Data Protection Policy
Author: HR Manager / DPO
Date last reviewed: April 2023
Approval route: CMT – April 2023. Employment & Welfare Committee – 9 May 2023. Corporation – 23 May 2023
Date approved: 23 May 2023
Next review date: April 2026
Location of copies:
SharePoint / All Staff / College Policies
College Website / Policies & Procedures
Aim:
The College has implemented this Data Protection Policy to ensure all College Personnel are aware of what they must do to ensure the correct and lawful treatment of Personal Data. This will maintain confidence in the College and will provide for a successful working and learning environment for all.
1. Introduction
The College’s reputation and continued success are dependent on the way the College manages and protects Personal Data. Protecting the confidentiality and integrity of Personal Data is a key responsibility of everyone within the College.
As an organisation that collects, uses and stores Personal Data about its employees, suppliers (sole traders, partnerships or individuals within companies), students, governors, parents and visitors, emergency contract details of employees/students, the College recognises that having controls around the collection, use, retention and destruction of Personal Data is important in order to comply with the College’s obligations under Data Protection Laws and in particular its obligations under Article 5 of GDPR.
The College has implemented this Data Protection Policy to ensure all College Personnel are aware of what they must do to ensure the correct and lawful treatment of Personal Data. This will maintain confidence in the College and will provide for a successful working and learning environment for all.
College Personnel will receive a copy of this Policy when they start and may receive periodic revisions of this Policy. This Policy does not form part of any member of the College Personnel’s contract of employment and the College reserves the right to change this Policy at any time. All members of College Personnel are obliged to comply with this Policy at all times.
If you have any queries concerning this Policy, please contact our Data Protection Officer, who is responsible for ensuring the College’s compliance with this Policy.
2. About this Policy
This Policy (and the other policies and documents referred to in it) sets out the basis on which the College will collect and use Personal Data either where the College collects it from individuals itself, or where it is provided to the College by third parties. It also sets out rules on how the College handles uses, transfers and stores Personal Data.
It applies to all Personal Data stored electronically, in paper form, or otherwise.
3. Definitions
3.1 College - Scarborough Sixth Form College, Sandybed Lane, Scarborough, YO12 5LF
3.2 College Personnel – Any College employee, worker or contractor who accesses any of the College’s Personal Data and will include employees, consultants, contractors, and temporary personnel hired to work on behalf of the College
3.3 Controller – Any entity (e.g., company, organisation or person) that makes its own decisions about how it is going to collect and use Personal Data. A controller is responsible for compliance with Data Protection Laws. Examples of personal Data the College is the Controller of include employee details or information the College collects relating to students. The College will be viewed as a Controller of Personal Data is it decides what Personal Data the College is going to collect and how it will use it. A common misconception is that individuals within organisations are the Controllers. This is not the case it is the organisation itself which is the Controller.
3.4 Data Protection Laws – The General Data Protection Regulation (Regulation (EU) 2016/679) and all applicable laws relating to the collection and use of Personal Data and privacy and any applicable codes of practice issued by a regulator including in the UK, the Data Protection Act 2018.
3.5 Data Protection Officer – Our Data Protection Officer can be contacted at: dpo@s6f.org.uk or by calling 01723 380789.
3.6. EEA – Austria, Belgium, Bulgaria, Croatia, Republic of Cyprus, Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Iceland, Ireland, Italy, Latvia, Liechtenstein, Lithuania, Luxembourg, Malta, Netherlands, Norway, Poland, Portugal, Romania, Slovakia, Slovenia, Spain, Sweden and the UK.
3.7. ICO – the Information Commissioner’s Office, the UK’s data protection regulator.
3.8. Individuals – Living individuals who can be identified, directly or indirectly, from information that the College has. For example, an individual could be identified directly by name, or indirectly by gender, job role and office location if you can use this information to work out who they are. Individuals include employees, students, parents, visitors and potential students. Individuals also include partnerships and sole traders.
3.9. Personal Data – Any information about an Individual (see definition above) which identifies them or allows them to be identified in conjunction with other information that is held. It includes information of this type, even if used in a business context.
