Privacy notice – How we Use Student Information

Under data protection law, individuals have a right to be informed about how each school uses any personal data that we hold about them. We comply with this right by providing ‘privacy notices’ (sometimes called ‘fair processing notices’) to individuals where we are processing their personal data. This privacy notice explains how we collect, store and use personal data about Students. It is based on the Department for Education’s model privacy notice for Students amended to reflect the way we use data in our schools.

We, Bentley Wood Trust, are the ‘data controller’ for the purposes of data protection law. Our Data Protection Officers are Naseema Akbar (Aylward Primary), Louise Kelly (Bentley Wood) (see ‘Contact us’ below).

The categories of student information we process include:

Personal data that we may collect, use, store and share (when appropriate) about Students includes, but is not restricted to:

• personal identifiers and contacts (such as name, unique pupil number, contact details and address, identification documents)
• Results of internal assessments and externally set examinations
• Student and curricular records
• Characteristics, such as ethnic background, eligibility for free school meals, or
• Special educational needs (including needs and ranking)
• Behavioural information (such as exclusions and any alternative provision put in place)
• Details of any medical and administration, including physical and mental health, Doctors information, allergies, medication and dietary requirements
• Attendance information (such as sessions attended, number of absences, absence reasons, and any previous schools attended)
• Safeguarding information (such as court orders and professional involvement)
• Educational Visit records
• Details of any support received, including care packages, plans and support providers
• Photographs
• CCTV images captured in school
• Biometric data used as part of the school’s cashless payment system

We may also hold data about Students that we have received from other organisations, including other schools, local authorities and the Department for Education.

This list is not exhaustive, to access the current list of categories of information we process please see each individual schools’ website for current privacy notices.

Why we collect and use student information:

We use this data to:

1. Support student learning
2. Monitor and report on student attainment and progress
3. Provide appropriate pastoral care
4. Assess the quality of our services
5. Keep children safe (food allergies, or emergency contact details)
6. Comply with the law regarding data sharing (such as, meeting the statutory duties placed upon us for DfE data collections).
7. Administer admissions waiting lists
8. Carry out research
9. Protect student welfare

Our legal basis for using this data

We only collect and use Students’ personal data when the law allows us to. Under the General Data Protection Regulation (UK GDPR), the lawful bases we rely on for processing student information are:

for the purposes of (1), (2), (3), (4), (7), (8) and (9) in accordance with the legal basis of Public task: collecting the data is necessary to perform tasks that schools are required to perform as part of their statutory function

• for the purposes of (5) in accordance with the legal basis of Vital interests: to keep children safe (food allergies, or medical conditions)
• for the purposes of (6) in accordance with the legal basis of Legal obligation: data collected for DfE census information 
• Section 537A of the Education Act 1996
• the Education Act 1996 s29(3)
• the Education (School Performance Information) (England) Regulations 2007
• regulations 5 and 8 School Information (England) Regulations 2008
• the Education (Pupil Registration) (England) (Amendment) Regulations 2013

In addition, concerning any special category data:

• • conditions a, b, c and d of UK GDPR - Article 9

Less commonly, we may also process Students’ personal data in situations where:

• We have obtained consent to use it in a certain way
• We need to protect the individual’s vital interests (or someone else’s interests)

Where we have obtained consent to use Students’ personal data, this consent can be withdrawn at any time. We will make this clear when we ask for consent, and explain how consent can be withdrawn.

Some of the reasons listed above for collecting and using Students’ personal data overlap, and there may be several grounds which justify our use of this data.

How we collect student information

We obtain student information via registration forms at the start of each academic year. In addition, when a child joins us from another school we are sent a secure file containing relevant information. Student data is essential for the schools’ operational use. Whilst the majority of student information you provide to us is mandatory, some of it is provided to us on a voluntary basis. In order to comply with UK GDPR we will inform you at the point of collection, whether you are required to provide certain student information to us or if you have a choice in this.

At Bentley Wood High School, we also use you information as part of an automated( i.e electronically operated) recognition system.  This is for the purposes of paying for items in the school canteen.

How we store student data

We keep personal information about Students while they are attending our school. We may also keep it beyond their attendance at our school if this is necessary in order to comply with our legal obligations. Please see our School Records Management Policy, available from each school’s website, which sets out how long we keep information about students.

Who we share student information with

Where it is legally required, or necessary (and it complies with data protection law) we routinely share personal information about students with:

• Our local authority – to meet our legal obligations to share certain information with it, such as safeguarding concerns and exclusions
• The Department for Education – to meet our legal obligations under regulation 5 of The Education (Information About Individual Students) (England) Regulations 2013.
• The Student’s family and representatives
• Educators and examining bodies – as part of delivering the curriculum.
• Ofsted – to meet regulatory requirements around inspections.
• Suppliers and service providers – to enable them to provide the service we have contracted them for
• Financial organisations – to enable us to provide services to students such as the catering provision
• Our auditors - to meet the requirements of the Academies Financial Handbook and the Academies Accounts Direction.
• Health authorities - to enable them to provide services and support to Students.
• Police forces, courts, tribunals
• Health and social welfare organisations - to enable them to provide services and support to Students.
• Professional advisers and consultants - to enable them to provide the service we have contracted them for
• Charities and voluntary organisations - to enable them to provide services and support to Students.
• Youth support services (students aged 13+)
• Schools that students attend after leaving us

Why we regularly share student information

We do not share information about students with any third party without consent unless the law and our policies allow us to do so.

