|Ratified by Governors||4th July 2019|
|Date of next review||Summer 2020|
The LA model policy has been adopted
Special category and criminal conviction personal data (the appropriate policy document)
This document meets the requirement at paragraph 1 of Schedule 1 to the Data Protection Act 2018 that an appropriate policy document be in place where the processing of special category personal data is necessary for the purposes of performing or exercising obligations or rights which are imposed or conferred by law on the controller or the data subject in connection with employment, social security or social protection.
It also meets the requirement at paragraph 5 of Schedule 1 to the Data Protection Act 2018 that an appropriate policy document be in place where the processing of special category personal data is necessary for reasons of substantial public interest. The specific conditions under which data may be processed for reasons of substantial public interest are set out at paragraphs 6 to 28 of Schedule 1 to the Data Protection Act 2018 and the School intends to rely on these as and when appropriate, with particular reliance on paragraph 18, ‘Safeguarding of children and individuals at risk’ and paragraph 17, ‘Counselling’.
Procedures for securing compliance
Article 5 of the General Data Protection Regulation sets out the data protection principles. These are our procedures for ensuring that we comply with them. These apply to all personal data processed by the School including special category data.
Personal data shall be processed lawfully, fairly and in a transparent manner in relation to the data subject.
The School will:
Personal data shall be collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes.
The School will:
Personal data shall be adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed.
The School will only collect the minimum personal data that we need for the purpose for which it is collected. We will ensure that the data we collect is adequate and relevant.
Personal data shall be accurate and, where necessary, kept up to date.
The School will ensure that personal data is accurate, and kept up to date where necessary. We will take particular care to do this where our use of the personal data has a significant impact on individuals.
Personal data shall be kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed.
The School will only keep personal data in identifiable form as long as is necessary for the purposes for which it is collected, or where we have a legal obligation to do so. Once we no longer need personal data it shall be deleted or rendered permanently anonymous.
Personal data shall be processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures.
The School will ensure that there appropriate organisational and technical measures in place to protect personal data.
The controller shall be responsible for, and be able to demonstrate compliance with these principles. The governing body and Senior Leadership Team responsible for ensuring that the department is compliant with these principles in relation to the processing of personal data including special category data..
Data controller’s policies as regards retention and erasure of personal data
We will ensure, where personal data including special category data is processed, that: