Newsflash - Christmas 2020

Christmas 2020

• Can we obtain admissions documentation from students based outside of the UK?
  Yes – because the GDPR does not prevent transfers from the data subject themselves (i.e. the individual whose data it is). If you receive it from a third party or organisation who isn’t the data subject, then you will need to ensure there is a safeguard as set out above (for example with the data subject’s explicit consent).
• Are cloud-based storage providers based outside of the UK?
  Providers can be based in the UK, the EEA or even further afield. It is worth checking with your providers to see where they are based. If cloud-based storage is based outside of the UK then those providers will need to ensure an appropriate safeguard is in place to transfer data safely post-Brexit.
• What happens if we don’t have a safeguard in place by December 31st?
  It’s hard to say currently because, as with a lot of Brexit developments, the outcomes are all very much unknown. The regulator, the ICO, have said that organisations must have safeguards in place by December 31st and if you don’t, you should not continue to receive data from outside of the UK. Where it is not possible to put in place a safeguard, do continue to chase those providers in order to show you are doing all you can to follow the guidelines.
• Do any other documents need to be updated?
  We will be updating our privacy notices over the Christmas break. The notices should stipulate those providers you use who are based outside of the UK (rather than just outside the EEA as previously required).

Tips for handling Data over Christmas and New Year

Finally we thought we would provide some general guidance on how to ensure all your data is handled securely over the Christmas break by sharing our 8 top tips.

1. Track data that is taken home over Christmas: most staff will want to make the most of the break - and they should, they have earnt it. However anyone who does need to do anything over Christmas should ensure they transport data home safely. Try to avoid using memory sticks but if they must be used, they should be authorised and, ideally, encrypted. For physical documents, consider getting staff to sign them out and in over the Christmas break.
2. If using video conferencing, keep it interesting (for example Christmas quizzes) but be mindful about what is being shared and who it is shared with: staff should ensure there is nothing inappropriate in the background to their call (and also to check the same for attendees).
3. Remind staff to blind copy (Bcc) recipients into group communications: They may have the best intention by sending everyone a Christmas Quiz but if feuding parents or siblings can then view each other’s email addresses this could result in complaints and/or concerns.
4. Consent isn’t a requirement to record nativity plays but at least give parents an opt-out: Ideally you will get parents’ consent as this is the safest method. If this is not possible you could rely on public task as the basis for processing (as nativity plays do normally form part of the school’s function and parents would expect schools to offer them). Should you do this you must ensure that: (a) you give parents an opt out, (b) you are clear with them about what the implications of opting out are and (c) give plenty of notice, possibly sending reminders to ensure parents are aware of your intentions. It is also important they know what you are using recordings/photos for – the wider the potential audience (such as on social media), the more likely it is you should gain consent.
5. It is ok to put names in Christmas Cards and to give Christmas Card lists: but maybe use only first name or first name and initial. Try and avoid putting the schools name on the list and to remind parents not to share the lists with others.
6. For Freedom of Information Requests, the clock pauses during school closure periods: as the timeframe for response is school days and not calendar days.
7. But for subject access requests, the clock doesn’t pause: the timeframe is one calendar month. So be forward thinking - if you will struggle to comply within the normal one calendar month timeframe (particularly if you have or are likely to have staffing shortages) you should communicate any delays as soon as possible. We can assist you in drafting this communication.
8. When returning in the new year, consider asking parents/staff to update their contact details: as individuals get new phones (and new phone numbers) during this time. This will help you ensure you keep their data up to date.