Youth support services

Students aged 13+

Once our students reach the age of 13, we also pass student information to our local authority and / or provider of youth support services as they have responsibilities in relation to the education or training of 13-19 year olds under section 507B of the Education Act 1996.

This enables them to provide services as follows:

• youth support services

• careers advisers

The information shared is limited to the child’s name, address and date of birth. However, where a parent or guardian provides their consent, other information relevant to the provision of youth support services will be shared. This right is transferred to the child / student once he/she reaches the age 16.

Students aged 16+

We will also share certain information about students aged 16+ with our local authority and / or provider of youth support services as they have responsibilities in relation to the education or training of 13-19 year olds under section 507B of the Education Act 1996.

This enables them to provide services as follows:

• post-16 education and training providers

• youth support services

• careers advisers

Data is securely transferred to the youth support service via a secure file transferring system and is stored within local authority software.

For more information about services for young people, please visit our local authority (Harrow) website  http://www.harrow.gov.uk/

Department for Education

We are required to share information about our students with the Department for Education (DfE) either directly or via our local authority for the purpose of data collections, under:

• Section 537A of the Education Act 1996
• the Education Act 1996 s29(3)
• the Education (School Performance Information) (England) Regulations 2007
• regulations 5 and 8 School Information (England) Regulations 2008
• the Education (Pupil Registration) (England) (Amendment) Regulations 2013

All data is transferred securely and held by DfE under a combination of software and hardware controls, which meet the current government security policy framework.

For more information, please see ‘How Government uses your data’ section.

Requesting access to your personal data

Under data protection legislation, parents and Students have the right to request access to information about them that we hold. To make a request for your personal information, or be given access to your child’s educational record, please contact our Data Protection Officer.

Other rights

Under data protection legislation, parents and students have certain rights regarding how their personal data is used and kept safe, including the right to:

• Object to the use of personal data if it would cause, or is causing, damage or distress
• Prevent it being used to send direct marketing
• Object to decisions being taken by automated means (by a computer or machine, rather than by a person)
• In certain circumstances, have inaccurate personal data corrected, deleted or destroyed, or restrict processing
• Withdraw consent by writing to us if we rely on your consent to justify processing your information,
• a right to seek redress, either through the ICO, or through the courts

How to Raise a Concern

If you would like to discuss anything within this privacy notice or have a concern about the way we are collecting or using your personal data, we request that you raise your concern with the below in the first instance:

We have appointed a data protection officer (DPO) to oversee compliance with data protection and this privacy notice. If you have any questions about how we handle your personal information which cannot be resolved by the above, then you can contact the DPO on the details below: -

Data Protection Officer: Judicium Consulting Limited

Address                        72 Cannon Street, London, EC4N 6AE

Email:                                 dataservices@judicium.com

Alternatively, you can contact the Information Commissioner’s Office at https://ico.org.uk/concerns/

How Government uses your data

The student data that we lawfully share with the DfE through data collections:

• underpins school funding, which is calculated based upon the numbers of children and their characteristics in each school.
• informs ‘short term’ education policy monitoring and school accountability and intervention (for example, school GCSE results or student progress measures).
• supports ‘longer term’ research and monitoring of educational policy (for example how certain subject choices go on to affect education or earnings beyond school)

Data collection requirements

To find out more about the data collection requirements placed on us by the Department for Education (for example; via the school census) go to https://www.gov.uk/education/data-collection-and-censuses-for-schools

The National Pupil Database (NPD)

Much of the data about students in England goes on to be held in the National Pupil Database (NPD).

The NPD is owned and managed by the Department for Education and contains information about students in schools in England. It provides invaluable evidence on educational performance to inform independent research, as well as studies commissioned by the Department.

It is held in electronic format for statistical purposes. This information is securely collected from a range of sources including schools, local authorities and awarding bodies.

To find out more about the NPD, go to https://www.gov.uk/government/publications/national-pupil-database-user-guide-and-supporting-information

Sharing by the Department

The law allows the Department to share students’ personal data with certain third parties, including:

• schools
• local authorities
• researchers
• organisations connected with promoting the education or wellbeing of children in England
• other government departments and agencies
• organisations fighting or identifying crime

For more information about the Department’s NPD data sharing process, please visit:

https://www.gov.uk/data-protection-how-we-collect-and-share-research-data

Organisations fighting or identifying crime may use their legal powers to contact DfE to request access to individual level information relevant to detecting that crime. Whilst numbers fluctuate slightly over time, DfE typically supplies data on around 600 students per year to the Home Office and roughly 1 per year to the Police.

For information about which organisations the Department has provided student information, (and for which project) or to access a monthly breakdown of data share volumes with Home Office and the Police please visit the following website: https://www.gov.uk/government/publications/dfe-external-data-shares

To contact DfE: https://www.gov.uk/contact-dfe