Education privacy notice

All personal information is held and processed by East Ayrshire Council as Data Controllers in accordance with data protection law.

For information on the role of Data Controller, Data Protection Officer and contact details for the Council, please refer to our Privacy Statement.

Personal data is required to be collected by the Education Service in order to carry out its duties as a provider of education services under the Education (Scotland) Act 1980 and the Education (Scotland) Act 2016.

Personal data includes identifiers such as:

• name
• address
• date of birth and personal characteristics such as gender and ethnic group
• qualifications and training
• health or absence information

The lawful basis for processing personal data are set out in data protection legislation. In this case, the lawful basis for processing individuals’ data are:

1. Contract – the processing is necessary for a contract.
2. Legal obligation – the processing is necessary for Education Services to comply with the law.
3. Public task – the processing is necessary to perform a task in the public interest or for official functions, and the task or function has a clear basis in law.
4. Consent – in limited circumstances, for instance relating to taking pictures for promotional purposes, Education Services may rely on an individual’s consent to process their personal data. Where Education Services is relying on an individual’s consent to process personal data then individuals have the right to withdraw this consent at any time.

Data protection legislation defines Special Category Data as data relating to the processing of personal data regarding:

• racial or ethnic origin
• political opinions
• religious or philosophical beliefs
• trade union membership
• processing of:
  • genetic data
  • biometric data
  • data concerning health
  • data concerning a person’s sex life or sexual orientation

Education Services will have a requirement to process some types of Special Category Data and in particular:

• racial or ethnic origin information for monitoring purposes
• health information for pupil assistance and absence monitoring
• pupil biometric data to administer the school catering system

Consent in limited circumstances, for instance with regards to using biometric data to administer the school catering system, Education Services may rely on an individual’s consent to process their personal data.

Where Education Services is relying on an individual’s consent to process personal data then individuals have the right to withdraw this consent at any time.

Lawful basis for processing Special Category Data

The lawful basis for processing Special Category Data is necessary for reasons of substantial public interest, on the basis of Union or Member State law which shall be proportionate to:

• the aim pursued
• respect the essence of the right to data protection
• provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject

Education Services receive an individual’s personal data from or share and individual’s personal data with:

• The Scottish Government
• Education Scotland
• External contractors (transport)
• NHS
• Private nurseries
• Strathclyde Passenger Transport
• Scottish Children’s Reporter Administration
• Social Work Services
• Scottish Public Services Ombudsman
• The (UK) Information Commissioner
• Ayrshire College and other higher education establishments

Education Services will also share pupil information with approved external software organisations providing educational products such as homework or tuition apps/online services, so that pupils can be registered and utilise the learning products.

Where information is shared with other organisations or processed on our behalf, we will ensure adequate protection by ensuring contracts and sharing agreements are in place that define security controls around the sharing of the information.

Education Services will also make any disclosures required by law and may also share information with other bodies responsible for detecting/preventing fraud or auditing/administering public funds.

We will only keep your information for the minimum period necessary.

After this time, information is deleted/destroyed in accordance with our Council approved Retention Schedule (PDF 814 KB) which explains how long we keep information for.

It is important that we hold accurate and up-to-date information.

If any details have changed, or change in the future, then individuals should ensure that they inform Education Services as soon as possible so that they can update their records.

Under data protection legislation, individuals have the right to request access to information about them that the Council holds.

Individuals also have the right to:

• object to processing of personal data that is likely to cause, or is causing damage or distress
• prevent processing for the purpose of direct marketing
• object to decisions being taken by automated means
• in certain circumstances, have inaccurate personal data rectified, blocked, erased or destroyed
• in certain circumstances, transfer their data to another organisation (data portability)

How to contact us

Individuals can contact us:

• regarding their data protection rights and the processing of their data
• if they have a concern about the way the Council is collecting or using their personal data

They should raise their concern with our Data Protection Officer in the first instance. Contact details can be found on our Privacy Statement.