SlideShare a Scribd company logo
1 of 14
Download to read offline
Data Protection and Freedom
of Information in schools

Keeping data secure, safe and legal
Why?
Data Protection Act 1998
Freedom of Information (FoI) Act 2000
The Data Protection Act 1998
• The Data Protection Act 1998 came into force in March
2001, replacing the Data Protection Act 1984.
• The EU Data Protection Directive (also known as Directive
95/46/EC) is a directive adopted by the European Union
designed to protect the privacy and protection of all
personal data collected for or about citizens of the EU,
especially as it relates to processing, using, or exchanging
such data.
• The Data Protection Act is how the UK implements the
European Directive.
The aims of the Data Protection Act
• Anyone who processes personal information must comply
with the eight principles
• It provides individuals with important rights, including the
right to find out what personal information is held about
them
The eight data protection principles
Information must be:
• Fairly and lawfully processed
• Processed for specified purposes
• Adequate, relevant and not excessive
• Accurate and up-to-date
• Not kept for longer than is necessary
• Processed in line with individuals’ rights
• Secure
• Not transferred outline the European Economic Area without
adequate protection
Individual rights
• Right of access – individuals have a right to know what
information organisations hold about them on a computer or
in certain filing systems.
• Individuals can submit a Subject Access Request to see or
have a copy of this information.
Freedom of Information Act 2000
• An Act to make provision for the disclosure of information
held by public authorities or by persons providing services
for them and to amend the Data Protection Act 1998 and
the Public Records Act 1958; and for connected purposes
Right of access
•What? Anything
•Who? Anybody
•Where from? Anywhere
•Why? None of your business
•FoIA assumes information will be disclosed
Exemptions
7 Absolute Exemptions
•S21
•S23
•S32
•S34
•S40
•S41
•S44

Information accessible by other means;
National security;
Court records;
Parliamentary privilege;
Personal information about the applicant;
Information provided in confidence;
Prohibition on disclosure
Exemptions
15 Qualified Exemptions
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•

S22
S24
S26
S27
S28
S29
S30
S31
S36
S37
S38
S39
S40
S42
S43

Future publication;
National security;
Defence or armed forces;
International relations;
Relations within the UK
The economy of the UK;
Investigations/proceedings;
Law enforcement;
Effective conduct of public affairs;
Communications with Her Majesty
Health & safety;
Environmental information;
Personal information about third party;
Legal professional privilege;
Commercial interests
School specifics
• Impact levels
• Encryption
• Questions and examples
Impact levels
Example data types
Impact Level
IL4 Confidential

IL3 Restricted
or
NHS
Confidential

IL2 Protect

IL1/ IL0

eGIF requirements

Aggregated reports

Registration
level

Authentication
requirements

•
•
•
•

Level Three ID
verification with
vetting and
'need to know'
measures

Physical/ personal/
procedural
protection with
appropriate
authorisation

• School MIS
• Teacher access to
learning platform/ portals
• Special educational
needs (with no IL 4 data
elements)
• Pupil characteristic
• Contact point
• Health records
• General student data
• Learning platforms/
portals

Level Two ID
vetting and
'need to know'
measures
IAO approval

Mandatory twofactor user ID,
password and
token
Internet/virtual
private network
(VPN) and token

Level One
basic ID
verification

User ID and
password

• Google search
• BBC News

Anonymous

Authentication not
required

National Pupil Database
Looked-after children
Witness protection
SEN IL4 data elements

Example
networks

External access
Gov PC
Internet
to www
café

PDA

Home Gov
PC LAN
Bootable
USB

Wi-fi

3G card

Bluetooth

Y1

N

N

Y2

N

N

N

Y3

N3
GSI
GCSx
CJX

Y

N

Y4

Y5

Encrypted
internet
VPN

Y6

Y7

N

Y8

Y1

N

Y

Y

Y

Y

Y2

Y

Y

Y

GSi
CJX

Internet

Any
Data encryption
Becta guidance states
“Users may not copy or remove sensitive or personal data
from the school or authorised premises unless the media is
encrypted and is transported securely for storage in a secure
location”
What does that mean to us?
•Change in the way USB sticks are used
•Not just USB. Additional encryption when accessing
information across the internet
Data protection-training