Personal data is defined broadly and covers things such as name, address, email address (including in a business context, email addresses of Individuals in companies such as firstname.surname@organisation.com), IP address and also more sensitive types of data such as trade union membership, genetic data and religious beliefs. These more sensitive types of data are called “Special Categories of Personal Data” and are defined below. Special Categories of Personal Data are given extra protection by Data Protection Laws.
3.10. Processor – Any entity (e.g., company, organisation or person) which accesses or uses Personal Data on the instruction of a Controller.
A Processor is a third party that processes Personal Data on behalf of a Controller. This is usually as a result of the outsourcing of a service by the Controller or the provision of services by the Processor which involve access to or use of Personal Data. Examples include: where software support for a system, which contains Personal Data, is provided by someone outside the business; cloud arrangements; and mail fulfilment services.
3.11. Special Categories of Personal Data – Personal Data that reveals a person’s racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data (i.e., information about their inherited or acquired genetic characteristics), biometric data (i.e., information about their physical, physiological or behavioural characteristics such as facial images and fingerprints), physical or mental health, sexual life or sexual orientation. Special Categories of Personal Data are subject to additional controls in comparison to ordinary Personal Data.
3.12. Personal Data Relating To Criminal Convictions And Offences – personal data relating to criminal convictions and offences are dealt with separately to special categories of personal data, there are additional safeguards that must be in place in order to process this type of data.
4. College Personnel’s General Obligations
4.1 All College Personnel must comply with this policy.
4.2. College Personnel must ensure that they keep confidential all Personal Data that they collect, store, use and come into contact with during the performance of their duties.
4.3. College Personnel must not release or disclose any Personal Data:
4.3.1. outside the College; or
4.3.2. inside the College to College Personnel not authorised to access the Personal Data, without specific authorisation from their manager or the Data Protection Officer; this includes by phone calls or in emails.
4.4. College Personnel must take all steps to ensure there is no unauthorised access to Personal Data whether by other College Personnel who are not authorised to see such Personal Data or by people outside the College.
5. Data Protection Principles – Article 5 of the GDPR
5.1. When using Personal Data, Data Protection Laws require that the College complies with the following principles. These principles require Personal Data to be:
5.1.1. processed lawfully, fairly and in a transparent manner in relation to individuals;
5.1.2. collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes;
5.1.3. adequate, relevant and limited to what is necessary for the purposes for which it is being processed;
5.1.4. accurate and where necessary kept up to date, meaning that every reasonable step must be taken to ensure that Personal Data that is inaccurate is erased or rectified as soon as possible;
5.1.5. kept for no longer than is necessary for the purposes for which it is being processed; and
5.1.6. processed in a manner that ensures appropriate security of the Personal Data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures.
5.2. These principles are considered in more detail in the remainder of this Policy.
5.3. In addition to complying with the above requirements the College also has to demonstrate in writing that it complies with them. The College has a number of policies and procedures in place, including this Policy and the documentation referred to in it, to ensure that the College can demonstrate its compliance.
6. Lawful use of Personal Data
6.1 In order to collect and/or use Personal Data lawfully the College needs to be able to show that its use meets one of a number of legal grounds. Please click here to see the detailed grounds [https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulationgdpr/lawful-basis-for-processing]
6.2. In addition, when the College collects and/or uses Special Categories of Personal Data, the College has to show that one of a number of additional conditions is met. Please click here to see the detailed additional conditions [https://ico.org.uk/for-organisations/guide-to-thegeneral-data-protection-regulation-gdpr/special-category-data].
6.3. The College has carefully assessed how it uses Personal Data and how it complies with the obligations set out in paragraphs 6.1 and 6.2, details of the lawful bases on which the college processes personal data can be found in the relevant privacy notices. If the College changes how it uses Personal Data, the College needs to update this record and may also need to notify Individuals about the change.
6.4. If College Personnel therefore intend to change how they use Personal Data at any point they must notify the Data Protection Officer who will decide whether their intended use requires amendments to be made and any other controls which need to apply.
7. Transparent Processing – Privacy Notices
7.1. Where the College collects Personal Data directly from Individuals, the College will inform them about how the College uses their Personal Data. This is in a privacy notice. The College has adopted the following privacy notices: [Staff Applicants/Employees, Student Applicants/Enrolled Students, Parents/Carers/Other]. All privacy notices are published on the College website.
