Controller DPO
Our controller Data Protection Officer (DPO) is the Head of Information Governance.
Contact the Data Protection Officer.
Information we collect
We collect school pupil and performance data on behalf of the Department for Education (DfE) to meet the DfE’s statutory obligations. This information is collected securely via the DfE’s Secure Access system. We do not retain individual identifying data beyond the time needed for processing.
Information we collect includes:
- personal pupil information (such as name, unique pupil number, date of birth, contact details, home address and postcode and free school meal eligibility)
- special category characteristics (such as ethnicity, language and special educational needs information
- attendance information (such as school, sessions attended, number of absences and absence reasons)
- exclusions information (suspensions and permanent)
- national curriculum assessment results and attainment information
- parent information to check for eligibility of free school meals
- personal staff information (such as name, NI number, teacher number)
- characteristics (such as gender, ethnicity, date of birth and disability status)
- contract information (such as start date, hours/weeks worked, post, role and salary information)
- absence information (such as number of absences and reasons)
- qualification information (such as type of qualification and subject)
Purpose
We use children and young person’s data to:
- enable us to carry out specific functions for which we are statutorily responsible
- derive statistics which inform decisions such as the funding of schools
- assess school performance and to set targets for schools
- perform analysis on the pupil population at school and local authority level
The statistics are used in such a way that individual children cannot be identified from them.
We use workforce data to:
- enable us to carry out specific functions for which we are statutorily responsible
- derive statistics to develop an understanding of changes to the school workforce at an local authority level for local authority monitoring purposes.
The data is processed in such a way that individual staff cannot be identified and statistics are reported on a school and local authority level only.
Lawful basis
Under the UK General Data Protection Regulation (UK GDPR), the lawful bases we rely on for processing child and young person’s information are:
Article 6 – paragraph (c) and (e):
(c) processing is necessary for compliance with a legal obligation to which the controller is subject.
(e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
Article 9 (special category personal data) – paragraph (g) and (j):
(g) processing is needed for reasons of substantial public interest, on the basis of Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject.
(j) processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) based on Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject.
We collect and use pupil-level information from the school census by statutory obligation placed on us by the Department for Education under under Section 537A of the Education Act 1996 and under section 3 of The Education (Information about Individual Pupils)(England) Regulations 2013.
School workforce information is processed in compliance with Article 6 (1) e) of the UK GDPR, where processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
Special category personal data such as ethnic origin is processed in compliance with Article 9 (2) g) of the UK GDPR, processing under reasons of public interest, which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject.
The Health and Social Care Act 2012 and the NHS Act 2006 provide justification for processing young people’s information for vaccinations under the UK GDPR lawful basis conditions of:
- exercise of official authority
- provision of healthcare
- public interest in the area of public health
How long will we keep your personal information
Our policy is not to hold in the Schools Research and Statistics Service local systems, any personal data beyond the period of necessary processing, unless it is anonymised and non-identifiable to an individual. The anonymised data will only be used for research and statistical purposes and to evaluate and develop educational policy and strategies and to support schools in school self-evaluation.
Recipients
We may share children and young person’s information with the following services only:
- Lambeth supporting families teams
- 14-19 education and training team
- youth support services (pupils aged 13+)
- the Department for Education (DfE)
- NHS England (via CHIS service providers) for child immunisation purposes
Rights
The Schools Research and Statistics Service do not hold personal information for identifiable individuals from the school census and other data collections, beyond the period of being processed. Identifiable personal information is removed immediately after this period.
If you have a concern about the way the Schools Research and Statistics Service are collecting or using your personal data, we ask that you raise your concern with us in the first instance. Alternatively, you can contact the Information Commissioner’s Office.
Under data protection legislation, parents and pupils have the right to request access to information about them that the local authority holds. To make a request for your personal information, or be given access to your child’s educational record, contact infogov@lambeth.gov.uk.
You also have the right:
- to ask us for access to information about you that we hold
- to have your personal data rectified, if it is inaccurate or incomplete
- to request the deletion or removal of personal data where there is no compelling reason for its continued processing
- to restrict our processing of your personal data (i.e. permitting its storage but no further processing
- to object to direct marketing (including profiling) and processing for the purposes of scientific/historical research and statistics
- not to be subject to decisions based purely on automated processing where it produces a legal or similarly significant effect on you