Carrigboy National School

Data Privacy Policy

Carrigboy National School

1. Your personal data - what is it?

Personal data relates to a living individual who can be identified from that data. Identification can be by the information alone or in conjunction with any other information in the data controller's possession or likely to come into such possession. The processing of personal data is governed by the General Data Protection Regulation (the "GDPR").

2. Who are we?
Carrigboy National School is the data controller. This means it decides how your personal data is processed and for what purposes.

3. How do we process your personal data?
Carrigboy National School complies with its obligations under the "GDPR" by keeping personal data up to date; by storing and destroying it securely; by not collecting or retaining excessive amounts of data; by protecting personal data from loss, misuse, unauthorised access and disclosure and by ensuring that appropriate technical measures are in place to protect personal data.

Carrigboy National School uses personal data about living individuals for the purpose of general school administration and communication.

Carrigboy National School recognises the importance of the correct and lawful treatment of personal data. All personal data, whether it is held on paper, on computer or other media, will be subject to the appropriate legal safeguards as specified in the General Data Protection Regulation 2017

Carrigboy National School fully endorses and adheres to the eight principles of the GDPR. These principles specify the legal conditions that must be satisfied in relation to obtaining, handling, processing, transportation and storage of personal data. Employees and any others who obtain, handle, process, transport and store personal data for Carrigboy National School must adhere to these principles.

4. The 8 Principles

The principles require that personal data shall:

1. Be processed fairly and lawfully and shall not be processed unless certain conditions are met.
2. Be obtained for a specified and lawful purpose and shall not be processed in any manner incompatible with that purpose.
3. Be adequate, relevant and not excessive for those purposes.
4. Be accurate and, where necessary, kept up to date.
5. Not be kept for longer than is necessary for that purpose.
6. Be processed in accordance with the data subject's rights.
7. Be kept secure from unauthorised or unlawful processing and protected against accidental loss, destruction or damage by using the appropriate technical and organisational measures.
8. Not be transferred to a country or territory outside the European Economic Area, unless that country or territory ensures an adequate level of protection for the rights and freedoms of data subjects in relation to the processing of personal data.








5. What is the legal basis for processing your personal data?

" Explicit consent of the data subject so that we can keep you informed about school news, events, activities and services and process your Art and Craft donations. ??
" Processing is necessary for carrying out obligations under employment, social security or social protection law, or a collective agreement n/a
" Processing is carried out by a not-for-profit body with a political, philosophical, religious or trade union aim provided. ??
o The processing relates only to pupils or former pupils (or those who have regular contact with it in connection with those purposes) ??
o There is no disclosure to a third party without consent ??

6. Sharing your personal data
Your child's personal data will be treated as strictly confidential

7. How long do we keep your personal data?

DATA RETENTION PERIODS FOR SCHOOLS


Pupil Related

Retention Periods
School Register/Roll Books
Enrolment Forms
Disciplinary notes
Test Results - Standardised
Psychological Assessments etc.
SEN Files/IEPS
Accident Reports
Child Protection Reports/Records
S.29 Appeals Indefinitely Hold until Pupil is 25 Years Never Destroy Hold until pupil is 25 Years
Never Destroy
Never Destroy
Never Destroy Never Destroy Never Destroy

Interview Records


Interview Board
Marking Scheme
Board of Management notes (for unsuccessful candidates) 18 months from close of competition plus 6 months in case Equality Tribunal needs to inform school that a claim is being taken

Staff Records

Contract of Employment
Teaching Council Registration
Vetting Records

Accident/Injury at work Reports Retention for duration of employment + 7 years

(6 years to make a claim against the school plus 1 year for proceedings to be served on school)

BoM Records

BOM Agenda and Minutes
CC TV Recordings


Payroll & Taxation


Invoices/receipts

Audited Accounts Indefinitely
28 days normally. In the event of criminal investigation - as long as is necessary

Revenue require a 6-year period after the end of the tax year

Retain for 7 Years

Indefinitely
Why, in certain circumstances, does the Data Protection Commission recommend the holding of records until the former pupil has attained 25 years of age?

The reasoning is that a pupil reaches the age of majority at 18 years and that there should be a 6-year limitation period in which it would be possible to take a claim against a school, plus 1 year for proceedings to be served on a school. The Statute of Limitations imposes a limit on a right of action so that after a prescribed period any action can be time barred.


8. Your rights and your personal data

Unless subject to an exemption under the GDPR, you have the following rights with respect to your personal data;

The right to request a copy of your personal data which Carrigboy National School holds about you
The right to request that Carrigboy National School corrects any personal data if it is found to be inaccurate or out of date
The right to request your personal data is erased where it is no longer necessary for Carrigboy National School to retain such data
The right to withdraw your consent to the processing at any time
The right, where there is a dispute in relation to the accuracy or processing of your personal data, to request a restriction is placed on further processing
The right to request that the data controller provide the data subject with his/her personal data and where possible, to transmit that data directly to another data controller, (known as the right to data portability), (where applicable)
[Only applies where the processing is based on consent or is necessary for the performance of a contract with the data subject and in either case the data controller processes the data by automated means]
The right to object to the processing of personal data, (where applicable)
[Only applies where processing is based on legitimate interests (or the performance of a task in the public interest/exercise of official authority); direct marketing and processing for the purposes of scientific/historical research and statistics]
The right to lodge a complaint with the Data Protection Commissioner (Ireland)






9. Further processing

If we wish to use your personal data for a new purpose, not covered by this Data Privacy Notice, then we will provide you with a new notice. The new notice will explain the new use of your personal data prior to commencing the processing. It will set out the relevant purposes and processing conditions. Where and whenever necessary, we will seek your prior consent to the new processing.

10. Maintaining Confidentiality

Carrigboy National School will treat all your personal information as private and confidential and will not disclose any data about you to anyone other than those engaged in the administration and day-to-day ministry of the parish.

There are four exceptional circumstances to the above permitted by law:

a. Where we are legally compelled to do so.
b. Where there is a duty to the public to disclose.
c. Where disclosure is required to protect your interest.
d. Where disclosure is made at your request or with your consent.

11. Use of Personal Information

Carrigboy National School will use your personal data for the following purposes: -

a. To enable us to run Carrigboy National School as an educational establishment
b. To administer membership/ pupil records;
c. To promote the interests of the school;
d. To maintain our own records
e. To inform you of news, events and activities relating to Carrigboy National School

13. Access to information is strictly controlled and is defined under our Data Protection Policy

14. Rights to Access Information

Parents/ Guardians and pupils Carrigboy National School have the right to access any personal data that is being held. This right is subject to certain exemptions: Personal Information may be withheld if the information relates to another individual.

Any person who wishes to exercise this right should make the request in writing to

The Principal (Data Controller)
Carrigboy National School
Durrus
Bantry
Co. Cork

The Data Protection Commissioner (Ireland)
Canal House
Station Road
Portarlington
Co. Laois
R32 AP23
+353 (0761) 104 800
info@dataprotection.ie

If personal details are inaccurate, they can be amended upon request.

Carrigboy National School aims to comply with requests for access to personal information as quickly as possible, but will ensure that it is provided within 30 days of receipt of a completed form unless there is good reason for delay. In such cases, the reason for delay will be explained in writing to the individual making the request.

This Data Protection Policy was ratified by the Board of Management of Carrigboy National School.





Finbarr O Sullivan, Chairperson.


References:
1. Solas (CPSMA) May-June 2001
2. Education Act 1998
3. Education Welfare Act 2000
4. Data Protection Act 2003
5. Freedom of Information Act 1997
6. Literacy and Numeracy Strategy 2011