We are committed to protecting your personal data, and ensuring it is used fairly and lawfully. Information you provide to us will be used in accordance with UK GDPR and the Data Protection Act 2018 legislation.
We are the data controller under the legislation for the personal information we hold about you or your child.
1. Information we use
We collect and process special categories of personal information related to education, care, and health needs assessment process under the Children and Families Act 2014. The information we may collect includes but is not limited to:
- name and contact details of the child and their parents/guardians
- personal characteristics, such as date of birth, gender, and ethnicity
- educational information, including assessments, progress reports, and special educational needs
- health information relevant to the child's well-being and educational needs
- care-related details, if applicable
2. Why we use this information
We process this information for the following purposes:
- to assess and support the educational, care, and health needs of a child
- to facilitate communication and co-ordination among relevant professionals involved in the education, health and care needs assessment process
- to comply with legal obligations under the Children and Families Act 2014
- to monitor and improve the quality of educational and support services provided
Usually, we will ask for you for agreement to share any personal information you share with us for these purposes, however, the primary legal basis we use for processing personal information for these purposes under UK GDPR and Data Protection Act 2018 is Article 6(1)(e) - processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
As we have the statutory responsibility for completing education, health and care plans, we can also use the following legal basis for elements of the personal information we use:
- Article 6(1)(c) - processing is necessary for compliance with a legal obligation to which the controller is subject - this means we do not need your consent to share your data if it is necessary and lawful to do so
Where special category of data such as ethnicity or health information is being used, the relevant condition under the legislation has been identified as:
- Article 9(2)(g) processing is necessary for reasons of substantial public interest, on the basis of Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject
The relevant substantial public interest condition in Schedule 1 of the Data Protection Act 2018 is:
- Schedule 1, Part 2, para. 6: Statutory purposes - processing is necessary for the exercise of a function conferred on the data controller by an enactment, and is necessary for reasons of substantial public interest
3. How your information will be kept secure
To meet our commitment to protecting your personal data we have data policies and procedures in place to ensure that it is safeguarded that include:
- restricted access to personal information, limited to authorised personnel involved in the education health and care assessment process
- encryption of information shared electronically and secure storage of data
- regular training for staff on data protection and privacy best practices
- compliance with relevant data protection laws, including the UK GDPR and Data Protection Act 2018
Where appropriate, we will undertake Data Protection Impact Assessments (DPIAs) on any new processes or systems we introduce that involve using your personal information.
We carry out checks on all third parties we use, and have contracts in place with them which detail data protection obligations they have to follow. For example, they are required to conform to our supplier information security policy, which protects your data while in their hands.
Your information will only be held by us for the set amount of time stated in our records retention schedule and will be permanently deleted or securely destroyed at the end of the period stated unless we have a lawful reason to retain it.
4. Who we share your information with
We may share your information with the following parties for the purposes outlined:
- educational professionals directly involved in the ECH needs assessment process
- healthcare providers and professionals
- local authorities and government agencies as required by law.
- third-party service providers engaged in supporting the ECH needs assessment process
Any sharing of information is done in compliance with data protection laws, and appropriate safeguards are implemented to ensure the confidentiality and security of your data.
For further information on who we share information see our privacy notices.
5. Your rights
As a data subject, you have the following rights over your personal information:
- the right to access the personal information we hold about you
- the right to rectify inaccurate or incomplete information
- the right to erasure (in certain circumstances)
- the right to restrict processing
- the right to data portability
- the right to object to processing
- rights related to automated decision-making, including profiling
You can find more information on your rights and how to make request under your rights.
For more detailed advice on your rights, visit the Information Commissioner's Office.
To exercise these rights or for any queries regarding the processing of your personal information, please contact your named contact within our special educational needs and disabilities (SEND) service or you can contact:
Data Protection Officer
Legal Services
Derbyshire County Council
Room 361
County Hall
Matlock
Derbyshire
DE4 3AG
email: access2info@derbyshire.gov.uk
If you are not satisfied with our response, you can request that your concern or complaint is dealt with under the more formal process set out in our complaints procedure.
If you are dissatisfied with our response to your complaint, you can contact the Information Commissioner's Office:
- write to:
Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
- tel: 0303 123 1113 (local rate) or tel: 01625 545 745 (national rate).
- fax: 01625 524 510
The Information Commissioner's Office deals with concerns and complaints relating to data protection and freedom of information legislation.
If you have any questions about this privacy notice, email cs.infogov@derbyshire.gov.uk