7.2. If the College receives Personal Data about an Individual from other sources, the College will provide the Individual with a privacy notice about how the College will use their Personal Data. This will be provided as soon as reasonably possible and in any event within one month.
7.3. If the College changes how it uses Personal Data, the College may need to notify Individuals about the change. If College Personnel therefore intend to change how they use Personal Data please notify the Data Protection Officer who will decide whether the College Personnel’s intended use requires amendments to be made to the privacy notices and any other controls which need to apply.
8. Data Quality – Ensuring the use of accurate, up to date and relevant personal data
8.1 Data Protection Laws require that the College only collects and processes Personal Data to the extent that it is required for the specific purpose(s) notified to the Individual in a privacy notice (see paragraph 7 above) and as set out in the College’s record of how it uses Personal Data. The College is also required to ensure that the Personal Data the College holds is accurate and kept up to date.
8.2 All College Personnel that collect and record Personal Data shall ensure that the Personal Data is recorded accurately, is kept up to date and shall also ensure that they limit the collection and recording of Personal Data to that which is adequate, relevant and limited to what is necessary in relation to the purpose for which it is collected and used.
8.3. All College Personnel that obtain Personal Data from sources outside the College shall take reasonable steps to ensure that the Personal Data is recorded accurately, is up to date and limited to that which is adequate, relevant and limited to what is necessary in relation to the purpose for which it is collected and used. This does not require College Personnel to independently check the Personal Data obtained.
8.4. In order to maintain the quality of Personal Data, all College Personnel that access Personal Data shall ensure that they review, maintain and update it to ensure that it remains accurate, up to date, adequate, relevant and limited to what is necessary in relation to the purpose for which it is collected and used. Please note that this does not apply to Personal Data which the College must keep in its original form (e.g., for legal reasons or that which is relevant to an investigation).
8.5. The College recognises the importance of ensuring that Personal Data is amended, rectified, erased or its use restricted where this is appropriate under Data Protection Laws. Any request from an individual for the amendment, rectification, erasure or restriction of the use of their Personal Data should be directed to the college’s Data Protection Officer in the first instance.
9. Personal Data must not be kept for longer than needed
9.1. Data Protection Laws require that the College does not keep Personal Data longer than is necessary for the purpose or purposes for which the College collected it.
9.2. The College has assessed the types of Personal Data that it holds and the purposes it uses it for and has set retention periods for the different types of Personal Data processed by the College, the reasons for those retention periods and how the College securely deletes Personal Data at the end of those periods. These retention periods are set out in the college’s Data Retention Policy, for more information please refer to the Data Retention Policy or contact the college’s DPO.
9.3. If College Personnel feel that a particular item of Personal Data needs to be kept for more or less time than the retention period set out in the Data Retention Policy, for example because there is a requirement of law, or if College Personnel have any questions about this Policy or the College’s Personal Data retention practices, they should contact the Data Protection Officer for guidance.
10. Data Security
The College takes information security very seriously and the College has security measures against unlawful or unauthorised processing of Personal Data and against the accidental loss of, or damage to, Personal Data. The College has in place procedures and technologies to maintain the security of all Personal Data from the point of collection to the point of destruction.
11. Data Breach
11.1 Whilst the College takes information security very seriously, unfortunately, in today’s environment, it is possible that a security breach could happen which may result in the unauthorised loss of, access to, deletion of or alteration of Personal Data. If this happens there will be a Personal Data breach and College Personnel must discuss this with the DPO or a member of CMT immediately. Please see paragraphs 11.2 and 11.3 for examples of what can be a Personal Data breach. Please familiarise yourself with the College Data Breach Policy & Procedure as it contains important obligations which College Personnel need to comply with in the event of Personal Data Breaches.
11.2. Personal Data Breach is defined very broadly and is effectively any failure to keep Personal Data secure, which leads to the accidental or unlawful loss (including loss of access to), destruction, alteration or unauthorised disclosure of Personal Data. Whilst most Personal Data breaches happen as a result of action taken by a third party, they can also occur as a result of something someone internal does.
