Data Protection Policy

School: SCOIL THOMAIS

Introductory Statement

Scoil Thomáis Data Protection Policy applies to personal data held by the school and Board of Management (BoM), which is protected by the Data Protection Acts 1988 to 2018, and the EU General Data Protection Regulation (GDPR) effective from 25th May 2018.

Data Protection legislation applies to obtaining, keeping and processing of personal data. The purpose of this policy is to assist the school to meet its statutory obligations, to explain those obligations to school staff, and to inform staff, pupils and parents/guardians on how their data will be treated.

The provisions of this policy apply to all school staff, Board of Management, parents/guardians, pupils and others (including prospective or potential pupils and their parents/guardians, and applicants for staff positions within the school) insofar as the school handles or processes their personal data in the course of their dealings with the school.

The school seeks to ensure that it can:

  • Provide access to individuals to their data
  • Ensure it is held securely
  • Clarify school data protection procedures
  • Enhance accountability and transparency

Principles of Data Protection

The Board of Management (BoM) of Scoil Thomáis is a data controller of personal data relating to its past, present and future staff, pupils, parents/guardians and other members of the school community. The BoM complies with the following principles:

  1. Obtain and Process Personal Data Fairly: Information on pupils is gathered with the help of parents/guardians and staff. Staff information is generally furnished by the person themselves with full and informed consent.
  2. Consent: Where consent is the basis for provision of personal data, the consent must be freely-given, specific, informed, and unambiguous. Consent can be withdrawn by data subjects at any time.
  3. Keep it only for one or more specified and explicit lawful purposes: The school will inform individuals of the reasons their data is necessary and the uses to which it will be put.
  4. Process it only in ways compatible with the purposes for which it was given initially: Data relating to individuals will only be processed in a manner consistent with the purposes for which it was gathered.
  5. Keep Personal Data safe and secure: Manual records are securely stored, and electronic data is protected with computer software and password protection. Portable devices are encrypted and password-protected.
  6. Keep Personal Data accurate, complete and up-to-date: Individuals should inform the school of any amendments. Records must not be altered or destroyed without proper authorisation.
  7. Ensure that it is adequate, relevant and not excessive: Only the necessary amount of information required to provide an adequate service will be gathered and stored.
  8. Retain it no longer than is necessary: Information is generally kept for the duration of the individual’s time in the school, following DES guidelines thereafter. Staff records are kept in accordance with Revenue and DES requirements.
  9. Right of Access: Individuals have a right to know and have access to a copy of personal data held about them, by whom, and the purpose for which it is held.

Definition of Data Protection Terms

  • Data: Information in a form that can be processed (automated/electronic or manual/filing system).
  • Personal Data: Any data relating to an identified or identifiable natural person.
  • Data Controller: The Board of Management of the school.
  • Data Subject: An individual who is the subject of personal data.
  • Data Processing: Any operation performed on data, including obtaining, recording, storing, using, or erasing.
  • Data Processor: A person/entity who processes personal information on behalf of a data controller (e.g., Aladdin, School Accounting software).
  • Special Categories of Personal Data: Personal data regarding racial/ethnic origin, religious beliefs, health, sexual orientation, genetic/biometric data, or criminal convictions.
  • Personal Data Breach: A breach of security leading to accidental or unlawful destruction, loss, alteration, or unauthorised disclosure of personal data.

The school has a legal responsibility to comply with Data Protection Acts 1988 to 2018 and GDPR. Implementation also takes into account:

  • Section 9(g) of the Education Act, 1998: Access to records for parents/students over 18.
  • Section 20 of the Education (Welfare) Act, 2000: Requirement to maintain a student register.
  • Section 28 of the Education (Welfare) Act, 2000: Supplying data to DES, Tusla, and NCSE.
  • Section 14 of the EPSEN Act, 2004: Furnishing information to the NCSE.
  • Freedom of Information Act 2014: Qualified right to access information held by public bodies.
  • Children First Act 2015: Responsibilities of mandated persons to report welfare concerns.

Personal Data Records Held

1. Staff Records

  • Categories: Names, addresses, PPS numbers, emergency contacts, qualifications, leave records, and accident reports.
  • Purposes: Management of school business, payroll, human resources, and compliance with safety legislation.
  • Security: Manual records in locked filing cabinets; digital records on password-protected computers with encryption.

2. Pupil Records

  • Categories: Name, address, PPS number, date of birth, religious belief, ethnic origin, medical card status, previous academic records, attendance, and psychological assessments.
  • Purposes: Educational provision, legislative compliance, emergency contact, and monitoring progress.
  • Security: Managed in accordance with ICT Acceptable Use and AUP policies.

3. Board of Management Records

  • Categories: Names and contact details of members, appointment records, and meeting minutes.
  • Purposes: To enable the BoM to operate in accordance with the Education Act 1998.

4. Creditors

  • Categories: Name, address, PPS number, tax details, and bank details.
  • Purposes: Management of school financial affairs and annual audits.

5. CCTV Images

  • Purposes: Ongoing safety and security of staff, pupils, and visitors.
  • Security: Access restricted to Principal/Deputy Principal. Recordings are retained for 28 days unless required for an investigation.

Procedures and Rights

Data Access Requests (DAR)

  1. Individuals are entitled to a copy of their personal data on written request via the Data Access Request Form.
  2. The DAR must be responded to within one month of receipt.
  3. No fee may be charged unless the request is repetitive or excessive.
  4. Personal data relating to third parties will not be disclosed during a DAR.

Personal Data Breaches

All incidents where personal data has been put at risk must be reported to the Office of the Data Protection Commissioner within 72 hours. BoM must communicate the breach to the data subject if it results in high risk to their rights and freedoms.

Telephone Enquiries

School personnel must not disclose personal information over the phone. Callers should be asked to put requests in writing.

Implementation and Ratification

  • Overall Responsibility: Scoil Thomáis Board of Management.
  • Data Controller: Ms. Mary McGarry (Principal).

This policy will be reviewed in the context of updated guidelines from the Data Protection Commissioner, DES, or Tusla.

Ratified by the Board of Management on 22nd June 2020.

🌐