More Related Content

What's hot

Keeping Information Safe: Privacy and Security Issues
Keeping Information Safe: Privacy and Security IssuesKeeping Information Safe: Privacy and Security Issues
Keeping Information Safe: Privacy and Security Issuesipspat
 
Introduction to the municipal freedom of information and protection of privac...
Introduction to the municipal freedom of information and protection of privac...Introduction to the municipal freedom of information and protection of privac...
Introduction to the municipal freedom of information and protection of privac...Guinsly Mondesir
 
Introduction to GDPR
Introduction to GDPRIntroduction to GDPR
Introduction to GDPRMartyn Ripley
 
Mitigation starts now
Mitigation starts nowMitigation starts now
Mitigation starts nowJisc
 
Database design dpa 1998
Database design   dpa 1998Database design   dpa 1998
Database design dpa 1998SabahtHussein
 
Concepts and Rights About Data Privacy and Security
Concepts and Rights About Data Privacy and SecurityConcepts and Rights About Data Privacy and Security
Concepts and Rights About Data Privacy and SecurityMaven Logix
 
LOPD - Spanish ethical and legal issues in the context of an international IC...
LOPD - Spanish ethical and legal issues in the context of an international IC...LOPD - Spanish ethical and legal issues in the context of an international IC...
LOPD - Spanish ethical and legal issues in the context of an international IC...Natalia Monllor
 

What's hot (8)

Keeping Information Safe: Privacy and Security Issues
Keeping Information Safe: Privacy and Security IssuesKeeping Information Safe: Privacy and Security Issues
Keeping Information Safe: Privacy and Security Issues
 
Introduction to the municipal freedom of information and protection of privac...
Introduction to the municipal freedom of information and protection of privac...Introduction to the municipal freedom of information and protection of privac...
Introduction to the municipal freedom of information and protection of privac...
 
Introduction to GDPR
Introduction to GDPRIntroduction to GDPR
Introduction to GDPR
 
DHR GDPR Overview
DHR GDPR OverviewDHR GDPR Overview
DHR GDPR Overview
 
Mitigation starts now
Mitigation starts nowMitigation starts now
Mitigation starts now
 
Database design dpa 1998
Database design   dpa 1998Database design   dpa 1998
Database design dpa 1998
 
Concepts and Rights About Data Privacy and Security
Concepts and Rights About Data Privacy and SecurityConcepts and Rights About Data Privacy and Security
Concepts and Rights About Data Privacy and Security
 
LOPD - Spanish ethical and legal issues in the context of an international IC...
LOPD - Spanish ethical and legal issues in the context of an international IC...LOPD - Spanish ethical and legal issues in the context of an international IC...
LOPD - Spanish ethical and legal issues in the context of an international IC...
 

Similar to Data protection-training

Worldwide Laws Privacy Presentation 2006
Worldwide Laws Privacy Presentation 2006Worldwide Laws Privacy Presentation 2006
Worldwide Laws Privacy Presentation 2006Kimberly Verska
 
Anne Cameron - An Introduction to the Data Protection Act for Researchers
Anne Cameron - An Introduction to the Data Protection Act for ResearchersAnne Cameron - An Introduction to the Data Protection Act for Researchers
Anne Cameron - An Introduction to the Data Protection Act for Researcherskclcompbio
 
Overview of the_data_protection-act
Overview of the_data_protection-actOverview of the_data_protection-act
Overview of the_data_protection-actRodamaeLBaccay
 
The EU Data Protection Reform's Impact on Cross Border e-Discovery: new Devel...
The EU Data Protection Reform's Impact on Cross Border e-Discovery: new Devel...The EU Data Protection Reform's Impact on Cross Border e-Discovery: new Devel...
The EU Data Protection Reform's Impact on Cross Border e-Discovery: new Devel...AltheimPrivacy
 
ethcpp04-Unit 3.ppt
ethcpp04-Unit 3.pptethcpp04-Unit 3.ppt
ethcpp04-Unit 3.pptAnil Yadav
 
Data Protection (Download for slideshow)
Data Protection (Download for slideshow)Data Protection (Download for slideshow)
Data Protection (Download for slideshow)Andrew Sharpe
 
