LeicesterIslamicAcademy

SchoolPersonalDataProtection&HandlingPolicy

2016-2017

IntroductionLeicester IslamicAcademyandouremployeeswilldoeverythingwithin theirpower toensure the

safetyandsecurityofanymaterialofapersonalorsensitivenature

Itistheresponsibilityofallmembersoftheschoolcommunitytotakecarewhenhandling,usingor

transferringpersonaldatathatitcannotbeaccessedbyanyonewhodoesnot:

• havepermissiontoaccessthatdata,and/or

• needtohaveaccesstothatdata.

Databreachescanhaveseriouseffectsonindividualsand/orinstitutionsconcerned,canbringthe

school into disrepute and may well result in disciplinary action, criminal prosecution and fines

imposed by the Information Commissioners Office for the school and the individuals involved.

Particularly,alltransferofdataissubjecttoriskoflossorcontamination.

Anyonewhohasaccess topersonaldatamustknow,understandandadhere to thispolicy,which

bringstogetherthelegalrequirementscontainedinrelevantdataprotectionlegislationandrelevant

regulationsandguidanceincludingviathelocalauthority.

TheDPA laysdownasetof rules forprocessingofpersonaldata (bothstructuredmanual records

anddigitalrecords). Itprovidesindividuals(datasubjects)withrightsofaccessandcorrection.The

DPA requires organisations to complywith eight data protection principles, which, among others

requiredatacontrollerstobeopenabouthowthepersonaldatatheycollectisused.

TheDPAdefines “PersonalData” as datawhich relate to a living individualwho canbe identified

(http://ico.org.uk/for_organisations/data_protection/the_guide/key_definitions)

• fromthosedata,or

• fromthosedataandotherinformationwhichisinthepossessionof,orislikelytocomeinto

thepossessionof,thedatacontroller,

andincludesanyexpressionofopinionabouttheindividualandanyindicationoftheintentionsof

thedatacontrolleroranyotherpersoninrespectoftheindividual.

Itfurtherdefines“SensitivePersonalData”aspersonaldataconsistingofinformationasto:

• theracialorethnicoriginofthedatasubject

• hispoliticalopinions

• hisreligiousbeliefsorotherbeliefsofasimilarnature

• whether he is a member of a trade union (within the meaning of the Trade Union and

LabourRelations(Consolidation)Act1992)

• hisphysicalormentalhealthorcondition

38

• hissexuallife

• thecommissionorallegedcommissionbyhimofanyoffence,or

• anyproceedingsforanyoffencecommittedorallegedtohavebeencommittedbyhim,the

disposalofsuchproceedingsorthesentenceofanycourtinsuchproceedings

GuidancefororganisationsprocessingpersonaldataisavailableontheInformationCommissioner’s

Officewebsite:http://www.ico.gov.uk/for_organisations/data_protection_guide.aspx

PolicyStatementTheschoolwillholdtheminimumpersonaldatanecessarytoenableittoperformitsfunctionandit

willnotholditforlongerthannecessaryforthepurposesitwascollectedfor.

Everyeffortwillbemadetoensurethatdataheldisaccurate,uptodateandthatinaccuraciesare

correctedwithoutunnecessarydelay.

All personal data will be fairly obtained in accordance with the “Privacy Notice” and lawfully

processedinaccordancewiththe“ConditionsforProcessing”.

PersonalDataTheschooland individualswillhaveaccess toawiderangeofpersonal informationanddata.The

data may be held in a digital format or on paper records. Personal data is defined as any

combination of data items that identifies an individual and provides specific information about

them,theirfamiliesorcircumstances.Thiswillinclude:

• Personalinformationaboutmembersoftheschoolcommunity–includingpupils/students,

members of staff and parents / carers e.g. names, addresses, contact details, legal

guardianshipcontactdetails,healthrecords,disciplinaryrecords

• Curricular / academic data e.g. class lists, pupil / student progress records, reports,

references

• Professional records e.g. employment history, taxation and national insurance records,

appraisalrecordsandreferences

• Any other information that might be disclosed by parents / carers or by other agencies

workingwithfamiliesorstaffmembers.

ResponsibilitiesTheschool’sSeniorInformationRiskOfficer(SIRO)isMrsSSuleman(BusinessManager).Thisperson

willkeepuptodatewithcurrentlegislationandguidanceandwill:

• determine and take responsibility for the school’s information risk policy and risk

assessment

• appointtheInformationAssetOwners(IAOs)

TheschoolwillidentifyInformationAssetOwners(IAOs)forthevarioustypesofdatabeingheld(e.g.

pupil / student information / staff information / assessmentdataetc.). The IAOswillmanageand

addressriskstotheinformationandwillunderstand:

• whatinformationisheld,forhowlongandforwhatpurpose,

• howinformationasbeenamendedoraddedtoovertime,and

• whohasaccesstoprotecteddataandwhy.

