Schools are the primary source of pupil data and as such collect and process this information in accordance with the Data Protection Act (1998).
Access to pupil records is therefore, restricted to only those professionals who have been contracted to provide services for schools or who have been named specifically in the fair processing statement, that data subjects are required to sign at the time the data is collected.
How can I access details of my child's educational record?
The Data Protection Act states that parents have an independent right of access only to official educational records of their children.
Schools and the Local Education Authority adhere to a common subject access request procedure. The procedure requires the data subject (ie the pupil or if they are under the age of 12 their representative) to complete a subject access request form obtainable from the school or East Riding of Yorkshire Council. A fee will be charged to cover the cost of administering the request and this fee will be individually set by the Governors of the school.
How can I be assured that the data held about my child is secure?
Anyone who uses personal data must conform to the requirements of the Data Protection Act (1998). In particular this requires the school to formally notify the Office of the Information Commissioner of:
- the purposes for which the school holds personal data
- what data it holds
- the source of the data
- to whom the data is disclosed
- to which countries the data may be transferred.
The data controller (ie the school) must satisfy one of the conditions of Schedule 2 of the Act. In most cases this will be to obtain the explicit consent of the data subject or their representative to the processing of their information, and with whom their information will be shared. This consent should be obtained in writing at the time of the initial data collection.
Who has access to pupil records?
All personal data must be kept safe and made available only to those who are authorised to access it.
The schools are the designated data controllers of pupil data and as such must comply with the Data Protection Act (DPA). The legal requirements are annual registration by schools and LEAs regarding the data they collect and keep and how they use it.
Information is passed to third parties who are contracted to provide services for schools. The DPA requires those who own the data and pass it to others to ensure that measures are in place for its safety and integrity and that it is not used for any purpose other than that for which it was collected, as well as how it will be destroyed when it is no longer required.
In order for the educational network to function properly, information is passed electronically from schools to LEA`s and examination boards. LEA`s pass information to a number of statutory bodies (such as QCA and Connexions). Additionally the Children and Young People's Unit (CYPU) requires local authorities, where necessary, to share information with other local government partners to identify children and young people in danger of social exclusion and those at risk.
