At Data Protection Education, we have an ongoing project to assess potential organisations that our schools are either currently contracted with to supply a product or service, or may in the future be in contract with.

For most organisations, a lot of thought and care goes into ensuring that when you’re collecting data, you are complying with the relevant data protection legislation- that it’s being collected with consent where required, that you have a lawful basis etc. However,

A recent study conducted by Check Point Research which can be found at the bottom of this article has found that there has been a 29% increase in cyberattacks on organisations in the education sector since 2020, the highest increase of any sector. 

Cyber attacks are on the up, and with the education sector seeing the highest number of cyber attacks of any sector since the start of the pandemic, as well as the highest increase in attacks in that same period

With biometric technology becoming more and more prevalent in society, the governance of the personal data that organisations collect from using this technology has recently been a topic of discussion.

The Children’s Code

The first update from the ICO is that the transition year for the introduction of The Children’s Code (also known as The Age Appropriate Design Code) has passed, with the code having come into effect on September 2nd.

Schools in Brighton and Hove have received the following Freedom of Information request:

1. Please send me copies/scans/digital files that record individual racist/religious incidents/bullying incidents in terms of numbers of incidents and their

The National Cyber Security Centre has today upgraded it's advice to schools relating to the prevalence of cybers attacks in the sector:

These protocols aim to ensure that online lessons with pupils when working from home, are safe, secure and continue to provide high-quality education using a virtual platform. 

This is guidance for setting up and managing online lessons using the school’s chosen platform ie  Zoom; Google or Microsoft teams.

Users of Class Dojo will recently have noticed that a requirement to provide consent for international data transfers was included to the login screen.

It is a requirement under the Freedom of Information Act and ICO to set out your commitment to making certain classes of information routinely available, such as policies and procedures, minutes of meetings, annual reports and financial information.

Updated 22 March 2021

The ICO gives the following advice when communicating privacy matters to children:

What information should we give to children?

Transparency is about being clear, open and honest with your users about what they can expect from you.

We've recently had more than one breach reported where physical files have got lost in the post.

In such cases, the sender remains the data controller and is responsible for ensuring that the optimum data security measures are in place during transfer. Where possible, consider whether a physical drop-off (and get a receipt) is a more secure option.

Do I need consent for emergency contacts?

Actually no, and here's why.

We know that we must have a lawful basis for processing any data, and consent is one of the six lawful bases that can be used.

Adapted from: The Irish Data Protection Commissioner

The UK GDPR does not prescribe the exact process for carrying out a DPIA beyond the minimum features outlined above, allowing for flexibility and scalability in line with your organisation’s needs. Although there is no one prescribed approach to take, the following steps can guide you through the process:

We have added publication scheme model templates in the FOI Best Practice area for academies as well as maintained schools.

Difference between the High Level and Detailed Publication Scheme

The Government has provided some guidance on the avoidance of disinformation online.

https://sharechecklist.gov.uk/

What is disinformation?

Disinformation is the deliberate creation or dissemination of false and/or manipulated information

In light of recent ICO reprimands to schools it is important schools remember best practice for managing photos. The formal legal warnings issued by the ICO recently to schools both related to the processing of photos where no consent had been given. 

We've just published two new drip-feeds for printing off a circulating to staff on recognising and responding to subject access requests.

The Data Protection Officer (DPO) can provide support in many areas but are you aware of what we do help with?

There are some more well-known areas of data protection that we would be called upon to advise such as subject access requests and breaches but DPO’s don’t only provide advice and support when things go wrong,

Updated operational guidance has been produced by Public Health England for local commissioners and schools on running the national child measurement programme (NCMP)

We've released version 1 of the Compliance Manager tool.

What is it?
The Compliance Manager allows you to assign any document to staff and enable the following interactions

or

Any standard document type can be uploaded and interactions selected. Then select the users to assign the document too and a date by which the users should have responded.

From the Information Commissioner's Office blog:

A former headteacher has been fined in court for unlawfully obtaining school children’s personal data from previous schools where he worked.

 By changing the culture of email use within an organisation will not only benefit the organisation towards GDPR compliance and beyond, it will also save a significant amount of time by reducing staff workload and hopefully support staff wellbeing too.