3 ms·
>We are supposed to employ a 'data officer' this basically cannot be anyone who works in the school at present. As a public body, you are required to appoint a
by jdietrich 8y ago
>We are supposed to employ a 'data officer' this basically cannot be anyone who works in the school at present.
As a public body, you are required to appoint a data protection officer. That officer may be an existing staff member, provided that they have suitable training. They may fulfil other tasks and duties, as long as these duties do not result in a conflict of interests. The same person can act as the data protection officer for more than one organisation, so you could share a DPO with other schools or the local authority. (GDPR Art. 37-39) If no-one in your organisation is competent to act as a DPO, then you were almost certainly breaching the Data Protection Act.
https://gdpr-info.eu/art-37-gdpr/ https://gdpr-info.eu/art-37-gdpr/
>Things like publicly visible visitors books are outlawed (depending on how you read guidance), the alternative are electronic systems - more cost.
They were already illegal under the Data Protection Act. You can use visitor forms or cards instead of a visitor book - the receptionist still has a record of visitors, but their personal information isn't on display.
>Displaying certain sensitive information, prescriptions for pupils, are now outlawed, this could compromise safety.
This was already illegal under the Data Protection Act. If parents want staff to be aware of sensitive medical information relating to their child, you should have taken a written declaration consenting for that information to be shared. That information should not be displayed in a place where pupils, visitors or any other unauthorised person might see it.
- donogh 8y agoA school does not necessarily meet the definition of a public authority [1]; I would say it's not; it depends on individual EU countries to legislate on that definition. Furthermore, in Ireland, for example, fines cannot be levied against public authorities: https://www.irishtimes.com/news/crime-and-law/public-bodies-not-subject-to-fines-under-new-data-protection-bill-1.3377063 https://www.irishtimes.com/news/crime-and-law/public-bodies-... [1] https://www.lexology.com/library/detail.aspx?g=e71ac55f-566b-4dba-a866-ca5daa8e2e91 https://www.lexology.com/library/detail.aspx?g=e71ac55f-566b...
- jdietrich 8y agoThe Data Protection Act 2018 was passed by parliament today. It applies the definitions of "public authority" given in Schedule I of the Freedom of Information Act 2010 (with a few exceptions), so maintained and academy schools are considered public authorities for the purposes of the GDPR. It does grant the Secretary of State the right to alter this definition, so it's possible that schools could be removed from this scope if the impact is deemed to be unreasonably onerous. http://www.legislation.gov.uk/ukpga/2018/12/pdfs/ukpga_20180012_en.pdf http://www.legislation.gov.uk/ukpga/2018/12/pdfs/ukpga_20180...
- coldacid 8y agoI bet the folks in Dublin will be happy to know that UK law applies to them again /s
- jdietrich 8y agoThe chap I was replying to mentioned that something would cost him "£300", not "€300". It's a reasonably safe bet that he's in the UK.
- donogh 8y agoFair enough. I haven't reviewed the UK legislation.