1. Data Protection Guidance for Principals and Deputy Principals Anne Lyne Partner & Breda O’Malley Partner Kilkenny - 3 October 2015

2. . 2 Introduction – what will we be looking at? 1.What is Data Protection? 2.The Data Controller 3.What is Personal Data? 4.Data Processing & Data Lifecycle 5.Why is Data Protection important in schools? 6.Issues that arise 7.www.dataprotectionschools.iewww.dataprotectionschools.ie 8.Impact on other school polices 9.Complaints 10.Data Protection v FOI 11.Workshop - The 8 Rules of Data Protection Data Protection Guidance for Principals & Deputy Principals Breda O'Malley, Partner &Anne Lyne, Partner, Hayes solicitors - Kilkenny 3 October 2015

3. 3 What is data protection? It is about your right to privacy The constitution - Bunreacht na hEireann, recognises and declares that people living in Ireland have certain fundamental personal rights e.g. equality before the law, right to life, freedom of expression There are other rights that are in the constitution but that are not clearly identifiable This includes the right to privacy Data Protection Guidance for Principals & Deputy Principals Breda O'Malley, Partner &Anne Lyne, Partner, Hayes solicitors - Kilkenny 3 October 2015

4. 4 What is data protection? The Oireachtas can also provide for laws that safeguard our rights The Oireachtas and the EU have provided that in addition to our constitutional rights we should have a right to have our private information (personal data) protected when it is being used (processed) by a third party (data controller) Data Protection Acts 1998-2003 - drafted in technical language Data Protection Guidance for Principals & Deputy Principals Breda O'Malley, Partner &Anne Lyne, Partner, Hayes solicitors - Kilkenny 3 October 2015

5. 5 What is data protection? We use terms such as “data controller”, “personal data” and “processing data” To understand what data protection is we need to know the meaning of terms used in the Acts Data Protection Guidance for Principals & Deputy Principals Breda O'Malley, Partner &Anne Lyne, Partner, Hayes solicitors - Kilkenny 3 October 2015

6. 6 In a school the data controller is the Board of Management As principal, given the “day to day management” of the schools rests with you, in reality the practical management of data protection is often your responsibility It is important that as a principal you ask the Board to nominate another board member as the “Data Protection Officer” to assist with data protection management That person should be the contact point in the school so that expertise developed at board level. This needs to be a team effort Who is the Data Controller in a school? Data Protection Guidance for Principals & Deputy Principals Breda O'Malley, Partner &Anne Lyne, Partner, Hayes solicitors - Kilkenny 3 October 2015

7. 7 The definition of “ personal data” is very broad and essentially covers any data from which an individual can be considered “identifiable” What is Personal Data? Data Protection Guidance for Principals & Deputy Principals Breda O'Malley, Partner &Anne Lyne, Partner, Hayes solicitors - Kilkenny 3 October 2015

8. 8 Breda O’Malley Anne Lyne Carol Fawsitt Harry Wall Deirdre O’Kane What is Personal Data? Data Protection Guidance for Principals & Deputy Principals Breda O'Malley, Partner &Anne Lyne, Partner, Hayes solicitors - Kilkenny 3 October 2015

9. 9 Hayes Employment Team Breda O’Malley Anne Lyne Carol Fawsitt Harry Wall Deirdre O’Kane What is Personal Data? Data Protection Guidance for Principals & Deputy Principals Breda O'Malley, Partner &Anne Lyne, Partner, Hayes solicitors - Kilkenny 3 October 2015

10. 10 Anne Lyne Personal Data What is Personal Data? Data Protection Guidance for Principals & Deputy Principals Breda O'Malley, Partner &Anne Lyne, Partner, Hayes solicitors - Kilkenny 3 October 2015

11. 11 In a school examples include: Class lists, school sports day photos Yard duty timetable “private handwritten notes” about a child at the side of an application form Notes from an interview or disciplinary process, text messages or emails Remember all of these can potentially be accessed by the identifiable person under the Acts What is Personal Data? Data Protection Guidance for Principals & Deputy Principals Breda O'Malley, Partner &Anne Lyne, Partner, Hayes solicitors - Kilkenny 3 October 2015

