Education Services Privacy Notice - Pupil Records

As the 'data controller' for the personal information - or data - we hold about you, South Ayrshire Council decides how your personal information is used/processed, and what it is used for.

This statement provides more details about this and provides information on how to get in touch with us if you need to know more.

Your personal data - what is it?

Personal data is information relating to a living person who can be identified from that data. Identification can be based on the information alone, or in conjunction with any other information. The processing of personal data is governed by the UK General Data Protection Regulation (UK GDPR) and supplemented by the Data Protection Act 2018.

What Personal Data will we collect from you?

We will only collect the personal information we need to provide you with relevant information, services and support. The personal data we will collect includes:

How will we use your information?

Your information will be used in a number of ways:

• for teaching, registration and assessment
• to ensure all aspects of a child/young person's education is managed and monitored appropriately
• to ensure that a child/young person's health and well-being is managed. 
• to ensure that a child/young person is transported to school safely and is able to fully take part in school activities.
• to ensure that appropriate education benefits can be processed
• to ensure the rights of pupils in schools

We use SEEMiS, an educational management information system, to process and manage pupil data, pupil contact data and staff data.

What is the legal basis for using/sharing your information?

The lawful basis for processing personal data are set out in Data Protection legislation. In this case the lawful basis for processing individuals' data are:

1) Public task - under Article 6(1) (e) of the UK GDPR, the processing is necessary for us to perform a task in the public interest or for our official functions, and the task or function has a clear basis in law. The main laws relating to Education are (this list is not exhaustive):

• The Education (Scotland) Act (1980)
• The Education (Additional Support for Learning) (Scotland) Act 2004
• The Education (Scotland) Act 2016
• The School Pupil Records (Scotland) Regulations 1990

A full list of Education legislation is available on request.

(2) Consent - in limited circumstances, for instance relating to taking pictures for promotional purposes, Education Services may rely on an individual's consent to process their personal data under Article 6 (1)(a) of the UK GDPR. Where Education Services is relying on an individual's consent to process personal data then individuals have the right to withdraw this consent at any time.

(3) Contract - The processing is necessary for a contract, for example school trips. The processing is under Article 6 (1)(b) of the UK GDPR.

Special Category Data

For some activities, we also need to process more sensitive personal information about you known as special category data, for example health information.

1)    Processing is necessary for reasons of substantial public interest as set out in Article 9(2) (g) of the UK GDPR and meets a condition in Part 2 of Schedule 1 of the Data Protection Act 2018.

2)    In limited circumstances, for instance with regards to using biometric data to administer the school catering system, Education Services may rely on an individual's explicit consent to process their personal data relying on Article 9 (2)(a) of the UK GDPR Where Education Services is relying on an individual's consent to process personal data then individuals have the right to withdraw this consent at any time.

Who will we share your information with?   

Where necessary your information will be shared with:

• Social Work and Community Learning and Development
• NHS Ayrshire and Arran
• Strathclyde Partnership for Transport and Transport Contractors
• Ayrshire Valuation Joint Board (Electoral Register)
• CRB - online school payments
• Scottish Qualification Authority (SQA)
• Skills Development Scotland
• Wilson Webware (Curriculum for Excellence Machine)
• Glow - schools intranet
• Groupcall - text messaging
• Scottish Government
• National Entitlement Cards
• Renaissance Learning (Accelerated Reader Programme)
• Social Security Scotland (for assisting in verification of a Disability Claim made by a parent for their child)

Education Services will also share pupil information with approved external software organisations providing educational products such as homework or tuition apps/online services, so that pupils can be registered and utilize the learning products.

Where information is shared with other organisations or processed on our behalf, we will ensure adequate protection by ensuring contracts and sharing agreements are in place that define security controls around the sharing of the information.

Education Services will also make any disclosures required by law and may also share information with other bodies responsible for detecting/preventing fraud or auditing/administering public funds.

How long do we keep hold of your information?

We keep your personal data for no longer than reasonably necessary. Our retention periods are as follows:

What are your rights?

The lawful basis for your processing/using your personal data directly impacts which rights are available to you. For example, some rights will not apply, in this case we are not required to:

• erase your personal information.
• enable the right to data portability

However, you do have the following rights and can ask us to:

• correct your personal information if it is inaccurate;
• complete your personal information if it is incomplete;
• restrict the processing of your personal information in certain circumstances

You also have the right to object to the processing of your personal information.

When we are processing your information with your consent, you have the right to:

• request us to erase of your personal information.
• enable the right to data portability
• correct your personal information if it is inaccurate;
• complete your personal information if it is incomplete;
• restrict the processing of your personal information in certain circumstances

Please note although you have the right to withdraw your consent in whole or in part, at any time, information that has been shared cannot be unshared.

When we are processing your information under contract, you have the right to:

• request us to erase of your personal information.
• enable the right to data portability
• correct your personal information if it is inaccurate;
• complete your personal information if it is incomplete;
• restrict the processing of your personal information in certain circumstances

Do you require this statement in a different format?

Please contact us if you require this information in an alternative format.

How can you get in touch with us?

If you wish to obtain any records held by us relating to you, or if you have any general data protection queries, please contact the Data Protection Service at:

Data Protection Officer
South Ayrshire Council
County Buildings
Wellington Square
Ayr
KA7 1DR

Email: DataProtection@south-ayrshire.gov.uk
Telephone: 01292 612 223

Are you dissatisfied with the way your Personal Information has been handled?

If you are unhappy with the way we have dealt with your personal information, you can complain to the Data Protection Officer using the contact details noted above.

If you remain dissatisfied after contacting us, you have the right to complain to the Information Commissioner:

Information Commissioner's Office - Scotland
Queen Elizabeth House
Sibbald Walk
Edinburgh
EH8 8FT

Email: scotland@ico.org.uk
Telephone: 0303 123 1115