This notice intends to explain what information Education needs in order to process information that may be collected, regarding pupils, parents, carers and other individuals. It is necessary for Education to gather, collect, store and process personal information to provide an Education service to all North Ayrshire communities.

All personal information is held and processed by North Ayrshire Council in accordance with the Data Protection law. For information on the role of Data Controller, please refer to the Information Commissioner’s Office.

Personal data is required to be collected by Education in order to carry out its duties as a provider of Education under the Education (Scotland) Act 1980 and the Education (Scotland) Act 2016.

Personal data that we may collect, use, store and share (when appropriate) about pupils includes, but is not restricted to:

• personal identifiers and contacts (such as name, address, data of birth, unique pupil number, contact details and address)
• characteristics (such as gender, ethnicity, language, and free school meal eligibility)
• qualifications / training information
• health attendance information (such as allergies, medication and dietary requirements)
• attendance information (such as number of absences and absence reasons)
• trips and activities undertaken
• catering and free school meal management
• Biometric facial recognition information for school meal management

The lawful bases for processing personal data are set out in Data Protection legislation.

We will rely on different bases for processing data depending on the circumstance. The bases we rely upon for Education are:

1. Contract - the processing is necessary for a contract.
2. Legal Obligation - the processing is necessary for Education to comply with the law.
3. Public task - the processing is necessary to perform a task in the public interest or for official functions, and the task or function has a clear basis in law.
4. Consent - in limited circumstances, for instance relating to taking pictures for promotional purposes, Education may rely on an individual’s consent to process their personal data. Where Education is relying on an individual’s consent to process personal data then individuals have the right to withdraw this consent at any time.

Data Protection legislation defines Special Category Data as data relating to the processing of personal data regarding racial/ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, data concerning health or data concerning a person’s sex life or sexual orientation.

Education will have a requirement to process some types of Special Category Data and in particular:

• racial or ethnic origin information for monitoring purposes
• health information for pupil assistance and absence monitoring
• biometric data used for facial recognition

The lawful basis for processing Special Category Data is:

1. The processing is necessary for reasons of substantial public interest, on the basis of Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject.
2. Consent - in limited circumstances, for instance relating to taking pictures for promotional purposes, Education may rely on an individual’s consent to process their personal data. Where Education is relying on an individual’s consent to process personal data then individuals have the right to withdraw this consent at any time.

Education receive an individual’s personal data from or share an individual’s personal data with:

• the Scottish Government
• Education Scotland
• external contractors
• private nurseries
• Strathclyde Passenger Transport
• Scottish Children’s Reporter Administration
• Social Work Services
• Scottish Public Services Ombudsman
• The (UK) Information Commissioner

Education will also make any disclosures required by law and may share information with other bodies responsible for detecting/preventing fraud or auditing/administering public funds.

Education will only keep an individual’s personal data for as long as necessary. After this time personal data will be securely destroyed.

It is important that we hold accurate and up to date information. If any details have changed, or change in the future, then individuals should ensure that they inform Education as soon as possible so that they can update their records.

Under data protection legislation, individuals have the right to request access to information about them that the Council holds. Further details can be found on our freedom of information and Privacy Policy pages.

Individuals also have the right to:

• object to processing of personal data that is likely to cause, or is causing, damage or distress
• in certain circumstances, have inaccurate personal data rectified, blocked, erased or destroyed

If individuals have a concern about the way Education is collecting or using their personal data, they should raise their concern in the first instance with the Councils’ Data Protection Officer.