11.3. There are three main types of Personal Data breach which are as follows:
11.3.1.Confidentiality breach - where there is an unauthorised or accidental disclosure of, or access to, Personal Data e.g. hacking, accessing internal systems that College Personnel are not authorised to access, accessing Personal Data stored on a lost laptop, phone or other device, people “blagging” access to Personal Data they have no right to access, putting the wrong letter in the wrong envelope, sending an email to the wrong student, or disclosing information over the phone to the wrong person;
11.3.2. Availability breach - where there is an accidental or unauthorised loss of access to, or destruction of, Personal Data e.g., loss of a memory stick, laptop or device, denial of service attack, infection of systems by ransom ware, deleting Personal Data in error, loss of access to Personal Data stored on systems, inability to restore access to Personal Data from back up, or loss of an encryption key; and
11.3.3. Integrity breach - where there is an unauthorised or accidental alteration of Personal Data.
12. Third Parties who have access to the College’s Personal Data
12.1 In the course of its business the college is routinely required to share personal data with third parties. Often these third parties are data controllers in their own right and the sharing of data with them arises out of a legal obligation that the college is subject to. There are also circumstances where the college enters into a contract with a third party who processes data on the College’s behalf.
12.2. Where the sharing of data is with another data controller, they will communicate with you directly about how they will process your data. Where the third party is a processor acting on behalf of the college they will be acting in accordance with a contract in place with the college and the college’s relevant privacy notice will apply to this processing.
12.3. Where the College appoints a contractor who is a Processor of the College’s Personal Data, the College will carry out due diligence to ensure the processor is compliant with the requirements of the GDPR and protects the rights of individuals. Where appropriate the college will ensure that a written contract is put in place. Where appropriate the college will also audit processors that it holds contracts with.
13. Individuals’ Right
13.1. GDPR gives individuals more control about how their data is collected and stored and what is done with it. Some existing rights of individuals have been expanded upon and some new rights have been introduced.
13.2. The different types of rights of individuals are reflected in this paragraph.
13.3. Subject Access Requests
13.3.1. Individuals have the right under the GDPR to ask the College to confirm what Personal Data they hold in relation to them and provide them with the data. Please refer to the College Subject Access Request Policy or contact the College DPO.
13.4. Right of Erasure (Right to be Forgotten)
13.4.1. This is a limited right for individuals to request the erasure of Personal Data concerning them where:
13.4.1.1. the use of the Personal Data is no longer necessary;
13.4.1.2. their consent is withdrawn and there is no other legal ground for the processing;
13.4.1.3. the individual objects to the processing and there are no overriding legitimate grounds for the processing;
13.4.1.4. the Personal Data has been unlawfully processed; and
13.4.1.5. the Personal Data has to be erased for compliance with a legal obligation.
13.4.2. In a marketing context, where Personal Data is collected and processed for direct marketing purposes, the individual has a right to object to processing at any time. Where the individual objects, the Personal Data must not be processed for such purposes.
13.5. Right of Data Portability
13.5.1. An individual has the right to request that data concerning them is provided to them in a structured, commonly used and machine readable format where: 1
13.5.1.1. the processing is based on consent or on a contract; and
13.5.1.2. the processing is carried out by automated means
13.5.2. This right is not the same as subject access and is intended to give individuals a subset of their data.
13.6. The Right of Rectification and Restriction
13.6.1. Finally, individuals are also given the right to request that any Personal Data is rectified if inaccurate and to have use of their Personal Data restricted to particular purposes in certain circumstances.
13.7. The Right to Object
13.7.1.Individuals have the right to object to the College’s processing of their Personal Data where the College’s processing is based on its legitimate interests or the performance of a task in the public interest and the individual has grounds relating to his or her particular situation on which to object unless the College has compelling legitimate grounds for the processing which override the interests of the individual, or where the processing is for the establishment, exercise or defence of legal claims.
13.7.2. Individuals have the right to object to the College’s processing of their Personal Data where the College is carrying out direct marketing to the individual; and/or the College’s processing is for the purpose of scientific/historical research and statistics and the individual has grounds relating to his or her particular situation on which to object.
13.8. Rights relating to Automated Decision Making
13.8.1. Individuals have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her unless the decision is necessary for entering into or performing a contract between the College and the individual; is required or authorised by Data Protection Laws; or based on the individual’s explicit consent.
