UK GDPR – General Data Protection Regulation
Please see the full policy in pdf format here: GDPR & Privacy Notice All Privacy Notices are linked at the bottom of this page.
The Data Protection Act 2018 came into force on 25th May 2018 in the UK. The Act implements the General Data Protection Regulation (now UK General Data Protection Act) in national law.
The UK GDPR has 2 key objectives:
To facilitate a free movement of data by creating a consistent data protection regime across the Union.
To provide a framework that more accurately reflects how we use data today and therefore better protect the rights and freedoms of individuals.
Data protection and the GDPR
As the UK transitional arrangements expired on 31 December 2020, there are some practical changes for Data Protection and GDPR.
To comply with the Data Protection, Privacy and Electronic Communications (Amendments, etc.) (EU Exit) Regulations 2019, please note that every policy, notice and procedural guide that refers to ‘GDPR’ shall now be read as ‘UK GDPR’.
The rights, responsibilities and data protection that the Data Protection Act 2018 and the GDPR are not changed. Our procedures and arrangements will not change.
If you would like to discuss anything about Data Protection, or if you have a concern about the way we are collecting or using your personal data, we request that you raise your concern with us in the first instance please email office@robertowen.powys.sch.uk or write to:
Ysgol Robert Owen,
Plantation Lane.
Newton,
Powys,
SY16 1LH
Telephone: 01686627454
For more information about how we handle personal information and your rights, please refer to the further information below and our Privacy Notices listed here.
Any individual, or person with parental responsibility, or young person with sufficient capacity to make a request is entitled to ask what information is held. This is known as a Subject Access Request (SAR). Please see click on the links below to see the form to submit a SAR to the school.
Data subject rights
At its core, the UK GDPR is about ensuring the privacy of the individual. The UK GDPR provides data subjects with 8 rights that they may exercise when their personal data is being processed; these rights support the individual’s overarching right to privacy in their private life. These rights include:
Right to be informed: Data subjects should expect to know the identify and contact details of the controller and their representative; why and how your data is being processed; if your data will be shared or passed on; how long your data will be stored; and what your rights are. This information is reflected in the School’s Privacy Notices.
Right to access: Data subjects have the right to obtain a copy of your personal data as well as to understand how and why your data is being used. This is commonly known as a Subject Access Request.
Right to object to automated decision making, including profiling: Where rights apply, data subjects can obtain human intervention; express your point of view; and obtain an explanation of the decision and challenge it. The right does not apply if the processing is required to fulfil a contract; has been authorised by member state law; or is based on explicit consent.
Right to object: Data subjects can object to us using your information in certain circumstances (please refer to the UK GDPR for the circumstances). This does not apply when we have lawful bases for processing your data, such as legal obligation or to protect the vital interests of a person.
Right to data portability: This right is not absolute. It allows data subjects to obtain/reuse your personal data for your own purposes across different services where data is processed by automated means; the right only applies to information you have provided to a controller. The processing has to be based on consent or where it is necessary to fulfil a contract.
Right to restriction: Data subjects can request that the processing of their data be restricted if one of the conditions set out in Article 18 applies (please refer to the UK GDPR for the conditions).
Right to erasure: Data subjects can request deletion of the data held about you, but only in certain circumstances, including if the data is no longer necessary for the purposes for which it was collected; if you withdraw consent on which the processing is based and where there is no other legal ground for the processing or you object to the processing and there are no overriding legitimate grounds for the processing; or if the data has been unlawfully processed, is to be erased for compliance with a legal obligation or has been collected in relation to the offer of information society services.
Right to rectification: Data subjects have the right to request that your information is updated to be made accurate, in the event where the information held by us may no longer be accurate (such as your address). You also have the right to rectification when the information we hold about you is incomplete, such as where the digit of a phone number is missing.
To exercise these rights, where they apply, please contact us through email office@robertowen.powys.sch.uk.
Lawful basis for processing
The lawful bases Ysgol Robert Owen rely on when handling personal data include, but are not limited to:
- legal obligations;
- vital interests;
- public interests;
- contract;
- consent.
