Education privacy notice

Who is the Data Controller for this processing?

Ourselves and some education providers are the Data Controllers for this processing.

The personal information we have collected from you will be shared with fraud prevention agencies who will use it to prevent fraud and money-laundering and to verify your identity. If fraud is detected, you could be refused certain services, finance, or employment.

What services are covered by this privacy notice?

What personal information do we hold?

We only collect and use the minimum amount of personal information required when delivering a service to you. Wherever possible we use non-identifiable personal information.

The service may use some or all of the personal information provided:

  • your name, address, date of birth, telephone number(s), email address or postal address
  • national identifiers such as NHS number, National Insurance number, Pupil ID
  • education details
  • details about your lifestyle and social circumstances
  • the IP address that you accessed any of our online services from
  • case file information
  • safeguarding information
  • physical or mental health details
  • racial or ethnic origin
  • religious or other beliefs of a similar nature
  • financial details
  • school attendance
  • contact details of all those with parental responsibility
  • physical, emotional and social development health needs

We get most of this information from you, but we may also get some of this data from:

  • other local authorities
  • health and social care provider
  • family members
  • central government agencies
  • employers
  • further education and higher education colleges
  • schools
  • commissioned partners
  • finance department
  • other third-party organisations, as allowed by law
  • pupil referral units
  • police
  • legal representatives
  • education providers

How do we use your personal information?

We use your information to:

  • deliver the service, or handle your query
  • plan and improve the services we offer
  • detect and prevent crime or fraud
  • research, however this would be in anonymised form unless we ask for your consent to use your personal information for this purpose
  • evidence positive outcomes to central government funding agencies
  • provide specialist advice as part of an education, health and care (EHC) needs assessment
  • ensure that the specialist advice we provide is accurate and up-to-date
  • assess your eligibility for free school meals
  • support your early years setting in school or college
  • provide appropriate support for children with special educational needs
  • provide specialist advice and support clinical assessments
  • safeguard children
  • teach you about road safety
  • teach you how to read and interpret bus and train timetables
  • teach you how to manage your money and use public transport

Who else might we share your personal information with?

Sometimes we may need to share your information, but we will only do so where it is necessary or required by law. We will only share the minimum information for each circumstance.

We may sometimes need to share some of your information with:

  • health service providers including NHS agencies (GPs, hospitals, ambulance, health visitor, mental health services)
  • Government agencies (e.g. Department of Education, Department of Work and Pensions)
  • education providers
  • care providers, e.g. day care, domiciliary, residential
  • support groups for people with disabilities
  • schools, colleges and early years settings
  • local authorities (education, social care and relevant housing and employment and other services)
  • the governing bodies of schools, including non-maintained special schools
  • the governing bodies of further education colleges and sixth form colleges
  • the proprietors of academies (including free schools, university technical colleges and studio schools)
  • the management committees of pupil referral units
  • independent schools and independent specialist providers approved under Section 41 of the Children and Families Act 2014
  • early years providers in the maintained, private, voluntary and independent sectors that are funded by the local authority
  • The National Health Service Commissioning Board
  • clinical commissioning groups (CCGs)
  • youth offending teams and relevant youth custodial establishments
  • the first-tier tribunal (Special Educational Needs and Disability) or mediation services
  • other third-party organisations, as allowed by law
  • other partner agencies that provide services on our behalf
  • Petty Pool

In addition, if you are receiving support from our education or family services then the NHS may share your NHS number with us. This is so that the ourselves and the NHS are using the same number to identify you whilst providing your care.

By using the same number the NHS and ourselves can work together more closely to support you.

We will use the NHS Number in an integrated care record system across a number of support services including GP’s, hospitals, community matrons, district nurses and social care practitioners.

Find out more about the Cheshire Care Record.

We may also use Data Processors to support these activities, for example by providing the systems we need to or delivering services on our behalf.

What is the legal basis for our use of your personal information?

