How we use personal information relating to staff

This Privacy Notice is to let you know how we as an educational setting look after personal information about individuals we employ or engage with at our school.  This notice explains the reasons why we hold personal information about our staff, how we use this information, who we share it with and how we keep it secure. This notice meets with the requirements of the General Data Protection Regulations (GDPR).

If you have any questions or queries or would like to discuss anything in this Privacy Notice, please contact:  Trina Evans, School Manager – Willow Nursery School, 01582 662 600.

How we collect information about our staff

We obtain information from new members of staff starting at each academic year through our ‘new staff’ information form. We also collect any changes to staff information through update forms during the academic year as part of our data administration process to keep the information we hold as up-to-date as possible.  The majority of our staff information is processed in our main Management Information System (MIS).

We collect and hold staff information that includes:

• Full name and address
• Date of birth and marital status
• Information that is categorised as special data such as gender, ethnicity, religion and medical information such as GP surgery details and medical conditions, including any disability
• Emergency contact information such as next of kin and other contact names and telephone numbers
• Qualifications and training record
• Contract information which includes work history, job titles, hours worked and salary details
• Bank account details including National Insurance number

In addition to the information we collect directly from you, we also record and hold the following information:

• Absence data and reasons for absence
• CRB clearance details
• Photographs
• Performance information relating to appraisals
• Recruitment information collected through application forms , including copies of right of work documentation, references and cover letters as part of the application process
• Pension and benefits information
• Outcomes of any disciplinary and/or grievance procedures
• Copies of forms of ID (e.g. driving licence etc.

Why we collect and use this information

We use staff information to:

• Contact next of kin/other contacts in cases of emergency
• Enable the development of a comprehensive picture of the workforce and how it is deployed
• Inform the development of our recruitment and retention policies
• Enable staff members to be paid
• Facilitate safer recruitment as part of our safeguarding obligations towards pupils
• Support effective performance management
• Enable equalities monitoring
• Allow for financial monitoring and planning

The lawful basis on which we hold and use this information

We collect and use staff information under the legal basis of public interest as an educational setting/school with the delegated task of educating and safeguarding the children in our care and under a legal obligation which necessitates our school making statutory data returns to the Department for Education (DfE) and the our Local Authority [as described in Article 6, GDPR).

Our school is obliged to make statutory school workforce census returns and hold attendance information under the following legislation:

• Section 5 of the Education (Supply of Information about the School Workforce) (England) Regulations 2007 and amendments

To find out more about the data collection requirements placed on us by the Department for Education (for example; via the school workforce census) go to https://www.gov.uk/education/data-collection-and-censuses-for-schools.

Whilst the majority of staff information you provide to us is mandatory (for reasons described above), there may be some information which we ask you for which is not mandatory but provided on a voluntary basis.

The data we collect relating to medical health information is necessary to protect your vital interests so that we can ensure your medical needs are properly addressed and catered for.

As a staff member,  you cannot decline a data collection but you have the right to decline providing information for self-declared data items by selecting the ‘Refused’ option  e.g. ethnicity.

There are certain personal data items (e.g. photographs) which we collect on the legal basis of legitimate interest. We will ask you for your explicit consent about how these data items can be used if the purpose extends beyond holding the data within our main management information system (e.g. photograph on our school’s website).  As a staff member, you can change your decision to grant or withdraw consent at any time.

If at any point in the future, we seek to use any previously collected information for another purpose or use the information in new software, we will ask for your explicit consent to do so.

Who we share staff information with

We routinely share staff information with:

• our local authority
• the Department for Education (DfE)

Why we share staff information with external parties

We do not share information about our staff with anyone without consent unless the legal basis for holding and sharing the data allow us to do so.

We share staff data with the Department for Education (DfE) and the Local Authority on a statutory basis through data collections such as the School Workforce Census under the following statute:

• Section 5 of the Education (Supply of Information about the School Workforce) (England) Regulations 2007 and amendments

All data is transferred securely and held by DfE under a combination of software and hardware controls which meet the current government security policy framework.   For more information, please see ‘How Government uses your data’ section.