The EU Data Protection Reform's Impact on Cross Border E-discovery; updated h...
The EU Data Protection Reform's Impact on Cross Border E-discovery; updated h...The EU Data Protection Reform's Impact on Cross Border E-discovery; updated h...
The EU Data Protection Reform's Impact on Cross Border E-discovery; updated h...AltheimPrivacy
 
3e - Data Protection
3e - Data Protection3e - Data Protection
3e - Data ProtectionMISY
 
Data Protection & Risk Management
Data Protection & Risk Management Data Protection & Risk Management
Data Protection & Risk Management Endcode_org
 
Safety And Security Of Data 4
Safety And Security Of Data 4Safety And Security Of Data 4
Safety And Security Of Data 4Wynthorpe
 
ethcpp04-Unit 3.ppt
ethcpp04-Unit 3.pptethcpp04-Unit 3.ppt
ethcpp04-Unit 3.pptAnil Yadav
 
What does the GDPR mean for charity communicators? | Scotland Networking Grou...
What does the GDPR mean for charity communicators? | Scotland Networking Grou...What does the GDPR mean for charity communicators? | Scotland Networking Grou...
What does the GDPR mean for charity communicators? | Scotland Networking Grou...CharityComms
 
Ico sme-webinar-slides-090217
Ico sme-webinar-slides-090217Ico sme-webinar-slides-090217
Ico sme-webinar-slides-090217Tony Dowling
 
Browne Jacobson - Administrative and public law - October 2017
Browne Jacobson - Administrative and public law - October 2017Browne Jacobson - Administrative and public law - October 2017
Browne Jacobson - Administrative and public law - October 2017Browne Jacobson LLP
 
GDPR webinar presentation | LawBite
GDPR webinar presentation | LawBiteGDPR webinar presentation | LawBite
GDPR webinar presentation | LawBiteClive Rich
 
Niall Rooney FD Event 05.09.19
Niall Rooney FD Event 05.09.19Niall Rooney FD Event 05.09.19
Niall Rooney FD Event 05.09.19Niall Rooney
 

Similar to Data protection-training (20)

Worldwide Laws Privacy Presentation 2006
Worldwide Laws Privacy Presentation 2006Worldwide Laws Privacy Presentation 2006
Worldwide Laws Privacy Presentation 2006
 
Legal update
Legal updateLegal update
Legal update
 
Gary Davis
Gary DavisGary Davis
Gary Davis
 
Anne Cameron - An Introduction to the Data Protection Act for Researchers
Anne Cameron - An Introduction to the Data Protection Act for ResearchersAnne Cameron - An Introduction to the Data Protection Act for Researchers
Anne Cameron - An Introduction to the Data Protection Act for Researchers
 
Overview of the_data_protection-act
Overview of the_data_protection-actOverview of the_data_protection-act
Overview of the_data_protection-act
 
The EU Data Protection Reform's Impact on Cross Border e-Discovery: new Devel...
The EU Data Protection Reform's Impact on Cross Border e-Discovery: new Devel...The EU Data Protection Reform's Impact on Cross Border e-Discovery: new Devel...
The EU Data Protection Reform's Impact on Cross Border e-Discovery: new Devel...
 
Privacy in simple
Privacy in simplePrivacy in simple
Privacy in simple
 
ethcpp04-Unit 3.ppt
ethcpp04-Unit 3.pptethcpp04-Unit 3.ppt
ethcpp04-Unit 3.ppt
 
Data Protection (Download for slideshow)
Data Protection (Download for slideshow)Data Protection (Download for slideshow)
Data Protection (Download for slideshow)
 
The EU Data Protection Reform's Impact on Cross Border E-discovery; updated h...
The EU Data Protection Reform's Impact on Cross Border E-discovery; updated h...The EU Data Protection Reform's Impact on Cross Border E-discovery; updated h...
The EU Data Protection Reform's Impact on Cross Border E-discovery; updated h...
 