Most of the personal information we process is provided to us directly by you, under the General Data Protection Regulation (GDPR), the lawful bases we rely on for using your personal information are:

  • you gave us your consent (GDPR Article 6 (a)
  • we have a contractual obligation with you (GDPR Article 6 (b)
  • we need it to perform a public task (GDPR Article 6 (e)
  • we have a legal obligation (GDPR Article 6 (c)

When we collect data about your race, health (including biometric or genetic data), sex life, sexual orientation, ethnic origin, politics or trade union membership, we also rely on the following lawful basis:

  • you gave us your explicit consent (GDPR Article 9 (2) (a))
  • we need to collect it for Substantial Public Interest in order to comply with UK legislation (GDPR Article 9 (2) (g)
  • we need it for employment, social security or social protection (GDPR Article 9 (2) (b))
  • we need to protect your vital interests in situations where you are incapable for giving consent (GDPR Article 9 (2) (c)
  • we need to collect it for Substantial Public Interest in order to comply with UK legislation (GDPR Article 9 (2) (g)
  • we are providing you with health and social care support (GDPR Article 9 (2) (h))
  • we need to analyse your information (GDPR Article 9 (2) (j))

The legislation we rely on when using your personal information to meet our legal obligations or public tasks includes but is not limited to:

  • Apprenticeship, Skills, Children and Learning Act (ASCL) 2009
  • Child Performance and Activities (England) Regulation 2014
  • Childcare Act 2006 and 2016
  • Children and Families Act 2014
  • Children and Young Persons Act 1963
  • Children's Act 1989 and 2004
  • Crime and Disorder Act 1998
  • Early Years Foundation Stage (Learning and Development Requirements) Order 2007
  • Education (Admissions Appeals Arrangements) (England) (Amendment) Regulations 2008
  • Education (Non-Maintained Special Schools) (England) (Amendment) Regulations 2015
  • Education Acts 1980 – 2011
  • Education (Provision of Full-Time Education for Excluded Pupils) England Regulations 2007(SI 2007/1870)
  • Education (Pupil Exclusions and Appeals) (Pupil Referral Units) England Regulations 2008
  • Education (Pupil Referral Units) (Management Committees etc.) England Regulations 2007
  • Education School Information (England) Regulations 2008 Regulation 8 of SI 2008/3093
  • Education and Adoption Act 2016
  • Education and Inspections Act 2006
  • Education and Skills Act 2002 and 2008
  • Employment and Training Act 1973
  • Equality Act 2010
  • Health and Safety at Work Act 1974
  • Learning and Skills Act 2000
  • Protection of Freedoms Act 2012
  • Provision of Education (England) Regulations 2008
  • Welfare Reform and Work Act 2016
  • Reporting of Injuries, Diseases and Dangerous Occurrences Regulations 2013 (RIDDOR)
  • Safeguarding Vulnerable Groups Act 2006
  • School Admissions (Admission Arrangements) (England) Regulations 2008
  • School Information (England) Regulations 2008
  • School Standards and Framework Act (SSFA) 1998
  • Special Educational Needs and Disability Regulations 2014
  • Teachers’ Pensions Regulations 2010
  • Teaching and Higher Education Act 1998

Where will we store your information?

Your information will be securely stored on our network and securely in offices and our secure records centre.

How long will we keep your personal information?

We will only use your personal information whilst delivering the service to you and to deal with any questions or complaints that we may receive about this, unless the law requires us to keep it for a longer period (see bulleted list below).

  • Education Case Management Files - until the child’s 25th birthday
  • SEN assessment and support – until the service user’s 31st birthday
  • Looked after children – until the service user’s 75th birthday

If we need to use your information for research or reports, your information will be anonymised and any information taken from notes (hand written or typed) during any consultation sessions will be securely destroyed. The information will continue to be used in a summarised and anonymised form in any research reports or papers that are published. The anonymised information in the papers may be of historic interest and may be held in public archives indefinitely.

Your rights

Under data protection law, you have rights including:

  • your right of access - you have the right to ask us for copies of your personal information
  • your right to rectification - you have the right to ask us to rectify information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.
  • your right to erasure - you have the right to ask us to erase your personal information in certain circumstances
  • your right to restriction of processing - you have the right to ask us to restrict the processing of your information in certain circumstances
  • your right to object to processing - you have the right to object to the processing of your personal data in certain circumstances
  • your right to data portability - you have the right to ask that we transfer the information you gave us to another organisation, or to you, in certain circumstances

You are not required to pay any charge for exercising your rights. If you make a request, we have one month to respond to you.

To make a request follow the instructions on our Data protection for you page.

How to complain if you are unhappy about how your data is used

You can complain directly to our Data Protection team online or by post.

  • Contact the DPO
  • By post: Data Protection Officer, The Portal, Wellington Road, Ellesmere Port, CH65 0BA

You also have the right to complain to the Information Commissioner’s Office using the following details:

Will my personal information be accessible outside the UK?

Your information is stored within the UK.

Should the transfer of personal information outside of the UK become necessary, it will only take place if permitted by law, and then only where there are appropriate safeguards in place to protect the personal information.