Foxfield School Data Protection Policy Document 2018

General Statement

Foxfield School fully endorses and adheres to the principles of data protection as outlined in the Data Protection Acts 1994 and 1998. All staff involved in the collection, processing and disclosure of personal data are aware of their duties and responsibilities within these guidelines.

Enquiries

Information about Foxfield School’s Data Protection policy can be obtained from

the Headteacher or Deputy in charge of Pupils and Curriculum/ Health and Safety Officer.

Fair Obtaining and Processing

Foxfield School undertakes to obtain and process data fairly and lawfully by informing all data subjects of the reasons for data collection, the purposes for which data is held, the likely recipients of the data and the data subjects’ right of access. Information about the use of personal data is printed on the appropriate collection form. If details are given verbally, the person collecting the data will explain the issues before collection the information.

Terms

Processing - Obtaining , recording or holding the 

information or data or carrying out a set of operations on the information or data.
data subject   means an individual who is the 
subject of personal data or the person to whom the data relates.

personal data  means data which relates to a living individual who can be identified. Addresses and telephone numbers are examples.

Parent refers to the meaning given in the Education Act 1996, and includes any person who has parental responsibility for a child.

Registered Purposes

The Data Protection Act Registration entries for Foxfield School are available for inspection by appointment. Explanation of any codes and categories is available from the Assistant Headteacher who is the person nominated to deal with Assessment Recording and Reporting at Foxfield School or the School Clerke who will keep more personal information such as home addresses and phone numbers. Information held for these stated purposes will not be used for any other purpose without the data subject’s consent.

Data Integrity

Foxfield School undertakes to ensure that data integrity is achieved by the following methods:

•	Data Accuracy 

Data will be as accurate and up-to-date as is reasonably possible. If a data subject informs the School of a change of circumstances their computer record will be updated as soon as is practicable. 

Data Adequacy and Relevance 

Data held about people will be adequate, relevant and not excessive in relation to the purpose for which the data is held. In order to ensure compliance with this principle, Foxfield School will check records regularly for missing, irrelevant or seemingly excessive information and may contact the subjects to verify certain items of data. Records are checked for irrelevant data . Decisions about what can be deleted is made by the Headteacher.

•	Length of Time 

Data held about individuals will not be kept for longer than necessary for the purposes registered. It is the duty of the school Clerke to ensure that obsolete data is properly erased. 

•	Subject Access 

The Data Protection Acts extend to all data subjects a right of access to their own personal data. In order to ensure that people receive only information about themselves it is essential that a formal system of requests is in place. Where a request for subject access is received from a pupil, the school’s policy is that: 

•	Requests from pupils will be processed as any subject access request as outlined below and the copy will be given directly to the pupil, unless it is clear that the pupil does not understand the nature of the request. 

•	Requests from pupils who do not appear to understand the nature of the request will be referred to their parents or carers. 

•	Requests from parents in respect of their own child will be processed as requests made on behalf of the data subject (the child) and the copy will be sent in a sealed envelope to the requesting parent. 

•	Authorised Disclosures 

Foxfield School will, in general, only disclose data about individuals with their consent. However there are circumstances under which Foxfield School’s authorised officer may need to disclose data without explicit consent for that occasion. 

These circumstances are strictly limited to: 

•	Pupil data disclosed to authorised recipients related to education and administration necessary for the school to perform its statutory duties and obligations. 

•	Pupil data disclosed to authorised recipients in respect of their child’s health, safety and welfare. 

•	Pupil data disclosed to parents in respect of their child’s progress, achievements, attendance, attitude or general demeanour within the vicinity of the school. 

•	Staff data disclosed to relevant authorities e.g. in respect of payroll and administrative matters. 

•	Unavoidable disclosures, for example to an engineer during maintenance of the computer system. In such circumstances the engineer would be required to sign a form promising not to disclose the data outside the school. 

•	Only authorised and trained staff are allowed to make external disclosures of personal data. Data used within the school by administrative staff and teachers will only be made available where the person requesting the information is a professional legitimately working within the school who need to know the information in order to do their work. We will not disclose anything on pupils’ records which would be likely to cause serious harm to their physical or mental health or that of anyone else. 

A “legal disclosure” is the release of personal information from the computer to someone who requires the information to do his or her job within or for the organisation, provided that the purpose of that information has been registered.

An “illegal disclosure” is the release of information to someone who does not need it, or has no right to it, or one which falls outside the organisation’s registered purposes.

Data and Computer Security

Foxfield School undertakes to ensure security of personal data by the following general methods.

Physical Security

Appropriate building security measures are in place, such as alarms, window locks, deadlocks and computer hardware storage. Only authorised persons are allowed access to the technician’s computer room and Network system. Visitors to the school are required to sign in and out, to wear identification badges whilst in the school and are, where appropriate, accompanied.

Logical Security

Security software is installed on all computers containing personal data. Only authorised users are allowed access to the computer files and password changes are regularly undertaken. Computer files are backed up (i.e. security copies are taken) regularly.

Procedural Security

In order to be given authorised access to the computer, staff will have to undergo checks and will sign a confidentiality agreement. All staff are trained in their Data Protection obligations and their knowledge updated as necessary. Computer printouts as well as source documents are shredded before disposal.

Overall security policy for data is determined by the Headteacher and is monitored and reviewed regularly, especially if a security loophole or breach becomes apparent. 

Any queries or concerns about security of data in the school should in the first instance be referred to the Headteacher

A  deliberate breach of this Data Protection Policy by any member of staff will be treated as a disciplinary matter, and serious breaches could lead to dismissal.

Further details on any aspect of this policy and its implementation can be obtained from the Headteacher.

Date of issue: 08/10/12

Date of revision; 08/10/14