3e - Data Protection
3e - Data Protection3e - Data Protection
3e - Data Protection
 
Data Protection & Risk Management
Data Protection & Risk Management Data Protection & Risk Management
Data Protection & Risk Management
 
Safety And Security Of Data 4
Safety And Security Of Data 4Safety And Security Of Data 4
Safety And Security Of Data 4
 
ethcpp04-Unit 3.ppt
ethcpp04-Unit 3.pptethcpp04-Unit 3.ppt
ethcpp04-Unit 3.ppt
 
What does the GDPR mean for charity communicators? | Scotland Networking Grou...
What does the GDPR mean for charity communicators? | Scotland Networking Grou...What does the GDPR mean for charity communicators? | Scotland Networking Grou...
What does the GDPR mean for charity communicators? | Scotland Networking Grou...
 
Ico sme-webinar-slides-090217
Ico sme-webinar-slides-090217Ico sme-webinar-slides-090217
Ico sme-webinar-slides-090217
 
Browne Jacobson - Administrative and public law - October 2017
Browne Jacobson - Administrative and public law - October 2017Browne Jacobson - Administrative and public law - October 2017
Browne Jacobson - Administrative and public law - October 2017
 
EU Trade Secrets Directive & Data Protection Changes
EU Trade Secrets Directive & Data Protection ChangesEU Trade Secrets Directive & Data Protection Changes
EU Trade Secrets Directive & Data Protection Changes
 
GDPR webinar presentation | LawBite
GDPR webinar presentation | LawBiteGDPR webinar presentation | LawBite
GDPR webinar presentation | LawBite
 
Niall Rooney FD Event 05.09.19
Niall Rooney FD Event 05.09.19Niall Rooney FD Event 05.09.19
Niall Rooney FD Event 05.09.19
 

Recently uploaded

QCon London: Mastering long-running processes in modern architectures
QCon London: Mastering long-running processes in modern architecturesQCon London: Mastering long-running processes in modern architectures
QCon London: Mastering long-running processes in modern architecturesBernd Ruecker
 
Tampa BSides - The No BS SOC (slides from April 6, 2024 talk)
Tampa BSides - The No BS SOC (slides from April 6, 2024 talk)Tampa BSides - The No BS SOC (slides from April 6, 2024 talk)
Tampa BSides - The No BS SOC (slides from April 6, 2024 talk)Mark Simos
 
A Glance At The Java Performance Toolbox
A Glance At The Java Performance ToolboxA Glance At The Java Performance Toolbox
A Glance At The Java Performance ToolboxAna-Maria Mihalceanu
 
Bridging Between CAD & GIS: 6 Ways to Automate Your Data Integration
Bridging Between CAD & GIS:  6 Ways to Automate Your Data IntegrationBridging Between CAD & GIS:  6 Ways to Automate Your Data Integration
Bridging Between CAD & GIS: 6 Ways to Automate Your Data Integrationmarketing932765
 
React Native vs Ionic - The Best Mobile App Framework
React Native vs Ionic - The Best Mobile App FrameworkReact Native vs Ionic - The Best Mobile App Framework
React Native vs Ionic - The Best Mobile App FrameworkPixlogix Infotech
 
Why device, WIFI, and ISP insights are crucial to supporting remote Microsoft...
Why device, WIFI, and ISP insights are crucial to supporting remote Microsoft...Why device, WIFI, and ISP insights are crucial to supporting remote Microsoft...
Why device, WIFI, and ISP insights are crucial to supporting remote Microsoft...panagenda
 
Transcript: New from BookNet Canada for 2024: BNC SalesData and LibraryData -...
Transcript: New from BookNet Canada for 2024: BNC SalesData and LibraryData -...Transcript: New from BookNet Canada for 2024: BNC SalesData and LibraryData -...
Transcript: New from BookNet Canada for 2024: BNC SalesData and LibraryData -...BookNet Canada
 
Microsoft 365 Copilot: How to boost your productivity with AI – Part one: Ado...
Microsoft 365 Copilot: How to boost your productivity with AI – Part one: Ado...Microsoft 365 Copilot: How to boost your productivity with AI – Part one: Ado...
Microsoft 365 Copilot: How to boost your productivity with AI – Part one: Ado...Nikki Chapple
 