12. 12 DATA PROCESSING LIFECYCLE Processing Data Storing/Altering Retrieving Disclosing Erasing Collecting Data Protection Guidance for Principals & Deputy Principals Breda O'Malley, Partner &Anne Lyne, Partner, Hayes solicitors - Kilkenny 3 October 2015

13. 13 Why is data protection important in schools? Schools hold personal data for a large number of stakeholders: students, staff, Boards of Management, creditors etc. Data is processed everyday While issues relating to data protection may not arise on a day to day basis, they may become very significant in the event of a breach, an employment dispute or litigation. Data Protection Guidance for Principals & Deputy Principals Breda O'Malley, Partner &Anne Lyne, Partner, Hayes solicitors - Kilkenny 3 October 2015

14. 14 When do issues arise A bullying complaint by a teacher Disciplinary procedure An unsuccessful candidate at interview Records stored at home in the garage, under the bed! A missing laptop A parent without custody looking for student records Data Protection Guidance for Principals & Deputy Principals Breda O'Malley, Partner &Anne Lyne, Partner, Hayes solicitors - Kilkenny 3 October 2015

15. 15 Where to start? Dataprotectionschools.ie Gives information on data protection and has a number of sample policies including a data protection policy, data audit checklist, pro-forma data access form Very important that a school has good data protection policy Why? So that you are not making up your response if an issue arises. There is a roadmap in your policy This should be considered a “live” working document and should be updated on a regular basis Scenarios from the workshop today should be considered in light of your policy and amendments made if necessary Data Protection Guidance for Principals & Deputy Principals Breda O'Malley, Partner &Anne Lyne, Partner, Hayes solicitors - Kilkenny 3 October 2015

16. 16 What about complaints Policy should set out that complaints should be made to the school and the complaint is first it is dealt with at a local level There is a right under the Act to complain to the Data Protection Commissioner (DPC) Informal resolution the initial goal of the DPC Prosecution under the Acts is unlikely Data Protection Guidance for Principals & Deputy Principals Breda O'Malley, Partner &Anne Lyne, Partner, Hayes solicitors - Kilkenny 3 October 2015

17. 17 Child protection policy Anti - Bullying policy CCTV Enrolment policy IT policies Website, Facebook, Twitter Consider impact of Data Protection on other school policies Data Protection Guidance for Principals & Deputy Principals Breda O'Malley, Partner &Anne Lyne, Partner, Hayes solicitors - Kilkenny 3 October 2015

18. . 18 Data Protection v Freedom of Information? Firstly, primary schools are exempt from FOI with the exception of ETB schools The Freedom of Information Acts (1997-2014) obliges government departments, the Health Service Executive (HSE), local authorities and a range of other public bodies to publish information on their activities and to make the information they held, including personal information, available to all citizens Obvious conflict with right to privacy given requirement for personal information to be given out Data Protection Guidance for Principals & Deputy Principals Breda O'Malley, Partner &Anne Lyne, Partner, Hayes solicitors - Kilkenny 3 October 2015

19. . 19 Data Protection v Freedom of Information? (cont.) There are however protections for personal privacy in that the Freedom of Information Act 2014 provides the following statutory rights: A legal right for each person to access information held by a body to which FOI legislation applies A legal right for each person to have official information relating to himself/herself amended where it is incomplete, incorrect or misleading A legal right to obtain reasons for decisions affecting himself/herself Data Protection Guidance for Principals & Deputy Principals Breda O'Malley, Partner & Anne Lyne, Partner, Hayes solicitors - Kilkenny 3 October 2015

20. 20 1.Obtain and process information fairly 2.Keep it only for one or more specified, explicit and lawful purposes 3.Use and disclose it only in ways compatible with the purposes for which it was initially given to you 4.Keep it safe and secure 5.Keep it accurate, complete and up to date 6.Ensure that it is adequate, relevant and not excessive 7.Retain it for no longer than is necessary for the purpose or purposes for which it was initially given to you 8.Give a copy of the Personal Data to an individual on request Workshop - The 8 Rules of Data Protection Data Protection Guidance for Principals & Deputy Principals Breda O'Malley, Partner & Anne Lyne, Partner, Hayes solicitors - Kilkenny 3 October 2015

21. Data Protection Guidance for Principals and Deputy Principals www.hayes-solicitors.ie Breda O’Malley bomalley@hayes-solicitors.ie Anne Lyne alyne@hayes-solicitors.ie