Privacy Notice

We use pupil data (information about individual pupils at our school):

• to support pupil learning
• to keep pupils safe
• to monitor and report on pupil progress
• to meet our duties to deliver high standards of educational provision
• to provide appropriate pastoral care
• to provide access to school meals
• to provide access to extracurricular activities
• to assess the quality of our services
• to comply with the law regarding data sharing

We transfer the pupil’s Educational Record to their next school when they leave CCfL or is kept in archive at the end of year 11 in line with our data retention policy.

We collect and use pupil information under the following conditions:

• to meet our duties as a maintained school under the Education Acts 1996, 2002, 2011, the Education and Healthcare Act 2014, the School Standards and Framework Act 1998, the Children’s Act 2004 and related legislation and regulation, the Equalities Act 2010 and other related legislation, and any regulations or statutory guidance made under those acts (Article
  6(1)(e) and Article 6 (1)(c) of the General Data Protection Regulation);
• where it is necessary to meet our duties as an employer and our duties in relation to health and safety (Article 6(1)(c) of the General Data Protection Regulation);
• where it is necessary to protect the pupil’s vital interests (if there is a medical emergency and consent cannot be obtained, for example) (Article 6 (1) (d) and 9 (2) (c) of the General Data Protection Regulation)
• where it is necessary for the defence of a legal claim or potential legal claim (Article 9 (2) (f) of the General Data Protection Regulation)

As a result of your explicit consent to the use (Article 6 (1) (a). We do not require consent for the majority of the data we collect as the school is a public authority carrying out its duties under law. Where we do require your consent for the processing or collection of your child’s data, we will advise you of this in advance and will not use this data without your consent.

Whilst the majority of pupil information you provide to us is mandatory, some of it is provided to us on a voluntary basis. In order to comply with the General Data Protection Regulation, we will inform you whether you are required to provide certain pupil information to us or if you have a choice in this.

The categories of pupil information that we collect, hold and share include:

• Personal information (such as the pupil’s name, their unique pupil number, address and parental contact details)
• Characteristics (such as the pupil’s ethnicity, the language they speak at home, their nationality, country of birth and their eligibility for free school meals)
• Attendance information (such as sessions attended, number of absences and the reasons given for absence)
• Assessment information (such as the pupil’s performance in statutory tests)
• Information about the pupil’s behaviour and any sanctions imposed
• Information about any Special Educational Needs the pupil may have and the measures in place to assist them and information shared with us by other public authorities in relation to this
• Information about any relevant medical conditions
• Information about accidents and ill-health that the pupil has experienced on the school site
• Information about any additional services (e.g. clubs) that the child has accessed.
• Information shared with us by other public authorities regarding child protection

We hold pupil data for as short a time as possible that is consistent with our statutory and legal obligations. We use the Information and Record Management Society’s Toolkit for Schools to inform our decisions on retention period.

We ensure that we have adequate protection in place for pupil data, whether this is stored in electronic format or in hard copy. We ensure our staff have training on their duties in relation to information security. We hold a copy of the pupil’s Educational Record until they reach the age of 25.

We routinely share pupil information with:

• Any education or training establishment that the pupil attends after leaving us
• the London Borough of Camden (as the local authority and as a result of contracts in place for services with them)
• Camden Learning, who are contracted by the London Borough of Camden to provide educational and professional support to schools and to promote high standards of educational provision within Camden
• the Department for Education (DfE)
• the NHS

 
We also have in place contracts with third parties who process pupil data on our behalf. These are

• Century (virtual learning environment)
• Hegarty Maths (virtual learning environment) 
• Google Classroom (virtual learning environment)
• LGFL (IT provider)
• Lucid Software (pupil educational assessment service)
• Caterlink (school meals provider)
• Arbor (management information system provider)
   

In each case, our contract with the provider ensures that the data is only used for the purposes for which it was collected by us and that appropriate security measures are in place.

We do not share information about our pupils with anyone without consent unless the law and our policies allow us to do so. The law allows us to share data with third parties, such as those listed above, where they are carrying out duties for the school and appropriate controls are in place.

