Further data protection considerations during Covid-19

Please note: the information contained in this legal update is correct as of the original date of publication.

As the current situation around Covid-19 is evolving and new measures are constantly being implemented by Government, we considered that a summary of considerations for education settings would be of assistance.

1. Education provision during lockdown

It would be timely to remind staff about the requirement to comply with data security and school policies in respect of the same. A link to our previous article on staff working from home can be found here.

As education is to be provided remotely to children, schools have been become more innovative in how lessons are being delivered. This has included live lessons over video platforms such as Zoom or Teams. As a school, you should ensure that the platform used for the delivery of such lessons over the internet is appropriate and safe, and consider the terms and conditions of the same. There have been reported incidents of certain platforms being targeted during delivery of lessons or meetings, and staff should be alert to who is in attendance at such meetings or live class sessions. Schools can consider sending parents and children and staff updated suitable use of IT contracts or policies setting out advice on using such platforms, to include items such as ensuring participants are suitably dressed, participating from a suitable location with limited personal items and limited third parties being visible on screen, and guidelines as to suitable conduct, etc.

Where schools consider it necessary to record such sessions, participants should be advised about the lawful basis on which the school is relying to make the recording. If the school cannot rely on any ground other than consent, this should be appropriately sought in line with data protection requirements.

Further, if recordings are to be made or are permitted then clear information should be provided at the outset that this is the case, as well as the reason for the recording, how it will be stored and the retention period for the same. Some schools have enquired concerning the rights in recordings of live lessons where a staff member is delivering teaching and may wish to use the recording on a different platform at a later date, such as YouTube. Whatever is to be done to the recording, where it will be shared and who will have the full rights to the same should be clarified at the outset.

2. Data sharing for the purpose of Covid-19 testing

Prior to the latest lockdown, the Government was seeking to promote the testing of children at secondary schools on a mass level. This had been trialled in Liverpool and the surrounding areas. Draft documentation has been provided by the Department for Education in respect of obtaining consent for testing. However, schools should ensure that they have the necessary consents for sharing data with any third-party agencies where required. Ultimately, as data controllers, it is for the trust and schools to ensure, where they are sharing data, that they comply with the requirements of the Data Protection Act. Where data is being shared or retained, Privacy Notices should be updated to reflect this. Additional information about updating Privacy Notices in this respect can be found here.

Similarly, a number of local authorities have been asking for increased data from schools, especially in respect of any reporting of positive cases. In particular instances, personal information, e.g. names, are being requested. Before sharing any personal data, schools and trusts should consider the extent of the data which can be shared in accordance with any relevant legal requirements or basis for sharing the same.

3. Personal data in respect of examinations in the event that exams do not proceed

Given the further lockdown, an indication has been given without further detail that exams may be cancelled again this year. Schools faced a number of challenges during the last release of examination results in the form of SARs, complaints and appeals. Steps can be taken now to prepare for the system which will be put in place for grading students this year by ensuring appropriate record keeping is undertaken, systems are put in place to deal with increased requests for personal data, and that these systems are shared with staff.

4. Ensuring policies and procedures have been updated

Schools should ensure that they have reviewed their policy and procedures to ensure that any changes to processes as a result of Covid-19 and restrictions relating to Covid-19 are included. This may include:

• adding details of any additional processing that is undertaken in your Privacy Notices
• amending your Retention and Destruction Policy to include the retention if any recordings for remote learning
• setting out procedures for live remote lessons
• updating the use of technology policies, etc.

If you would like any further advice on the above matters, please contact Daljit Kaur on 0330 045 2281 or by email at daljit.kaur@brownejacobson.com.