Everyone in the schoolhas the responsibilityofhandlingprotectedor sensitivedata ina safeand

securemanner.

Governorsarerequiredtocomplyfullywiththispolicyintheeventthattheyhaveaccesstopersonal

data,whenengagedintheirroleasaGovernor.

RegistrationTheschoolisregisteredasaDataControllerontheDataProtectionRegisterheldbytheInformation

Commissioner.

InformationtoParents/Carers–the“PrivacyNotice”InordertocomplywiththefairprocessingrequirementsoftheDPA,theschoolwillinformparents/

carersofallpupils/studentsofthedatatheycollect,processandholdonthepupils/students,the

purposesforwhichthedataisheldandthethirdparties(egLA,DfE,etc)towhomitmaybepassed.

This privacy noticewill be passed to parents / carers through letter andwhere applicable letter.

Parents/carersofyoungpeoplewhoarenewtotheschoolwillbeprovidedwiththeprivacynotice

aspartoftheirregistrationprocess.

Training&awarenessAllstaffwillreceivedatahandlingawareness/dataprotectiontrainingandwillbemadeawareof

theirresponsibilities,asdescribedinthispolicythrough:

• Inductiontrainingfornewstaff

• Staffmeetings/briefings/Inset

• DaytodaysupportandguidancefromInformationAssetOwners/SLT

RiskAssessments

Information risk assessments will be carried out by Information Asset Owners to establish the

securitymeasuresalready inplaceandwhether theyare themostappropriateandcosteffective.

Theriskassessmentwillinvolve:

• Recognisingtherisksthatarepresent;

• Judgingtheleveloftherisks(boththelikelihoodandconsequences);and

• Prioritisingtherisks.

RiskassessmentsareanongoingprocessandshouldresultinthecompletionofanInformationRisk

ActionsFormasbelow:

RiskIDInformation

Assetaffected

Information

AssetOwner

Protective

Marking

(ImpactLevel)

Likelihood

Overallrisk

level(low,

medium,

high)

Action(s)to

minimiserisk

ImpactLevelsandprotectivemarkingFollowingincidentsinvolvinglossofdata,theGovernmentrecommendsthattheProtectiveMarking

Schemeshouldbeusedtoindicatethesensitivityofdata.TheProtectiveMarkingSchemeismapped

toImpactLevelsasfollows:

GovernmentProtectiveMarkingScheme

labelImpactLevel(IL) Appliestoschools?

NotProtectivelyMarked 0

WillapplyinschoolsProtect 1or2Restricted 3Confidential 4

WillnotapplyinschoolsHighlyConfidential 5

TopSecret 6

Most student / pupil or staff personal data that is usedwithin educational institutionswill come

under thePROTECTclassification. Howeversome,e.g. thehomeaddressofachild (orvulnerable

adult)atriskwillbemarkedasRESTRICT.

The school will ensure that all school staff, independent contractors working for it, and delivery

partners,complywithrestrictionsapplyingtotheaccessto,handlingandstorageofdataclassified

as Protect, Restricted or higher. Unmarked material is considered ‘unclassified’. The term

‘UNCLASSIFIED’or‘NON‘or‘NOTPROTECTIVELYMARKED’maybeusedtoindicatepositivelythata

protectivemarkingisnotneeded.

All documents (manualordigital) that containprotectedor restricteddatawill be labelled clearly

with the Impact Level shown in the header and the Release and Destruction classification in the

footer.

Usersmustbeawarethatwhendataisaggregatedthesubsequentimpactlevelmaybehigherthan

theindividualimpactlevelsoftheoriginaldata.Combiningmoreandmoreindividualdataelements

together ina reportordataview increases the impactof abreach.Abreach thatputs students /

pupilsatseriousriskofharmwillhaveahigherimpactthanariskthatputsthematlowriskofharm.

Long-termsignificantdamagetoanyone’s reputationhasahigher impact thandamagethatmight

causeshort-termembarrassment.

Releaseanddestructionmarkingsshouldbeshowninthefootere.g..“Securelydeleteorshredthis

informationwhenyouhavefinishedusingit”.

