event no further additional information should be passed to Connexions after the opt-out has been received.  

The Connexions Service supports young people, helping them to achieve their potential and to realise benefits from education and training.  It is very important that the Connexions Service receive the information about their clients which they need to do this job effectively – subject only to the opt-out provision described above.  The information required will include contact details of pupils and their parents or carers, gender, date of birth, ethnicity, special educational needs, school attended, and Key Stage or examination results.

Funding and accountability for Connexions lies with the Local Authority

Information provided to Connexions before parents or pupils have been notified

If a school has provided pupil information beyond name and address to the Connexions Service inadvertently without notifying parents or pupils that this is happening, and then receives a parental or pupil opt-out when the fair processing notice is issued, the school must advise the parent or pupil of the situation, and also inform the Connexions service provider that the opt-out has been claimed and of the need for them to take appropriate action.  In the event of pupils, at age 16, opting out of the provision of information to Connexions providers when their parents have not previously done so, the Connexions provider should be informed in the same way.

Passing information to ContactPoint

Provisions in The Children Act 2004 Information Database (England) Regulations 2007, made under section 12 of the Children Act 2004, require all maintained schools to provide certain information to the database known as ContactPoint.

ContactPoint will provide a quick way for practitioners (Eg. headteachers) to find out who else is working with the same child.

This information includes basic identifying information, on both the pupil and the parents or carers of the pupil.  As this is the first time that personal data about parents and carers has been collected via the School Census it is extremely important that the appropriate FPN is sent to all parents or carers who have parental responsibility for the child.

Within the school MIS system, schools will need to ensure that they have recorded accurate addresses, phone numbers including local area codes and used the relationship codeset accurately.  We are aware that some schools use the FAM code which is intended for “other family members” as a place to record information about parents – as the Children Act only gives ContactPoint the right to receive information on parents, the DCSF can only collect information on contacts identified as Father, Mother, Step Father, Step Mother, Foster Mother and Foster Father or as Carer where the parental responsibility tag is set as Yes.  We appreciate that in many cases that there will be multiple returns for an individual child.

This data will be provided to ContactPoint nationally from the Department, from the information provided in the School Census, rather than from individual schools.

(back to Data Protection for schools)