188体育

To keep children safe and make sure they get the support they need, you can share information with other schools and children鈥檚 social care teams. It鈥檚 not usually necessary to ask for consent to share personal information for the purposes of safeguarding a child.

Your designated safeguarding lead will decide if personal data needs to be shared. They should make sure they record:

• who they鈥檙e sharing that information with
• why they鈥檙e sharing the data
• whether they have consent from the pupil, parent or carer

Read working together to safeguard children to find out more information about sharing a pupil鈥檚 safeguarding file. You should also refer to the safeguarding section of keeping children safe in education.

Occasionally, you may need to share personal information about your pupils with local authorities, other schools or children鈥檚 services. For example:

• if a pupil shows signs of physical or mental abuse, you may need to pass this information on to children鈥檚 services
• another school may need to know which pupils will be at their sports day or on a joint school trip

Sharing information can help provide appropriate services that safeguard and promote the welfare of children. The Data Protection Act 2018 and UK GDPR provides a framework to make sure that personal information is shared appropriately.

Before you share any data, you must:

• consider all the legal implications
• check if you need permission to share the data
• confirm who needs the data, what data is needed and what they鈥檒l use it for
• make sure that you have the ability to share the specified data securely
• check that the actions cannot be completed or verified without the data

You also have a statutory requirement to share personal data about your pupils with DfE through the school census. You do not need to get consent from pupils, parents or carers to share this data with us. You should provide information about what data you share in your school鈥檚 privacy notice. Privacy notice model documents suggest wording to explain to staff, parents, carers and pupils what data you鈥檙e collecting and sharing.

Schools may also need to share personal data about their staff with the local authority.

If a pupil moves to another school, you should transfer their records to the new school. This includes the pupil鈥檚 common transfer file and educational record. You must:

• make sure you transfer the data securely
• transfer the record within 15 days of getting confirmation the pupil is registered at another school
• be able to trace the record during the transfer

To securely share and transfer pupil records, you could:

• use the school to school (S2S) system
• send them to a named person using an encrypted email
• ask your local authority to transfer them
• deliver any paper records in person or ask the new school to collect them

If you鈥檙e organising a school trip with another school, you鈥檒l need to share data with them to confirm which pupils are going. You may also need to share details such as dietary requirements or medical information to make sure pupils are safe. Where you already have consent for the information, make sure this also covers sharing it.

Before sharing any personal data, you need to identify the lawful basis. This may be consent from the individual. There may be some circumstances where it may not be appropriate to ask for consent, however. For example:

• if the individual cannot give consent
• it鈥檚 not reasonable to ask for consent
• when there鈥檚 a safeguarding concern

You鈥檒l usually need to get the pupil鈥檚 consent to share their data if they鈥檙e aged 13 or over. If they鈥檙e under 13, you must get consent from whomever holds parental responsibility for the child.

Guidance on understanding and dealing with issues relating to parental responsibility is also available. The Information Commissioner鈥檚 Office has guidance to help you understand a .

How to get consent

You can get consent in different ways. It must be clear that the individual agrees to share their personal data and understands what they鈥檙e agreeing to. Do not use pre-ticked boxes or add disclaimers that state that, by not responding, they are agreeing to share their data. You should keep a record of:

• the consent
• when you got the consent
• how you got the consent 鈥� for example, keeping the letter you sent to parents or carers

When getting consent, you need to explain:

• what personal information you鈥檙e sharing
• why you鈥檙e sharing it
• who you鈥檙e sharing it with and what they鈥檒l use it for
• how you鈥檒l share their information
• the process for withdrawing consent

Any letters you send to parents or carers that ask for a reply slip that includes personal data should have a data protection statement. This could mean linking to a privacy notice or including information within the letter.

If you鈥檙e asking for consent from a pupil aged 13 or over, you must write your request so they can understand it and are clear about what they鈥檙e agreeing to.

Case study: ensuring data subjects have their rights respected when using biometric data

If you use pupils鈥� biometric data as part of an automated biometric recognition system, such as using fingerprints to receive school meals instead of paying with cash, you must comply with the requirements of the Protection of Freedoms Act 2012.

That means following these steps.

1. In accordance with the child鈥檚 age or capacity, get written consent from at least one parent or carer before you take and process any biometric data from their child. See the section on consent over age of 13.

2. Provide an alternative means to access the relevant services for any pupil from whom you do not have consent. For example, pupils must be able to pay for school meals using cash at each transaction, if they wish.

3. Delete any relevant data already captured, if a parent or carer withdraws their consent.

If a pupil does not want their biometric data processed, you must not process it even if their parent or carer has given consent. This is required by law.

You also need to get consent from any staff members using the school鈥檚 biometric system. Staff can withdraw their consent at any time and you must then delete any relevant data already captured.

Guidance is available on protecting children鈥檚 biometric information in school.

Photos are used in school for many different reasons. You鈥檒l need to identify the lawful basis for each different use of a photograph.

You should have a clear photo policy published alongside your privacy notice and provide copies of both to parents and carers.

You may be able to use photos in printed materials such as a prospectus or marketing materials under the . However, you need to provide pupils, parents or carers with an opportunity to object before you go to print.

You must get consent to share photos on your school鈥檚 social media channels or elsewhere online.

If you鈥檙e using a photo of a pupil, do not include their name unless you have specific consent to do so.

You should only use a photo in line with the consent provided. When you鈥檙e asking for consent, you should make it clear for how long you鈥檒l use the photograph.

Photos used in identity management systems may be essential for performing the public task of the school, but you should delete them once a child is no longer a pupil at your school.

The Information Commissioner鈥檚 Office provides further guidance on .

UK GDPR does not stop schools from publishing exam results online or in the local press.

You do not need to get consent from pupils, parents or carers to publish exam results. However, you should tell pupils where and how their results will be published before they鈥檙e published. This gives them an opportunity to ask you to remove their results from the list should they wish to.

The Information Commissioner鈥檚 Office has more information about .

You will need to provide data to support immunisation programmes in your school. This includes:聽

• sharing information leaflets and consent forms with parents or carers
• providing a list of eligible children and young people, and their parent鈥檚 or carer鈥檚 contact details to the School Age Immunisation Service (SAIS) team

Sharing these contact details does not mean that a vaccine will be given. A parent or carer will need to give their consent for a vaccine to be given to their child.

There is a lawful basis for you to share information with school immunisation teams under article 6(1)(e) of UK GDPR. This states that the information can be shared if 鈥減rocessing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller 鈥�.

This means that the school can share this information with immunisation programmes as it is in the public interest.

Sharing information with immunisation programmes is part of the exercise of a school鈥檚 official authority. Schools also have a duty to support wider public health.

Data protection laws do not prevent you from sharing personal data where it is appropriate to do so in a fair and lawful way, and in this instance it is beneficial to do so.