Email Marketing Automation for Bonterra Impact Management (fka Social Solutio...
Email Marketing Automation for Bonterra Impact Management (fka Social Solutio...Email Marketing Automation for Bonterra Impact Management (fka Social Solutio...
Email Marketing Automation for Bonterra Impact Management (fka Social Solutio...Jeffrey Haguewood
 
[Webinar] SpiraTest - Setting New Standards in Quality Assurance
[Webinar] SpiraTest - Setting New Standards in Quality Assurance[Webinar] SpiraTest - Setting New Standards in Quality Assurance
[Webinar] SpiraTest - Setting New Standards in Quality AssuranceInflectra
 
Manual 508 Accessibility Compliance Audit
Manual 508 Accessibility Compliance AuditManual 508 Accessibility Compliance Audit
Manual 508 Accessibility Compliance AuditSkynet Technologies
 
So einfach geht modernes Roaming fuer Notes und Nomad.pdf
So einfach geht modernes Roaming fuer Notes und Nomad.pdfSo einfach geht modernes Roaming fuer Notes und Nomad.pdf
So einfach geht modernes Roaming fuer Notes und Nomad.pdfpanagenda
 
2024 April Patch Tuesday
2024 April Patch Tuesday2024 April Patch Tuesday
2024 April Patch TuesdayIvanti
 
MuleSoft Online Meetup Group - B2B Crash Course: Release SparkNotes
MuleSoft Online Meetup Group - B2B Crash Course: Release SparkNotesMuleSoft Online Meetup Group - B2B Crash Course: Release SparkNotes
MuleSoft Online Meetup Group - B2B Crash Course: Release SparkNotesManik S Magar
 
Modern Roaming for Notes and Nomad – Cheaper Faster Better Stronger
Modern Roaming for Notes and Nomad – Cheaper Faster Better StrongerModern Roaming for Notes and Nomad – Cheaper Faster Better Stronger
Modern Roaming for Notes and Nomad – Cheaper Faster Better Strongerpanagenda
 
Arizona Broadband Policy Past, Present, and Future Presentation 3/25/24
Arizona Broadband Policy Past, Present, and Future Presentation 3/25/24Arizona Broadband Policy Past, Present, and Future Presentation 3/25/24
Arizona Broadband Policy Past, Present, and Future Presentation 3/25/24Mark Goldstein
 
Abdul Kader Baba- Managing Cybersecurity Risks and Compliance Requirements i...
Abdul Kader Baba- Managing Cybersecurity Risks  and Compliance Requirements i...Abdul Kader Baba- Managing Cybersecurity Risks  and Compliance Requirements i...
Abdul Kader Baba- Managing Cybersecurity Risks and Compliance Requirements i...itnewsafrica
 
A Framework for Development in the AI Age
A Framework for Development in the AI AgeA Framework for Development in the AI Age
A Framework for Development in the AI AgeCprime
 
Connecting the Dots for Information Discovery.pdf
Connecting the Dots for Information Discovery.pdfConnecting the Dots for Information Discovery.pdf
Connecting the Dots for Information Discovery.pdfNeo4j
 
UiPath Community: Communication Mining from Zero to Hero
UiPath Community: Communication Mining from Zero to HeroUiPath Community: Communication Mining from Zero to Hero
UiPath Community: Communication Mining from Zero to HeroUiPathCommunity
 

Recently uploaded (20)

QCon London: Mastering long-running processes in modern architectures
QCon London: Mastering long-running processes in modern architecturesQCon London: Mastering long-running processes in modern architectures
QCon London: Mastering long-running processes in modern architectures
 
Tampa BSides - The No BS SOC (slides from April 6, 2024 talk)
Tampa BSides - The No BS SOC (slides from April 6, 2024 talk)Tampa BSides - The No BS SOC (slides from April 6, 2024 talk)
Tampa BSides - The No BS SOC (slides from April 6, 2024 talk)
 
A Glance At The Java Performance Toolbox
A Glance At The Java Performance ToolboxA Glance At The Java Performance Toolbox
A Glance At The Java Performance Toolbox
 
Bridging Between CAD & GIS: 6 Ways to Automate Your Data Integration
Bridging Between CAD & GIS:  6 Ways to Automate Your Data IntegrationBridging Between CAD & GIS:  6 Ways to Automate Your Data Integration
Bridging Between CAD & GIS: 6 Ways to Automate Your Data Integration
 
React Native vs Ionic - The Best Mobile App Framework
React Native vs Ionic - The Best Mobile App FrameworkReact Native vs Ionic - The Best Mobile App Framework
React Native vs Ionic - The Best Mobile App Framework
 
Why device, WIFI, and ISP insights are crucial to supporting remote Microsoft...
Why device, WIFI, and ISP insights are crucial to supporting remote Microsoft...Why device, WIFI, and ISP insights are crucial to supporting remote Microsoft...
Why device, WIFI, and ISP insights are crucial to supporting remote Microsoft...
 
