Privacy Notice for School Workforce

The categories of school information that we process include:

  • personal information (such as name, employee or teacher number, national insurance number)
  • characteristics information (such as gender, age, ethnic group)
  • contract information (such as start date, hours worked, post, roles and salary information)  
  • work absence information (such as number of absences and reasons)
  • qualifications (and, where relevant, subjects taught)
  • relevant medical information (physical or mental)
  • addresses and next of kin

This list is not exhaustive, to access the current list of categories of information we process please refer to the Information Asset Register of each individual school.

Why we collect and use workforce information

We use workforce data to:

  1. enable the development of a comprehensive picture of the workforce and how it is deployed
  2. inform the development of recruitment and retention policies
  3. enable individuals to be paid

Under the General Data Protection Regulation (GDPR), the legal bases we rely on for processing personal information for general purposes are: 

Article 6, which includes:

  1. the data subject has given consent to the processing of his or her personal data for one or more specific purposes
  2. processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract
  3. processing is necessary for compliance with a legal obligation to which the controller is subject
  4. processing is necessary in order to protect the vital interests of the data subject or of another natural person
  5. processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller
  6. processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interest or fundamental rights and freedoms of the data subject which require protection from personal data, in particular where the data subject is a child

Article 9, which includes:

  1. processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation shall be prohibited.
  2. Point i. above shall not apply if one of the following applies:
    • The data subject has given explicit consent to the processing of those personal data for one or more specified purposes, except where Union or Member State law provide that the prohibition referred to in point i. may not be lifted by the data subject
    • Processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law in so far as it is authorised by Union or Member State law or a collective agreement pursuant to Member State law providing for appropriate safeguards for the fundamental rights and the interests of the data subject
    • Processing is necessary to protect the vital interests of the data subject or of another natural person where the data subject is physically or legally incapable of giving consent
    • Processing is carried out in the course of its legitimate activities with appropriate safeguards by a foundation, association or any other not-for-profit body with a political, philosophical, religious or trade union aim and on condition that the processing relates solely to the members or to former members of the body or to persons who have regular contact with it in connection with its purposes and that the personal data are not disclosed outside that body without the consent of the data subjects
    • Processing relates to personal data which are manifestly made public by the data subject
    • Processing necessary for the establishment, exercise or defence of legal claims or whenever courts are acting in their judicial capacity
    • Processing is necessary for reasons of substantial public interest, on the basis of Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interest of the data subject
    • Processing is necessary for the purposes of preventative or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment of the management of health or social care systems and services on the bases of Union or Member State law or pursuant to contract with a health professional and subject to the conditions and safeguards referred to in paragraph iii.
  3. Processing is necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health or ensuring high standards of quality and safety of health care and of medicinal products or medical devices, on the basis of Union or Member State law which provides for suitable and specific measures to safeguard the rights and freedoms of the data subject, in particular professional secrecy
  4. Processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) based on Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject
  5. Personal data referred to in paragraph i. may be processed for the purposes referred to in point  h. of paragraph ii. when those data are processed by or under the responsibility of a professional subject to the obligation of professional secrecy under Union or Member State law or rules established by national competent bodies or by another person also subject to an obligation of secrecy under Union or Member State law or rules established by national competent bodies.
  6. Member States may maintain or introduce further conditions, including limitations, with regard to the processing of generic data, biometric data or data concerning health.

Collecting workforce information

We collect personal information via staff contract forms

Workforce data is essential for the school’s operational use. Whilst the majority of personal information you provide to us is mandatory, some of it is requested on a voluntary basis. In order to comply with GDPR, we will inform you at the point of collection, whether you are required to provide certain information to us or if you have a choice in this. 

Storing workforce information

We hold data securely for the set amount of time shown in our data retention policy. For more information on our data retention schedule and how we keep your data safe, please visit http://www.bicesterlearningacademy.co.uk/index.php/policies/

Who we share workforce information with

We routinely share this information with:

  • our local authority (where applicable)
  • the Department for Education (DfE) 

Why we share school workforce information

We do not share information about our workforce members with anyone without consent unless the law and our policies allow us to do so.

Local authority

We are required to share information about our workforce members with our local authority (LA) under section 5 of the Education (Supply of Information about the School Workforce) (England) Regulations 2007 and amendments.  

Department for Education

The Department for Education (DfE) collects personal data from educational settings and local authorities via various statutory data collections. We are required to share information about our children and young people with the Department for Education (DfE) for the purpose of those data collections, under:

We are required to share information about our school employees with the (DfE) under section 5 of the Education (Supply of Information about the School Workforce) (England) Regulations 2007 and amendments. 

All data is transferred securely and held by DfE under a combination of software and hardware controls which meet the current government security policy framework. 

For more information, please see ‘How Government uses your data’ section.

Requesting access to your personal data

Under data protection legislation, you have the right to request access to information about you that we hold. To make a request for your personal information, contact the Director of Business & Finance.

You also have the right to:

  • object to processing of personal data that is likely to cause, or is causing, damage or distress
  • prevent processing for the purpose of direct marketing
  • object to decisions being taken by automated means
  • in certain circumstances, have inaccurate personal data rectified, blocked, erased or destroyed; and
  • a right to seek redress, either through the ICO, or through the courts

If you have a concern about the way we are collecting or using your personal data, we ask that you raise your concern with us in the first instance. Alternatively, you can contact the Information Commissioner’s Office at https://ico.org.uk/concerns/

Contact

If you would like to discuss anything in this privacy notice, please contact:

Director of Business & Finance Tel: 01869 242121 ext 2123.

How Government uses your data

The workforce data that we lawfully share with the DfE through data collections:

  • informs departmental policy on pay and the monitoring of the effectiveness and diversity of the school workforce
  • links to school funding and expenditure
  • supports ‘longer term’ research and monitoring of educational policy

Data collection requirements

To find out more about the data collection requirements placed on us by the Department for Education including the data that we share with them, go to https://www.gov.uk/education/data-collection-and-censuses-for-schools.

Sharing by the Department

The Department may share information about school employees with third parties who promote the education or well-being of children or the effective deployment of school staff in England by:

  • conducting research or analysis
  • producing statistics
  • providing information, advice or guidance

The Department has robust processes in place to ensure that the confidentiality of personal data is maintained and there are stringent controls in place regarding access to it and its use. Decisions on whether DfE releases personal data to third parties are subject to a strict approval process and based on a detailed assessment of:

  • who is requesting the data
  • the purpose for which it is required
  • the level and sensitivity of data requested; and 
  • the arrangements in place to securely store and handle the data 

To be granted access to school workforce information, organisations must comply with its strict terms and conditions covering the confidentiality and handling of the data, security arrangements and retention and use of the data.

To contact the department: https://www.gov.uk/contact-dfe

Policy/Procedure Title  Privacy Notice for School Workforce
Issue Date to Committee Autumn Term 2018
Author (Name/Department) J Davison-  Director of Business & Finance (BLA)
Approved by Trustees   Autumn Term 2018
Review Date – Every three years Autumn Term 2021