13.9. The College will use all Personal Data in accordance with the rights given to Individuals’ under Data Protection Laws and will ensure that it allows Individuals to exercise their rights in accordance with these Laws. If you wish to discuss or exercise any of these rights please contact the college’s Data Protection officer in the first instance.
14. Marketing and Consent
14.1 The College will sometimes contact Individuals to send them marketing or to promote the College. Where the College carries out any marketing, Data Protection Laws require that this is only done in a legally compliant manner.
14.2. Marketing consists of any advertising or marketing communication that is directed to particular individuals. In all cases the college relies on either affirmative consent or where applicable a soft opt in when carrying out direct marketing
14.3. The college has also taken into account the Privacy and Electronic Communications Regulations (PECR) that sit alongside data protection. PECR apply to direct marketing i.e., a communication directed to particular individuals and covers any advertising/marketing material. It applies to electronic communication i.e. calls, emails, texts, faxes. PECR rules apply even if you are not processing any personal data.
14.4. Consent is central to electronic marketing. To this end the college provides an un-ticked opt-in box whenever it collects personal data for the purposes of marketing.
14.5. Alternatively, the College may rely on a “soft opt in” if the following conditions are met:
14.5.1. contact details have been obtained in the course of a sale (or negotiations for a sale);
14.5.2. the College is marketing its own similar services; and
14.5.3. the College provides individuals a simple opportunity to refuse to opt out of the marketing, both when first collecting the details and in every message after that.
15. Automated decision making and profiling
15.1 Under Data Protection Laws there are controls around profiling and automated decision making in relation to Individuals.
Automated Decision Making happens where the College makes a decision about an Individual solely by automated means without any human involvement and the decision has legal or other significant effects; and
Profiling happens where the College automatically uses Personal Data to evaluate certain things about an Individual.
15.2. Any Automated Decision Making or Profiling which the College carries out can only be done once the College is confident that it is complying with Data Protection Laws. If College Personnel therefore wish to carry out any Automated Decision Making or Profiling College Personnel must inform the Data Protection Officer.
15.3. College Personnel must not carry out Automated Decision Making or Profiling without the approval of the Data Protection Officer.
15.4. The College does not carry out Automated Decision Making or Profiling in relation to its employees.
16. Data Protection Impact Assessments (DPIA)
16.1. The GDPR introduced a new requirement to carry out a risk assessment in relation to the use of Personal Data for a new service, product or process. This must be done prior to the processing via a Data Protection Impact Assessment (“DPIA”). A DPIA should be started as early as practical in the design of processing operations. The process is designed to:
16.1.1. describe the collection and use of Personal Data;
16.1.2. assess its necessity and its proportionality in relation to the purposes;
16.1.3. assess the risks to the rights and freedoms of individuals; and,
16.1.4. the measures to address the risks.
16.2. The GDPR stipulates that a DPIA must be completed where the use of Personal Data is likely to result in a high risk to the rights and freedoms of individuals.
16.3. Where a DPIA completed by the College reveals risks which are not appropriately mitigated the ICO will be consulted.
16.4. Where the College launches or proposes to adopt a new process, product or service which involves Personal Data, the College will consider whether it needs to carry out a DPIA as part of the project initiation process. Where necessary the College will carry out a DPIA at an early stage in the process so that it can identify and fix problems with its proposed new process, product or service at an early stage.
16.5. Situations where the College has carried out a Data Protection Impact Assessments include the following (please note that this list is not exhaustive):
16.5.1. Personal Data relating to criminal convictions and offences
16.5.2. Systematic monitoring of public areas on a large scale e.g., CCTV cameras.
16.6. All DPIAs are reviewed and approved by the Data Protection Officer.
17. Transferring Personal Data to a Country outside the EEA
17.1. Data Protection Laws impose strict controls on Personal Data being transferred outside the EEA. Transfer includes sending Personal Data outside the EEA but also includes storage of Personal Data or access to it outside the EEA. It needs to be thought about whenever the College appoints a supplier outside the EEA or the College appoints a supplier with group companies outside the EEA which may give access to the Personal Data to staff outside the EEA.
17.2. So that the College can ensure it is compliant with Data Protection Laws College Personnel must not export Personal Data unless it has been approved by the Data Protection Officer.
17.3. College Personnel must not export any Personal Data outside the EEA without the approval of the Data Protection Officer.