DATA PROTECTION AND INFORMATION SHARING POLICY
GDPR stands for General Data Protection Regulation. GDPR states that personal data should be ‘processed fairly & lawfully’ and ‘collected for specified, explicit and legitimate purposes’ and that individuals data is not processed without their knowledge and are only processed with their ‘explicit’ consent. GDPR covers personal data relating to individuals.
White Rock pre-school is committed to protecting the rights and freedoms of individuals with respect to the processing of children's, parents, visitors and staff personal data.
The Data Protection Act gives individuals the right to know what information is held about them. It provides a framework to ensure that personal information is handled properly.
White Rock Pre-school collects and uses personal information about staff, pupils, parents and other individuals who come into contact with the school. This information is gathered in order to enable it to provide education and other associated functions. In addition, there may be a legal requirement to collect and use information to ensure that the school complies with its statutory obligations.
What is Personal Information? Personal information or data is defined as data which relates to a living individual who can be identified from that data, or other information held.
All staff involved with the collection, processing and disclosure of personal data will be aware of their duties and responsibilities by adhering to these guidelines.
GDPR includes 7 rights for individuals
1) The right to be informed White Rock Pre-school is a registered Childcare provider with Ofsted and as so, is required to collect and manage certain data. We need to know parent’s names, addresses, telephone numbers, email addresses, date of birth and National Insurance numbers. We need to know children’s’ full names, addresses, date of birth and Birth Certificate number. For parents claiming the free nursery entitlement we are requested to provide this data to Torbay Council; this information is sent to the Local Authority via a secure electronic file transfer system.
We are required to collect certain details of visitors to our pre-schools. We need to know visits names, telephone numbers, addresses and where appropriate company name. This is in respect of our Health and Safety and Safeguarding Policies. As an employer we are required to hold data on our employees; names, addresses, email addresses, telephone numbers, date of birth, National Insurance numbers, photographic ID such as passport and driver’s license, bank details. This information is also required for Disclosure and Barring Service checks (DBS) and proof of eligibility to work in the UK.
2) The right of access
At any point an individual can make a request relating to their data we will need to provide a response (within 14 days). White Rock Pre-school can refuse a request, if we have a lawful obligation to retain data i.e. from Ofsted in relation to the EYFS, but we will inform the individual of the reasons for the rejection. The individual will have the right to complain to the ICO if they are not happy with the decision.
3) The right to erasure
You have the right to request the deletion of your data where there is no compelling reason for its continued use. However we have a legal duty to keep childrens and parents details for a reasonable time, White Rock Pre-school retain these records for 3 years after leaving pre-school, children's accident and injury records for 19 years (or until the child reaches 21 years), and 22 years (or until the child reaches 24 years) for Child Protection records. Staff records must be kept for 6 years after the member of leaves employment, before they can be erased. This data is archived securely and shredded after the legal retention period. There is a full Risk Assessment in place for transportation and storage.
4) The right to restrict processing Parents
Visitors and staff can object to White Rock Pre-school processing their data. This means that records can be stored but must not be used in any way, for example reports or for communications.
5) The right to data portability
White Rock Pre-school requires data to be transferred from one IT system to another; such as from White Rock Pre-school Limited to the Local Authority. These recipients use secure file transfer systems and have their own policies and procedures in place in relation to GDPR.
6) The right to object
Parents, visitors and staff can object to their data being used for certain activities like marketing or research.
7) The right not to be subject to automated decision-making including profiling. Automated decisions and profiling are used for marketing based organisations. White Rock Pre-school does not use personal data for such purposes.
Purpose This policy is intended to ensure that personal information is dealt with correctly and securely and in accordance with the Data Protection Act 1998, and other related legislation. It will apply to information regardless of the way it is collected, used, recorded, stored and destroyed, and irrespective of whether it is held in paper files or electronically.
Access to data and records Staff and parents/carers whose personal data is held by White Rock Pre-School are entitled to: Ask what information is being held Ask how to gain access Be informed how to keep it up to date Be informed as to what the Pre-School is doing to comply to obligations under the GDPR 2018.
Staff Responsibilities All the staff at White Rock Pre-School are responsible for:
Checking that any personal data they provide is accurate and up to date. Informing the manager of any changes to the information they have provided.
Ensuring that all data and records of children and families who are at the Pre-School are kept securely.
Ensuring that personal information is not disclosed either orally or in writing to any unauthorised third parties. If, as part of their job responsibilities, staff collect personal data from families and children, they must comply with this policy.
White Rock Pre-School is authorised to keep the following records regarding children:
Headcount Data - All providers who offer the Free Entitlement are required to submit headcount data via a Torbay Early Years portal each term; this includes details of the children they will claim for and the hours and weeks the child will access in that term. Headcount days are set for each term and these are published in the Free Entitlement contract.
Early Years Census - Each year, early years PVI settings who offer the Free Entitlement are required to complete an Early Years Census. This information is collected via the Early Years Provider Portal and then passed by Torbay Count Council to the Department for Education
Adults authorised to collect children from pre-school; The names, addresses, telephone numbers and photographs of emergency contacts in case of children's illness or accident; The allergies, dietary requirements and illnesses of individual children; The times of attendance of children, staff, volunteers and visitors;
Accidents; Incidents; Safeguarding documentation; IEPs; Concerns/complaints. Information regarding staff: The names, addresses, telephone numbers of all staff and next of kin; bank details for payment purposes; Medical information; Contract of employment; Signed policy agreements; CPD documents; Concerns/complaints; Attendance register; Absence information; Accidents; Incidents;
Photograph Policy Within the Early Years Foundation Stage Framework (2014), practitioners are required to obtain photographic evidence of children’s play, learning development, and experiences within the Pre-School setting. These photographs are then printed and put into each child’s Developmental Folders. The individual folders show each child’s developmental progress and are a personalised record of progression. When the child leaves the Pre-School setting, this document goes with them and may be used by the teachers in the child’s new Primary school to obtain information regarding each child’s skills, learning and development. All parents will be requested to authorise the use of photographs being taken for the purpose of the above when they fill in the registration form. However, if any photographs are required for other purposes than that mentioned above, such as publicity, news articles, television, or the Pre-School's website, parents will be requested to fill in a specific form authorising the use of their child’s image. Once the photographs are taken, they are printed and all digital copies of photographs are deleted. If photographs are required for research purposes, parents' authorisation will be requested in writing with a written and signed explanation of how these photographs will be used. No person is authorised to remove the camera's from the setting to print out photographs of the children. Once the photos have been printed they are deleted from the camera and the computer unless being used for updating the Pre-School website. Any member of staff who keeps and uses photographs of the children at White Rock Pre-School other than for the purposes mentioned above will receive instant dismissal for gross misconduct, and the authorities (LADO, ISA, Ofsted) will be immediately informed.
White Rock Pre-School’s designated Data Controller Karen Hornabrook, is responsible for ensuring compliance with the Data Protection Act and the implementation of this policy. Any breach of this policy will be taken seriously and may result in formal action. Any member of the staff or any parent/carer who considers that the policy has not been followed in respect of personal data about themselves should raise this matter with the Pre-School Manager and/or chair.