Transcript: New from BookNet Canada for 2024: BNC SalesData and LibraryData -...
Transcript: New from BookNet Canada for 2024: BNC SalesData and LibraryData -...Transcript: New from BookNet Canada for 2024: BNC SalesData and LibraryData -...
Transcript: New from BookNet Canada for 2024: BNC SalesData and LibraryData -...
 
Microsoft 365 Copilot: How to boost your productivity with AI – Part one: Ado...
Microsoft 365 Copilot: How to boost your productivity with AI – Part one: Ado...Microsoft 365 Copilot: How to boost your productivity with AI – Part one: Ado...
Microsoft 365 Copilot: How to boost your productivity with AI – Part one: Ado...
 
Email Marketing Automation for Bonterra Impact Management (fka Social Solutio...
Email Marketing Automation for Bonterra Impact Management (fka Social Solutio...Email Marketing Automation for Bonterra Impact Management (fka Social Solutio...
Email Marketing Automation for Bonterra Impact Management (fka Social Solutio...
 
[Webinar] SpiraTest - Setting New Standards in Quality Assurance
[Webinar] SpiraTest - Setting New Standards in Quality Assurance[Webinar] SpiraTest - Setting New Standards in Quality Assurance
[Webinar] SpiraTest - Setting New Standards in Quality Assurance
 
Manual 508 Accessibility Compliance Audit
Manual 508 Accessibility Compliance AuditManual 508 Accessibility Compliance Audit
Manual 508 Accessibility Compliance Audit
 
So einfach geht modernes Roaming fuer Notes und Nomad.pdf
So einfach geht modernes Roaming fuer Notes und Nomad.pdfSo einfach geht modernes Roaming fuer Notes und Nomad.pdf
So einfach geht modernes Roaming fuer Notes und Nomad.pdf
 
2024 April Patch Tuesday
2024 April Patch Tuesday2024 April Patch Tuesday
2024 April Patch Tuesday
 
MuleSoft Online Meetup Group - B2B Crash Course: Release SparkNotes
MuleSoft Online Meetup Group - B2B Crash Course: Release SparkNotesMuleSoft Online Meetup Group - B2B Crash Course: Release SparkNotes
MuleSoft Online Meetup Group - B2B Crash Course: Release SparkNotes
 
Modern Roaming for Notes and Nomad – Cheaper Faster Better Stronger
Modern Roaming for Notes and Nomad – Cheaper Faster Better StrongerModern Roaming for Notes and Nomad – Cheaper Faster Better Stronger
Modern Roaming for Notes and Nomad – Cheaper Faster Better Stronger
 
Arizona Broadband Policy Past, Present, and Future Presentation 3/25/24
Arizona Broadband Policy Past, Present, and Future Presentation 3/25/24Arizona Broadband Policy Past, Present, and Future Presentation 3/25/24
Arizona Broadband Policy Past, Present, and Future Presentation 3/25/24
 
Abdul Kader Baba- Managing Cybersecurity Risks and Compliance Requirements i...
Abdul Kader Baba- Managing Cybersecurity Risks  and Compliance Requirements i...Abdul Kader Baba- Managing Cybersecurity Risks  and Compliance Requirements i...
Abdul Kader Baba- Managing Cybersecurity Risks and Compliance Requirements i...
 
