The GDPR will have an effect on schools but probably less than might be expected. The reason for this is that schools already have to comply with regulations e.g. safeguarding etc that override the GDPR and provide regulations that will already be in place.
Does the school need to think about GDPR Special Category Data?
What the GDPR does not allow is for data to be collected and for that data to be used for other purpose. For example a school could not ask a childs religion and based on that determine something else like if a child could have blood transfusion in the event of an accident. What the school should be doing is asking specifically if a child is allowed to have a blood transfusion etc. Another common example is where a school believes that it needs to hold the religion of a child to ensure that they provide a correct lunch meal for them. But the reality is that the school does not need to hold the religion (Special Category Data) simply to know about what foods the child cannot eat. The same could be achieved by simply asking what foods the child does not eat which would then not require the school to hold the religious personal data and could be a generic question on an application form when a child joins the school.
What about the age of GDPR Consent in the UK?
Also the schools will have to look carefully at Consent because in the UK this has been changed under the GDPR to be 13 years old so schools will have to get Consent for data held from the child when they reach this age.
Where can I find out more information about how the GDPR will affect schools?
The Jaz'ing Up GDPR! book covers how the GDPR will affect schools in more detail in a fun and easy to understand way without all of the bureaucratic legalise that is common in all other books and discussions about the GDPR.
The book is full of cartoons and call outs to make it easier to grasp what GDPR is all about and is split into 3 main sections.
- GDPR Nuts and Bolts explains everything you need to know about the GDPR and how the GDPR will affect schools.
- Staff Toolbox that is designed for staff who work with personal data and need to get a grounding on the subject.
- Your Rights as a Data Subject is written from the point of view of the individual person who is affected by the GDPR so that they know there rights and the types of things they will be asking for.