Further information about the data collection requirements placed on our school by the DfE through the school workforce census can be found at https://www.gov.uk/guidance/school-workforce-census

The data shared with the DfE and the local Authority is for the purpose of:

• informing departmental policy on pay
• monitoring the effectiveness and diversity of the school workforce
• making links to school funding and expenditure
• supporting ‘longer term’ research and monitoring of educational policy

Our Local Authority’s Privacy Notice relating to school workforce information can be found at  https://www.centralbedfordshire.gov.uk/schools-portal/administration/school-privacy-notice.aspx

How we keep personal data secure

We fully adhere to our Data Protection policies which outline our procedures and processes for accessing, handling and storing data safely in accordance with all the UK GDPR principles. These policies are regularly reviewed and ratified by our governors. The following processes ensure that we comply with data protection legislation in how we manage the protection of personal data:

• Our networks, file systems and server operating systems are secured through firewalls and spyware/ virus detection programs on our servers to prevent unauthorised access to our data. We closely monitor these filtering systems in accordance with our Safeguarding and Child Protection Policies.
• Data held in a physical location within the school is held securely and only accessible by staff with appropriate authorisation
• Access to data on systems is through individual passwords which are carefully managed and monitored
• Any data that is removed from the school is minimised and encrypted
• Older data is safely removed from computers and other devices
• Data shared with the DfE and the Local Authority is shared through secure file transfer systems. Any data shared with other legitimate third parties where there is a legal basis for sharing will only be shared through secure methods.
• Data shared with third party software suppliers is controlled by the school. We will only deal with suppliers who can demonstrate that they comply with the requirements of data protection legislation and not use personal data for any other purpose than the purpose for fulfilling the functions we have contracted with them
• We ensure all staff receive regular training on data protection

We also adhere to our Data Breach Procedures Policy in the event of a data breach. These procedures explain how our school responds to occurrences of known or reported data breaches. A copy of this policy is available on our school website.

Requesting access to your personal data

Under data protection regulations, as a staff member, you have the following rights:

• Right to be informed
• Right to access to your personal information
• Right to have inaccurate personal data rectified, blocked, erased or destroyed in certain circumstances
• Right to object to processing of personal data that is likely to cause, or is causing, damage or distress
• Right to restrict processing for the purpose of direct marketing
• Right to data portability
• Right to object to decisions being taken by automated means
• Right to claim compensation for damages caused by a breach of the Data Protection regulations

It should be noted that some of these rights will not apply in circumstances where allowing them would significantly reduce or prevent our ability to perform our duties as a school and safeguard the children in our care.

You do have the right to request access to your personal information that we hold. To request access to your personal information, you can make a Subject Access Request (SAR). For further information about this contact Trina Evans, School Manager – Willow Nursery School, 01582 662 600.

Our school will follow procedures outlined in our Subject Access Request Policy available from our policy section which follows the guidelines promoted by the data protection regulations.

Please note that whilst we aim to respond to requests within the required time period of one month, we may not be able to honour this time period if we receive requests just before or during school holidays. If the nature of the request is complex and/or the request falls within a holiday period, we will aim to reach a mutually agreed alternative time period.

How long we keep personal information

We hold staff data for the period determined appropriate for the different types of data we hold.
We will keep information for the minimum period necessary in accordance with DfE’s data retention recommendations which take into account legal and safeguarding considerations linked to the types of data held. Our Data Retention Schedule can be found in our policy section.

All information is held securely and will be destroyed as appropriate under secure and confidential conditions.

Let us know of any changes to personal information and emergency contact information

As a matter of course, we will contact you at least once a year to ensure that all the personal information and emergency contact details we have for you is accurate and up-to-date. We would encourage you to inform the school’s business manager/main administrator of any changes to your personal details as soon as possible.

Reporting concerns about our data protection processes

If you have a concern about the way we are collecting or using your personal data, we request that you raise your concern with us in the first instance by contacting Trina Evans, School Manager – Willow Nursery School, 01582 662 600. Alternatively, you can contact the Information Commissioner’s Office at https://ico.org.uk/concerns/

Keeping you informed through this Privacy Notice

We aim to keep you informed of any changes to our data collections and data protection obligations through this Privacy Notice – the latest copy will be available on our website in our policy section.

Why the Department for Education (DfE) hold and share school workforce data

The DfE’s main source of school workforce data comes from the school workforce census returns from schools and provides information to the department on:

• Staff pay bills
• Staff turnover
• Absences

School workforce information also informs the departmental policy on pay and the monitoring of the effectiveness and diversity of the school workforce.

The Department may share information about school employees with third parties who promote the education or well-being of children or the effective deployment of school staff in England by:

• conducting research or analysis
• producing statistics
• providing information, advice or guidance

The DfE has robust processes in place to ensure that the confidentiality of personal data is maintained and there are stringent controls in place regarding access to it and its use. Decisions on whether DfE releases personal data to third parties are subject to a strict approval process and based on a detailed assessment of:

• who is requesting the data
• the purpose for which it is required
• the level and sensitivity of data requested; and
• the arrangements in place to securely store and handle the data

How the DfE keeps data secure

All data is transferred securely and held by DfE under a combination of software and hardware controls, which meet ISO27001 standards and the government security policy framework.

To be granted access to school workforce information, organisations must comply with its strict terms and conditions covering the confidentiality and handling of the data, security arrangements and retention and use of the data.

To contact the department: https://www.gov.uk/contact-dfe