A Framework for Development in the AI Age
A Framework for Development in the AI AgeA Framework for Development in the AI Age
A Framework for Development in the AI Age
 
Connecting the Dots for Information Discovery.pdf
Connecting the Dots for Information Discovery.pdfConnecting the Dots for Information Discovery.pdf
Connecting the Dots for Information Discovery.pdf
 
UiPath Community: Communication Mining from Zero to Hero
UiPath Community: Communication Mining from Zero to HeroUiPath Community: Communication Mining from Zero to Hero
UiPath Community: Communication Mining from Zero to Hero
 

Data protection-training

  • 1. Data Protection and Freedom of Information in schools Keeping data secure, safe and legal
  • 2. Why? Data Protection Act 1998 Freedom of Information (FoI) Act 2000
  • 3. The Data Protection Act 1998 • The Data Protection Act 1998 came into force in March 2001, replacing the Data Protection Act 1984. • The EU Data Protection Directive (also known as Directive 95/46/EC) is a directive adopted by the European Union designed to protect the privacy and protection of all personal data collected for or about citizens of the EU, especially as it relates to processing, using, or exchanging such data. • The Data Protection Act is how the UK implements the European Directive.
  • 4. The aims of the Data Protection Act • Anyone who processes personal information must comply with the eight principles • It provides individuals with important rights, including the right to find out what personal information is held about them
  • 5. The eight data protection principles Information must be: • Fairly and lawfully processed • Processed for specified purposes • Adequate, relevant and not excessive • Accurate and up-to-date • Not kept for longer than is necessary • Processed in line with individuals’ rights • Secure • Not transferred outline the European Economic Area without adequate protection
  • 6. Individual rights • Right of access – individuals have a right to know what information organisations hold about them on a computer or in certain filing systems. • Individuals can submit a Subject Access Request to see or have a copy of this information.
  • 7. Freedom of Information Act 2000 • An Act to make provision for the disclosure of information held by public authorities or by persons providing services for them and to amend the Data Protection Act 1998 and the Public Records Act 1958; and for connected purposes
  • 8. Right of access •What? Anything •Who? Anybody •Where from? Anywhere •Why? None of your business •FoIA assumes information will be disclosed
  • 9. Exemptions 7 Absolute Exemptions •S21 •S23 •S32 •S34 •S40 •S41 •S44 Information accessible by other means; National security; Court records; Parliamentary privilege; Personal information about the applicant; Information provided in confidence; Prohibition on disclosure
  • 10. Exemptions 15 Qualified Exemptions • • • • • • • • • • • • • • • S22 S24 S26 S27 S28 S29 S30 S31 S36 S37 S38 S39 S40 S42 S43 Future publication; National security; Defence or armed forces; International relations; Relations within the UK The economy of the UK; Investigations/proceedings; Law enforcement; Effective conduct of public affairs; Communications with Her Majesty Health & safety; Environmental information; Personal information about third party; Legal professional privilege; Commercial interests
  • 11. School specifics • Impact levels • Encryption • Questions and examples
  • 12. Impact levels Example data types Impact Level IL4 Confidential IL3 Restricted or NHS Confidential IL2 Protect IL1/ IL0 eGIF requirements Aggregated reports Registration level Authentication requirements • • • • Level Three ID verification with vetting and 'need to know' measures Physical/ personal/ procedural protection with appropriate authorisation • School MIS • Teacher access to learning platform/ portals • Special educational needs (with no IL 4 data elements) • Pupil characteristic • Contact point • Health records • General student data • Learning platforms/ portals Level Two ID vetting and 'need to know' measures IAO approval Mandatory twofactor user ID, password and token Internet/virtual private network (VPN) and token Level One basic ID verification User ID and password • Google search • BBC News Anonymous Authentication not required National Pupil Database Looked-after children Witness protection SEN IL4 data elements Example networks External access Gov PC Internet to www café PDA Home Gov PC LAN Bootable USB Wi-fi 3G card Bluetooth Y1 N N Y2 N N N Y3 N3 GSI GCSx CJX Y N Y4 Y5 Encrypted internet VPN Y6 Y7 N Y8 Y1 N Y Y Y Y Y2 Y Y Y GSi CJX Internet Any
  • 13. Data encryption Becta guidance states “Users may not copy or remove sensitive or personal data from the school or authorised premises unless the media is encrypted and is transported securely for storage in a secure location” What does that mean to us? •Change in the way USB sticks are used •Not just USB. Additional encryption when accessing information across the internet