Login


GDPR

 The Department for Education are focussing on improving attendance in Schools.  They wish to collate detailed attendance data from all Schools and Academies.  Access to better data is one thing that will allow the Department for Education to achieve their goal to improve attendance.  Access to data at a national, regional and local level will both help highlight particular challenges and identify solutions that are working well and can be shared. 

 

The Department for Education will be accessing personal pupil data such as name, date of birth, etc. 

 

To enable this process to work effectively, the Department for Education have procured the services of Wonde, a data processor.  Wonde will provide the software that essentially pulls the data from our School’s databases and places it in to the databases of the Department for Education.  Wonde act as a data processor meaning they are prevented legally from using or sharing any personal data.  Wonde can only process personal data for the reason this task is intended and as advised by the data controller (The Department for Education).

 

Our School and the Department for Education act as data controllers.  This means we each require a lawful basis to process the attendance data.  There are six available lawful bases for processing data.  No single basis is ‘better’ or more important than any other.  Which basis is most appropriate will depend on the purpose for processing the data.

 

Consent is one lawful basis for processing, but there are alternatives. Consent is not inherently better or more important than these alternatives.  Consent is not always required when processing data and other lawful bases should always be considered.  For this task consent is not required due to the nature of the task as the Department for Education are processing on the basis of ‘Public Task’.  The school have a legal duty to provide the Department for Education with the data they request.   The Information Commissioner’s Office explain that to rely on the basis of Public Task you must meet one of the following criteria:

 

  • Process personal data ‘in the exercise of official authority’. This covers public functions and powers that are set out in law; or
  • Process personal data to perform a specific task in the public interest that is set out in law.

This particular task for the Department for Education meets the above criteria and therefore no consent from parents to share their children’s data is required.