TranslateNorth Ayrshire Council is a local authority established under the Local Government etc. (Scotland) Act 1994 and is registered with the Information Commissioner's Office (ICO) as a data controller (registration number Z4840237).
This notice intends to explain what information Education needs in order to process information that may be collected, regarding pupils, parents, carers and other individuals.
It is necessary for Education to gather, collect, store and process personal information to provide an Education service to all North Ayrshire communities.
What information do we need and why?
Personal data is required to be collected by Education to carry out its duties as a provider of Education under the Education (Scotland) Act 1980 and the Education (Scotland) Act 2016.
Personal data that we may collect, use, store and share (when appropriate) about individuals includes, but is not restricted to:
- personal identifiers and contacts (such as name, address, data of birth, unique pupil number, contact details and address)
- characteristics (such as gender, ethnicity, language, and free school meal eligibility)
- qualifications / training information
- health attendance information (such as allergies, medication and dietary requirements)
- attendance information (such as number of absences and absence reasons)
- trips and activities undertaken
- catering and free school meal management
Lawful bases for processing
The lawful bases for processing personal data are set out in Data Protection legislation.
We will rely on different bases for processing data depending on the circumstance. The bases we rely upon for Education are:
- Contract - the processing is necessary for a contract.
- Legal Obligation - the processing is necessary for Education to comply with the law.
- Public task - the processing is necessary to perform a task in the public interest or for official functions, and the task or function has a clear basis in law.
- Consent - in limited circumstances, for instance relating to taking pictures for promotional purposes, Education may rely on an individual’s consent to process their personal data. Where Education is relying on an individual’s consent to process personal data then individuals have the right to withdraw this consent at any time.
- Recognised Legitimate Interest for safeguarding and emergencies.
Special Category Data
Data Protection legislation defines Special Category Data as data relating to the processing of personal data regarding racial/ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, data concerning health or data concerning a person’s sex life or sexual orientation.
Education will have a requirement to process some types of Special Category Data and in particular:
- racial or ethnic origin information for monitoring purposes
- health information for pupil assistance and absence monitoring
The lawful basis for processing Special Category Data is:
- The processing is necessary for reasons of substantial public interest, on the basis of Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject.
- Consent - in limited circumstances, for instance relating to taking pictures for promotional purposes, Education may rely on an individual’s consent to process their personal data. Where Education is relying on an individual’s consent to process personal data then individuals have the right to withdraw this consent at any time.
Who will we share your information with?
Education receives an individual’s personal data from or share an individual’s personal data with:
- the Scottish Government
- Education Scotland
- external contractors
- private nurseries
- Strathclyde Passenger Transport
- Scottish Children’s Reporter Administration
- Social Work Services
- Scottish Public Services Ombudsman
- The (UK) Information Commissioner
Education will also make any disclosures as required by law and may share information with other bodies responsible for detecting/preventing fraud or auditing/administering public funds.
How long do we keep your information?
Data is retained according to Council record retention schedules and securely stored. Breach reporting follows statutory requirements.
Your information rights
Under data protection legislation, individuals have the right to request access to information about them that the Council holds.
Further details can be found on our freedom of information page and privacy policy page.
Individuals also have the right to:
- object to processing of personal data that is likely to cause, or is causing, damage or distress
- in certain circumstances, have inaccurate personal data rectified, or removed
If individuals have a concern about the way Education is collecting or using their personal data, they should raise their concern in the first instance with the Councils’ Data Protection Officer by emailing dataprotection@north-ayrshire.gov.uk.