GETTING TO GRIPS WITH GDPR - HEADS OF SIXTH FORM
I will be feeding in issues relating to GDPR over coming weeks. Here's the first issue on the area of UCAS data. New GDPR legislation comes into effect on 25 May. Anyone who processes personal information under existing legislation must comply with eight principles of the Data Protection Act, which make sure that personal information is:
Fairly and lawfully processed
Processed for limited purposes
Adequate, relevant and not excessive
Accurate and up to date
Not kept for longer than is necessary
Processed in line with your rights
Secure
Not transferred to other countries without adequate protection
The key obvious areas for sixth form leaders are:
- Not kept for longer than is necessary
- Secure
- Fairly and lawfully processed
UCAS applications
Are your paper UCAS forms kept secure?
What do you do with UCAS forms from the previous year? Are the forms securely stored? For how long do you reasonably need to keep the forms? If you are destroying forms with personal data make sure they are shredded or disposed of in a way that others cannot access the data? Have you informed students how long their form will be stored?
UCAS reference writers - are they provided with the entire UCAS form with all the personal data (address, email, sexual orientation, ethnicity, phone number)? If so, do they really need to have this? What happens if they leave the entire UCAS pack with the whole UCAS application form on a bus or train etc? Maybe the writer just needs the name, choices and subject and tutor references rather than the actual UCAS form (assuming it has been checked prior to the reference writer carrying out their role).
So…consider how you need to handle UCAS forms. Another issue to think about is sixth form leaders who you take mobile numbers from the UCAS form and create an additional contact list to help contact students (e.g. calling them if they miss an examination) then you will need to get permission from the student. Think of developing an overall consent form which explains what data you will collect, how it will be used and when will it be deleted. This could be signed when applying to the sixth form? Michael Senior, Director of Sixth Form 30 April 2018