SecureStorageofandaccesstodataTheschoolwillensurethatsystemsaresetupsothattheexistenceofprotectedfilesishiddenfrom

unauthorisedusersand thatuserswill beassigneda clearance thatwill determinewhich filesare

accessible to them.Access to protected datawill be controlled according to the role of the user.

Members of staff will not, as a matter of course, be granted access to the whole management

informationsystem.

Alluserswillusestrongpasswords,whichmustbechangedregularly.Userpasswordsmustneverbe

shared.

Personaldatamayonlybeaccessedonmachinesthataresecurelypasswordprotected.Anydevice

thatcanbeusedtoaccessdatamustbelockedifleft(evenforveryshortperiods)andsettoauto

lockifnotusedforfiveminutes.

All storage media must be stored in an appropriately secure and safe environment that avoids

physicalrisk,lossorelectronicdegradation.

Personaldatacanonlybestoredonschoolequipment(thisincludescomputersandportablestorage

media where approved. Private equipment (i.e. owned by the users) must not be used for the

storageofpersonaldata.

Whenpersonaldataisstoredonanyportablecomputersystem,USBstickoranyotherremovable

media:

• thedatamustbeencryptedandpasswordprotected,

• the device must be password protected (many memory sticks / cards and other mobile

devicescannotbepasswordprotected),

• thedevicemustofferapprovedvirusandmalwarecheckingsoftware(memorystickswillnot

providethisfacility,mostmobiledeviceswillnotoffermalwareprotection),and

• thedatamustbesecurelydeletedfromthedevice,inlinewithschoolpolicy(below)onceit

hasbeentransferredoritsuseiscomplete.

40

Theschoolhasclearpolicyandproceduresfortheautomaticbackingup,accessingandrestoringall

dataheldonschoolsystems,includingoff-sitebackups.

The school has clear policy and procedures for the use of “Cloud Based Storage Systems” (for

example dropbox, Microsoft 365, google apps and google docs) and is aware that data held in

remoteandcloudstorageisstillrequiredtobeprotectedinlinewiththeDataProtectionAct.The

schoolwillensurethatitissatisfiedwithcontrolsputinplacebyremote/cloudbaseddataservices

providerstoprotectthedata.

FurtherinformationontheICOGuidance:

http://www.ico.org.uk/for_organisations/guidance_index/~/media/documents/library/Data_Protect

ion/Practical_application/cloud_computing_guidance_for_organisations.ashx

AsaDataController,theschoolisresponsibleforthesecurityofanydatapassedtoa“thirdparty”.

DataProtectionclauseswillbeincludedinallcontractswheredatais likelytobepassedtoathird

party.

All paper based Protected and Restricted (or higher) material must be held in lockable storage,

whetheronoroffsite.

The school recognises that under Section 7 of the DPA,

http://www.legislation.gov.uk/ukpga/1998/29/section/7 data subjects have a number of rights in

connectionwiththeirpersonaldata,themainonebeingtherightofaccess.Proceduresareinplace

todealwithSubjectAccessRequests i.e.awrittenrequesttoseeallorapartofthepersonaldata

held by the data controller in connection with the data subject. Data subjects have the right to

know:ifthedatacontrollerholdspersonaldataaboutthem;adescriptionofthatdata;thepurpose

forwhichthedataisprocessed;thesourcesofthatdata;towhomthedatamaybedisclosed;anda

copyofallthepersonaldatathatisheldaboutthem.Undercertaincircumstancesthedatasubject

can also exercise rights in connection with the rectification; blocking; erasure and destruction of

data.

SecuretransferofdataandaccessoutofschoolTheschoolrecognisesthatpersonaldatamaybeaccessedbyusersoutofschool,ortransferredto

theLAorotheragencies.Inthesecircumstances:

• Usersmaynot removeorcopysensitiveor restrictedorprotectedpersonaldata fromthe

school or authorised premiseswithout permission and unless themedia is encrypted and

passwordprotectedandistransportedsecurelyforstorageinasecurelocation

• Usersmusttakeparticularcarethatcomputersorremovabledeviceswhichcontainpersonal

datamustnotbeaccessedbyotherusers(egfamilymembers)whenoutofschool

• Whenrestrictedorprotectedpersonaldataisrequiredbyanauthoriseduserfromoutside

theorganisation’spremises (forexample,byamemberofstaff towork fromtheirhome),

theyshouldpreferablyhavesecureremoteaccesstothemanagement informationsystem

orlearningplatform;

• Ifsecureremoteaccessisnotpossible,usersmustonlyremoveorcopypersonalorsensitive

datafromtheorganisationorauthorisedpremisesifthestoragemedia,portableormobile

deviceisencryptedandistransportedsecurelyforstorageinasecurelocation;

• Users must protect all portable and mobile devices, including media, used to store and

transmitpersonalinformationusingapprovedencryptionsoftware;and

• Particularcareshouldbetakenifdataistakenortransferredtoanothercountry,particularly

outside Europe, and advice should be taken from the local authority (if relevant) in this

event.

