Why school data must be “accurate and up-to-date”
Having accurate data is about much more than keeping Ofsted, or the ICO happy when they come to scrutinise or audit your school’s GDPR compliance.
Good quality data will bring a wealth of benefits to your School, including:
- Quick and easy communication with parents
- Help safeguard students will medical or dietary requirements
- Enable the school to reduce its server space requirements
- Improve school office efficiency
In schools, we’d all like to think that the data that we hold on our students and parents is up-to-date and accurate. With GDPR, data accuracy becomes a regulatory requirement therefore, schools will have an explicit requirement to make sure that the records held are the most up-to-date.
UNFORTUNATELY, we all know the reality of the situation, parents don’t tell us when something changes – addresses, phone numbers, emails, family relationships, medical or dietary requirements. That said, schools can no longer hold their hands up and say “they didn’t tell us”, under GDPR schools must to be proactive in checking and updating the information they hold.
As well as holding accurate data for students, parents and staff, schools need to have a regular data purge. Sorting and deleting/shredding any data that is no longer needed, or no longer relevant. Removing obsolete and out of date information means mistakes are reduced, and time saved when looking for a specific piece of information. Schools also need to think about data minimisation, we’ll be covering this in another blog shortly.
However, schools still need to concentrate on making sure that they have correct and accurate data, and need to carefully consider challenging the accuracy of that information. (For example, a student’s file shows they live in Newtown, however the student is seen getting on the bus to Oldtown).
It may be impractical to check the accuracy of personal data someone else provides. In recognition of this, the regulations mandate that a school should accurately record information provided. BUT DO NOT change information without checking the source and accuracy.
As well as accurate factual data, schools often hold comments and opinions from staff on the behaviour or personality of a student. An expression of an opinion about an individual is classed as their personal data. Two people may have very different opinions about the ability or personality of an individual. So, when recording information about an individual, it should be recorded as an opinion, and, where appropriate, whose opinion it is.
Having satisfied themselves that their data is accurate, schools should then consider data suppression i.e. regular removal of any unwanted records, inaccurate data, Opt-out data; REMEMBER under GDPR it will be an Opt-in policy, schools must be mindful of this change when reviewing the data they hold, seeking consent or gathering information.
When sharing data with third parties schools must take steps to protect individual privacy, This means in small data sets no one should be able to identify which student is the data subject.
The implementation of GDPR does seem daunting however schools that have always had good data protection practices have very little to be concerned about – the key is to make sure you are preparing for GDPR whilst you still have time.