As many staff are now working from home, it raises a number of data protection issues that schools need to be alert to. Reassuringly, the website for the Information Commissioner’s Office states that they will not take regulatory action if an organisation’s data protection practices are not up to their usual standard as a result of the pandemic if organisations need to prioritise other areas or adapt their usual approach during this extraordinary period.
However, it will still be important for schools to consider data protection as part of their management procedures going forward, not least because of the potential safeguarding risks associated with a data breach. Given the large amount of personal data and sensitive personal data that staff members will now be processing from home, ideally schools should carry out a data protection impact assessment to help to identify any measures that need to be put in place to manage the risks. Staff should be reminded about the need to be careful with personal data and support and advice should be given to staff to ensure that they have appropriate security and anti-virus measures on their devices and laptops. You should review your policy on the use of personal devices / home working and update it to reflect the current circumstances if required.
Sharing personal data with hub schools
Another data protection consideration relates to pupils who are attending a hub school which is not their usual school as there will be certain information which their home school should share relating to safeguarding, medical conditions, dietary requirements, SEN and any other information the hub school needs in order to carry out its obligations safely.
GDPR is not a barrier to sharing this information but the key point is that any decision relating to the disclosure of pupil information should be proportionate in the circumstances and ideally a note should be taken to explain why sharing certain information is considered justified in the circumstances (being mindful that the nature of a lot of the information that is being shared is inherently sensitive). The information should be shared securely and should only be disclosed to the hub school once you are sure that the parents or carers are definitely sending their child there.
A separate point to add is that schools should try to ensure that they inform parents and, where relevant, pupils about the information that has been disclosed to the hub school, ideally within a month of the new schooling arrangements. This would effectively be a short privacy notice so that it is clear what information is being processed by the hub school and why. This privacy information could be sent by the hub school in the form of a letter to parents / pupils to explain that as the pupil is attending the school, the pupil’s home school has provided information to enable the hub school to safeguard the wellbeing of the children attending the temporary provision. A summary of the general information which has provided to the hub school should be given. Parents / pupils should not be asked for consent to share this information as consent is not an appropriate lawful basis to rely on in these circumstances.