DisposalofdataTheschoolwillcomplywiththerequirementsforthesafedestructionofpersonaldatawhenitisno

longerrequired.

Thedisposalofpersonaldata, ineitherpaperorelectronicform,mustbeconductedinawaythat

makes reconstruction highly unlikely. Electronic filesmust be securely overwritten, in accordance

with government guidance and other media must be shredded, incinerated or otherwise

disintegratedfordata.

ADestructionLogshouldbekeptofalldatathatisdisposedof.Thelogshouldincludethedocument

ID,classification,dateofdestruction,methodandauthorisation.

AuditLogging/Reporting/IncidentHandlingIt is goodpractice,as recommended in the“DataHandlingProcedures inGovernment”document

that theactivitiesofdatausers, in respectofelectronicallyheldpersonaldata,willbe loggedand

theselogswillbemonitoredbyresponsibleindividuals.

Theauditlogswillbekepttoprovideevidenceofaccidentalordeliberatedatasecuritybreaches–

includinglossofprotecteddataorbreachesofanacceptableusepolicy,forexample.

The school has a policy for reporting, managing and recovering from information risk incidents,

whichestablishes:

• a“responsibleperson”foreachincident;

• acommunicationsplan,includingescalationprocedures;

• andresultsinaplanofactionforrapidresolution;and

• aplanofactionofnon-recurrenceandfurtherawarenessraising.

All significant data protection incidents must be reported through the SIRO to the Information

Commissioner’sOfficebaseduponthelocalincidenthandlingpolicyandcommunicationplan.

UseoftechnologiesandProtectiveMarkingThefollowingprovidesausefulguide:

Theinformation ThetechnologyNotesonProtectMarkings

(ImpactLevel)

Schoollifeandevents

Schoolterms,holidays,trainingdays,thecurriculum,extra-curricularactivities,events,displaysofpupilswork,lunchtimemenus,extendedservices,parentconsultationevents

Commonpracticeistousepublicallyaccessibletechnologysuchasschoolwebsitesorportal,emailednewsletters,subscriptiontextservices

MostofthisinformationwillfallintotheNOTPROTECTIVELYMARKED(ImpactLevel0)category.

Learningandachievement

Individualpupil/studentacademic,socialandbehaviouralachievements,progresswithlearning,learningbehaviour,howparentscansupporttheirchild’slearning,assessments,attainment,attendance,individualandpersonalisedcurriculumandeducationalneeds.

Typicallyschoolswillmakeinformationavailablebyparentsloggingontoasystemthatprovidesthemwithappropriatelysecureaccess,suchasaLearningPlatformorportal,orbycommunicationtoapersonaldeviceoremailaccountbelongingtotheparent.

MostofthisinformationwillfallintothePROTECT(ImpactLevel2)category.Theremaybestudents/pupilswhosepersonaldatarequiresaRESTRICTEDmarking(ImpactLevel3)orhigher.Forexample,thehomeaddressofachildatrisk.Inthiscase,theschoolmaydecidenottomakethispupil/studentrecordavailableinthisway.

Messagesandalerts

Attendance,behavioural,achievement,sickness,schoolclosure,transportarrangements,andotherinformationthatitmaybeimportanttoinformorcontactaparentaboutassoonaspossible.Thismaybeparticularlyimportantwhenitisnecessarytocontactaparentconcerninginformationthatmaybeconsideredtoosensitivetomakeavailableusingotheronlinemeans.

Emailandtextmessagingarecommonlyusedbyschoolstocontactandkeepparentsinformed.Whereparentsarefrequentlyaccessinginformationonlinethensystemse.g.LearningPlatformsorportals,mightbeusedtoalertparentstoissuesvia“dashboards”ofinformation,orbeusedtoprovidefurtherdetailandcontext.

MostofthisinformationwillfallintothePROTECT(ImpactLevel1)category.However,sinceitisnotpracticaltoencryptemailortextmessagestoparents,schoolsshouldnotsenddetailedpersonallyidentifiableinformation.General,anonymousalertsaboutschoolsclosuresortransportarrangementswouldfallintotheNOTPROTECTIVELYMARKED(ImpactLevel0)category.

43