I'm Iain Bradley, head of Data Modernisation Division in the Department
for Education. This short film is intended to help schools with their own
preparations for GDPR. General Data Protection Regulation replaces the Data
Protection Act. Much of it is similar in that it covers the safe processing and
usage of personal data. There is a stronger focus on demonstrating
compliance with the regulation though and GDPR also has special categories
of personal data things like ethnicity and religion many of which we use within
the education sector so we need to be really careful about how we use and
process that personal level data. So the personal data ecosystem is a term we use
for understanding where you store personal data and in particular how
those systems might interlink. Within education there's loads of different
types of systems where this might be. Within the ecosystem you've got your
core management information system, you've got curriculum tools, you've got
payment systems and you've got virtual learning environments, which is one set
of systems that people will be quite familiar with, particularly senior
leaders, but you've also got things like catering management, safeguarding,
communication tools that you might use for parent communications, the school
transport and school trips, you've also got to think about where you might store
data within school uniform systems and school photographs, things like that.
Schools might also use identity management systems or things that
contain biometric data, which are a key part of the the new regulation, but
also think about where your office documents are stored and your core IT
infrastructure. Finally when trying to create that ecosystem think about where
you actually send data to and so that might be interactions with health or
social care, it might be sending data up to a multi-academy trust or the
local authority or it might be sending data to the Department itself. And
finally, that all covers personal data about pupils and potentially parents but
also think about your workforce. So there's three things to think of - people
who apply for jobs and what data you hold about people who've applied for
jobs, your current employees who are working with you at present, and people
who perhaps left the organization as well. You have personal data about all of
those people, probably, and that all needs to be in scope. In order to map your
ecosystem, start with those headings we've
just described up around the room. Note down every single system or datastore
that might be relevant under those headings. Ideally, you can also draw the
data flows between systems then you've got a really good illustration of your
own data ecosystem. Once you've got that you can then start to focus on the six
key questions that you need to understand about those systems or data
stores in order to be able to demonstrate GDPR compliance.
Scope: which personal and special category data items are contained within that system?
Sharing: does any personal data flow from that system on to anywhere else?
Retention: what is the system's data retention policy? Does it align to the
data retention policies needed to fulfill your duties as a school and is
this clear within your contract with the supplier?
Access: how would you get the information for a subject access request out of that system?
Security: how does the system ensure
security of the personal data held? what recognized standards are in place?
And finally, own readiness: is this system supplier
confident that they will be GDPR compliant by May 2018? How will they
demonstrate that to you? You may know that information already. You may need to
look on the supplier's websites. They might be communicating this to you
directly or you may need to ask them. There are also some commercial or
non-commercial organizations who are starting to aggregate this information
for schools as well. Once you've got that information together you can put it
together into a clearly structured table. In making sure that table is complete,
where are the risks? There's two top tips that schools have been telling me about.
Firstly, check for software that's not on the SLT's radar, for example, subject-specific software.
The key here is to involve all staff in the development and
checking of that ecosystem diagram, and secondly, think again about onward flow
from systems. Do you have any software that sits on an MIS and shares data with
other systems? Do you know what they all are and what data goes where? Do these
systems store data and if so do you know where that is? The data protection
officer needs to be highly knowledgeable about data protection and GDPR.
They need to understand the school's operations and policies. It's their job
to promote a strong culture about protection of data.
They also need to be aware of compliance, obligations, promote the training and
processing and conducting of internal audits. They need to be able to report
directly to the board and conduct data protection impact assessments and
determine when they're necessary. All in all perhaps crucially under GDPR,
the head of IT or the headteacher probably has a slight conflict of
interest in that if they're setting up the ecosystem and assessing it they're kind
of marking their own homework. So, what might some solutions be? You could
realign responsibilities within your current team, creating the DPO role
within your team that is sufficiently removed from those making technology or
processing decisions. You could collaborate - share the DPO function
between a group of schools or share expertise by being the DPO for each
other's school. You could contract - it is possible to buy in the DPO function for
your school or for a group of schools. Finally, seeking volunteers from experts
that may exist in the wider school community is an option. It is possible
but note that as a volunteer their statutory responsibilities remain at the
same expectation as a paid DPO. It would be a reasonably big commitment
for that volunteer and they would need to be able to influence senior managers
decision-making in exactly the same way as a paid DPO. In drawing, understanding
and documenting the data ecosystem as well as exploring the DPO role, we've
started to get the foundations right for GDPR compliance. In our next
communication we'll be talking about how you start to communicate that to parents
and pupils the conditions, that you can rely on for processing within education,
as well as a hot topic that we know about data retention periods.
you