We share pupils’ data with the Department for Education (DfE) and the local authority (London Borough of Camden) on a statutory basis. This data sharing underpins school funding and educational attainment policy and monitoring. We are required to share information about our pupils with our local authority (LA) and the Department for Education (DfE) under section 3 of The Education (Information About Individual Pupils) (England) Regulations 2013.

We will also share data with other agencies in line with our duties in relation to safeguarding and child protection with other agencies.

To find out more about the data collection requirements placed on us by the Department for Education (for example; via the school census) go to:

Data collection and censuses for schools (Govt website)

The NPD is owned and managed by the Department for Education and contains information about pupils in schools in England. It provides invaluable evidence on educational performance to inform
independent research, as well as studies commissioned by the Department. It is held in electronic format for statistical purposes. This information is securely collected from a range of sources including schools, local authorities and awarding bodies.

We are required by law, to provide information about our pupils to the DfE as part of statutory data collections such as the school census and early years’ census. Some of this information is then stored in the NPD. The law that allows this is the Education (Information About Individual Pupils) (England) Regulations 2013.

To find out more about the pupil information we share with the department, for the purpose of data collections, go to :

Data collection and censuses for schools

To find out more about the NPD, go to: How DfE shares personal data

The department may share information about our pupils from the NPD with third parties who promote the education or well-being of children in England by:

• conducting research or analysis
• producing statistics
• providing information, advice or guidance

The Department has robust processes in place to ensure the confidentiality of our data is maintained and there are stringent controls in place regarding access and use of the data. Decisions on whether DfE releases data to third parties are subject to a strict approval process and based on a detailed assessment of:

• who is requesting the data
• the purpose for which it is required
• the level and sensitivity of data requested: and
• the arrangements in place to store and handle the data

To be granted access to pupil information, organisations must comply with strict terms and conditions covering the confidentiality and handling of the data, security arrangements and retention and use of the data.

For more information about the department’s data sharing process, please visit: 

How DfE shares personal data

For information about which organisations the department has provided pupil information, (and for
which project), please visit the following website:
DfE external data shares

Contact the Department for Education (DfE)

We also collect information about parents to meet our legal duties set out above. Typically, this data includes:

• Name
• Contact details including e-mail, telephone number and address
• Relationship with the pupil
• Information about financial payments made to the school
• Information held in relation to the school’s statutory responsibilities, including in respect of safeguarding and child protection, equalities, health and safety and special educational needs

• to support pupil learning
• to keep pupils safe
• to monitor and report on pupil progress
• to meet our duties to deliver high standards of educational provision
• to provide appropriate pastoral care
• to provide access to school meals
• to provide access to extracurricular activities
• to assess the quality of our services
• to comply with the law regarding data sharing
• to collect payment for optional services provided by the school

• to meet our duties as a maintained school under the Education Acts 1996, 2002, 2011, the Education and Healthcare Act 2014, the School Standards and Framework Act 1998, the Children’s Act 2004 and related legislation and regulation, the Equalities Act 2010 and other related legislation, and any regulations or statutory guidance made under those acts (Article
  6(1)(e) of the General Data Protection Regulation and Article 6(1)(c) of the General Data
  Protection Regulation);
• where it is necessary to meet our duties as an employer and our duties in relation to health and safety (Article 6(1)(c) of the General Data Protection Regulation);
• where it is necessary for the defence of a legal claim or potential legal claim (Article 9 (2) (f)
  of the General Data Protection Regulation)
• as a result of your explicit consent to the use (Article 6 (1) (a). We do not require consent for the majority of the data we collect as the school is a public authority carrying out its duties under the law. Where we do require your consent for the processing or collection of your child’s data, we will advise you of this in advance and will not use this data without your consent.

Under data protection legislation, parents and pupils have the right to request access to information about them that we hold. To make a request for your personal information, or be given access to your child’s educational record, contact the school office.

• object to processing of personal data that is likely to cause, or is causing, damage or distress
• in certain circumstances, have inaccurate personal data rectified, blocked, erased or destroyed;

Your rights in respect of your data and how you can make use of these are set out in our Data
Protection Policy

If you have a concern about the way we are collecting or using your personal data, you should raise your concern with the Data Protection Officer (details below) in the first instance. However, you can contact the Information Commissioner’s Office directly at: 

ICO Concerns