How we use your information

Our privacy notices explain what to expect when John Keble School collects personal information. In this notice John Keble Primary School, Crownhill Road, London, NW10 4DR is the data controller as defined by Data Protection legislation.

Our Data Protection Officer is:

Rajesh Seedher

020 8937 2018

school.dpo@brent.gov.uk

Data Protection Officer, Brent Council, Civic Centre, Engineers Way HA9 0FJ

The purposes of processing this personal data

Your information is collected for the purpose of:

• Providing education, training, welfare, and educational support services
• Administering school property
• Maintaining the school’s accounts and records
• Supporting and managing the school’s employees
• The school also use CCTV systems to monitor and collect visual images for security and the prevention of crime

The detailed purposes, categories of people, categories of personal data to be processed, legal justification, retention and information sharing can be found on the schools Record of Processing Activities. A copy can be obtained from our Data Protection Officer.

The lawful basis on which we use this information

We collect and use information under one or more of the following legal basis.

• Legal obligation – we need to process your information to comply with the law
• Public task – we need to process your information to carry out the task to provide you with an education
• Contract – we need to process your information as part of a contract such as contract of employment.
• Consent – we need your permission to use your information

Where we require consent to use your information we will make it clear when we ask for consent and explain how to go about withdrawing your consent.

By law, we are required to correctly and use certain pupil information. This information is known as statutory data and falls into the general purposes category of Article 6 of the GDPR 2018.

Further information may be collected relating to, for example, Special Educational Needs and/or Disabilities. In this case, the information is treated as special category data and processed and used as such. This data falls under the special category of Article 9 from the GDPR 2018.

Categories of personal data

The categories of information we may process include:

• Name and personal details (such as name, unique pupil number and address)
• Family details
• Financial details
• Education details
• Employment details
• Student and disciplinary records
• Vetting checks
• Goods and services
• Visual images, personal appearance and behaviour

We also process sensitive classes of information that may include:

• Physical or mental health details
• Racial or ethnic origin
• Religious or other beliefs of a similar nature
• Trade union membership
• Offences and alleged offences

We may process personal information about:

• Students and pupils
• Advisers and other professional experts
• School staff
• Governors
• Suppliers
• Complainants and enquirers
• Individuals captured by CCTV images

Where necessary or required, we may share information with:

• Education, training, careers and examining bodies
• School staff and boards
• Family, associates and representatives of the person whose personal data we are

• Local and central government
• Healthcare professionals
• Social and welfare organisations
• Police forces
• Courts
• Current, past or prospective employers
• Voluntary and charitable organisations
• Business associates and other professional advisers
• Suppliers and service providers
• Financial organisations
• Security organisations
• Press and the media

We will not adopt automated decision making, including profiling.

We do not process your information with third countries outside of the UK or EU zone without the safeguards being in place that are equivalent to the Data Protection Act 1998 or the General Data Protection Regulations (GDPR).

If you fail to provide the personal data, we may not be able to deliver accurate services to you, and may also take action if it is required to do so by law.

The National Pupil Database (NPD)

The NPD is owned and managed by the Department for Education and contains information about pupils in schools in England. It provides invaluable evidence on educational performance to inform independent research, as well as studies commissioned by the Department. It is held in electronic format for statistical purposes. This information is securely collected from a range of sources including schools, local authorities and awarding bodies.

We are required by law, to provide information about our pupils to the DfE as part of statutory data collections such as the school census and early years’ census. Some of this information is then stored in the NPD. The law that allows this is the Education (Information about Individual Pupils) (England) Regulations 2013.

To find out more about the NPD, go to https://www.gov.uk/government/publications/national-pupil-database-user-guide-and-supporting-information.

The department may share information about our pupils from the NPD with third parties who promote the education or well-being of children in England by:

• conducting research or analysis
• producing statistics
• providing information, advice or guidance

The Department has robust processes in place to ensure the confidentiality of our data is maintained and there are stringent controls in place regarding access and use of the data. Decisions on whether DfE releases data to third parties are subject to a strict approval process and based on a detailed assessment of:

• who is requesting the data
• the purpose for which it is required
• the level and sensitivity of data requested: and
• the arrangements in place to store and handle the data

To be granted access to pupil information, organisations must comply with strict terms and conditions covering the confidentiality and handling of the data, security arrangements and retention and use of the data.

For more information about the department’s data sharing process, please visit: https://www.gov.uk/data-protection-how-we-collect-and-share-research-data

For information about which organisations the department has provided pupil information, (and for which project), please visit the following website: https://www.gov.uk/government/publications/national-pupil-database-requests-received

To contact DfE: https://www.gov.uk/contact-dfe

Your rights

Individual rights under the Data Protection legislation.

1. The right to be informed

This is your right know about how your data is being processed, who it is given to, for what purpose and anything else that guarantees your rights. This document provides a summary, the ‘Record of Processing Activities’ gives further details.

2. The right of access

You have a right to access your personal data and relevant supplementary information. This is known as a ‘Subject Access Request’. Further information can be found at www.ico.org.uk. You can make a request by emailing the Data Protection Officer at school.dpo@brent.gov.uk. You should receive a response within 30 days, unless a different period applies as described under the ICO’s Subject Access code of practice.

3. The right to rectification

You have the right to have your personal data rectified if it is inaccurate or incomplete. You can do this by contacting the service area that you are concerned about directly. Otherwise you can make a request by emailing the Data Protection Officer at school.dpo@brent.gov.uk

4. The right to erasure

This is also known as “The Right to be Forgotten”. Please note that there are circumstances when your information cannot be erased. This includes situations whereby the council is required to retain information for statutory purposes in accordance with its data retentions policy. You can make a request by emailing the Data Protection Officer at school.dpo@brent.gov.uk. You should receive a response within 30 days.

5. The right to restrict processing

You have a right to request the council to ‘block’ or ‘supress’ processing of your personal data. Please note that this may not apply for most of the council’s processes because there is usually a legal duty to process information.

6. The right to data portability

You have the right to obtain and reuse your personal data for your own purposes. You can make a request by emailing the Data Protection Officer at school.dpo@brent.gov.uk, or in writing to the Data Protection Officer, Brent Council, Civic Centre, Engineers Way HA9 0FJ.

7. The right to object to processing

You have the right to object to processing for certain circumstances as listed by the ICO at www.ico.org.uk. You can make a request by emailing the Data Protection Officer at school.dpo@brent.gov.uk

8. Rights related to automated decision making including profiling

There are restrictions on automated decisions based solely on automated means without any human involvement. Also there are restrictions on profiling. You can make an enquiry by emailing the Data Protection Officer at school.dpo@brent.gov.uk.

Concerns about data protection

If you have a concern about the way we are collecting or using your personal data, we request that you raise your concern with our ‘Designated Data Protection Officer’ in the first instance. Alternatively, you can contact the Information Commissioner’s Office at https://ico.org.uk/concerns/

You can raise your concern by emailing the Data Protection Officer at school.dpo@brent.gov.uk, or in writing to the Data Protection Officer, Brent Council, Civic Centre, Engineers Way HA9 0FJ.