Privacy notice under the Data Protection Act
Pupils, as data subjects, have certain rights under the Data Protection Act, including a general right to be given access to personal data held about them by any data controller.
Data controllers have to provide “data subjects” with details of who they (the data controllers) are, the purposes for which they process the personal data, and any other information that is necessary to make the processing of the personal data fair, including any third parties to whom the data may be passed on. This is normally done by what is referred to as a “privacy notice”.
The Information Commissioner has recommended that the term 'Fair Processing Notice' be replaced by a 'Privacy Notice' from September 2009. The DfE is adopting a new approach in its data collections from now on, and has reviewed the whole process of issuing Privacy Notices. A school will issue a Privacy Notice to parents or to pupils where that young person is aged 12 or over when they enrol at the school. The notice may include information about organisations with whom the school shares its data and links to Local Authority and DfE websites where it is explained how data is used and shared by these organisations (see Read more and Other websites section). A Privacy notice may only need to be issued once and it is the responsibility of parents and pupils to review the content of these websites to check for any changes.
Further information about fair processing requirements, and guidance on the Data Protection Act generally, can be obtained from the Information Commissioner’s website (http://www.ico.gov.uk).