Right to withdraw consent
If the school has used consent as the lawful basis for processing your data, you have the right to withdraw this consent at any time. To exercise this right, please contact the GDPR Lead via email office@robertowen.powys.sch.uk
Use of the website
The Ysgol Robert Owen website provide you with a range of information about the school and the way in which we work. You do not have to provide us with any personal information to access the website.
The vast majority of personal information we hold about you via the website will be obtained if you contact us by email, phone or post using the contact details given on our website. We will ensure that all personal data you supply to us is held in accordance with data protection law.
Related Policies can be found on our website or obtained from the school directly.
Common to all privacy notices
The legal grounds for using your information:
This is common for all personal and sensitive data we collect and process about staff, volunteers,
pupils, parents, carers and any other individuals.
Some data is more sensitive than other types of data. These special categories are as follows:
- Personal information revealing racial or ethnic origin,
- Political opinions, religious or philosophical beliefs,
- Trade union membership,
- Genetic information,
- Biometric information,
- Health information, and information about sex life or orientation.
Telephone calls may be recorded for training and monitoring purposes.
CCTV is installed and is subject to appropriate controls, more details can be found in the CCTV policy on the website.
Consent
The school will ask for consent to process data about you or a pupil. The type of data that is to be
used, and how it is to be used will be specified on the consent forms.
You have the choice to opt in for certain types of data usage, and this is made clear. However, some data that is collected and processed in schools is not optional.
Legitimate interests
This means that the processing is necessary for legitimate interests except where the processing is unfair to you. The school relies on legitimate interests for many of the ways in which it uses
information. Specifically, the school has a legitimate interest in:
- Providing educational services to pupils
- Safeguarding and promoting the welfare of pupils and staff
- Promoting the objects and interests of the school
- Ensuring the efficient operation of the school
- Compliance with all relevant legal obligations of the school
- Keeping the whole school community informed about events, news and activities
Necessary for a contract
Information about individuals may be necessary to perform our obligations under our contracts.
For example, maintaining the School Management Information System database.
Legal obligations
Much of our work in school life is governed by legal obligations to supply information to organisations such as the local authority, Welsh government or HMRC for example. We may also have to disclose information to third parties such as the courts, Disclosure and Barring Service or the police where legally obliged to do so.
Vital interests
For example, to prevent someone from being seriously harmed or killed.
Public interest
The school considers that it is acting in the public interest when providing education. Certain
regulations, Welsh Government and Local Authority, health and other guidance may require the school to process data in the public interest.
Legal claims
The processing is necessary for the establishment, exercise or defence of legal claims. This allows us to share information with our legal advisors and insurers.
Your rights
What decisions can you make about your information?
Data protection legislation gives you a number of rights regarding your information. Some of these are new rights whilst others build on your existing rights.
Your rights are as follows:
- you can ask what information we hold about you and be provided with a copy. Sometimes
we are not able to share all the information, but this is set out in our Subject Access Policy
- if information is incorrect, you can ask us to correct it
- you can ask us to delete the information that we hold about you or your child in certain
circumstances. For example, where we no longer need the information
- you can ask us to send you, or another organisation, certain types of information about you
in a format that can be read by computer – this does not apply to pupil records as these are
transferred by a Welsh Government/LA process called the Common Transfer File
- our use of information about you may be restricted in some cases. For example, if you tell us
that the information is inaccurate we can only use it for limited purposes while we check its
accuracy. If you disagree with any decision we make about your data you can use our complaints policy, you also have the right to make a complaint to the Information Commissioner, and sometimes to the Information Tribunal or through the court process. Our Complaints Policy is available on the website.
Please see the following privacy notices:
Privacy Notice – School Workforce
Privacy Notice – Job Applicants
Privacy Notice – Governing Body and Representatives
Privacy Notice – Alternative Provision
For our Subject Access Request Process and Protocol, please see here: (please note these documents will open as separate pdf’s for download)
Subject Access Process and Protocol