Confidentiality, Privacy and General Data Protection Regulation Policy
Statement
GDPR stands for General Data Protection Regulation and replaces the previous Data protection Directives that were in place. It was approved by the EU Parliament in 2016 and comes into effect on 25th May 2018.
GDPR states that personal data should be ‘processed fairly & lawfully’ and ‘collected for specified, explicit and legitimate purposes’ and that individuals data is not processed without their knowledge and are only processed with their ‘explicit’ consent. GDPR covers personal data relating to individuals. ABC Childcare Services Cheshire Limited is committed to protecting the rights and freedoms of individuals with respect to the processing of children’s, parents, visitors and staff personal data.
The Data Protection Act gives individuals the right to know what information is held about them. It provides a framework to ensure that personal information is handled properly. ABC Childcare Services Cheshire Limited is registered with the ICO (Information Commissioners Office) under registration reference: Z2181014 and has been registered 7 th April 2010. Certificates are on display on the parent information boards in all ABC settings.
GDPR includes 7 rights for individuals
1) The right to be informed
ABC Childcare Services Cheshire Limited is a registered Childcare provider with Ofsted and as so, is required to collect and manage certain data. We need to know parent’s names, addresses, telephone numbers, email addresses, date of birth and National Insurance numbers. We need to know children’s’ full names, addresses, date of birth and Birth Certificate number. For parents claiming the free nursery entitlement we are requested to provide this data to Cheshire East Council; this information is sent to the Local Authority via a secure electronic file transfer system.
We are required to collect certain details of visitors to our pre-schools. We need to know visits names, telephone numbers, addresses and where appropriate company name. This is in respect of our Health and Safety and Safeguarding Policies.
As an employer ABC Childcare Services Cheshire Limited is required to hold data on its employees; names, addresses, email addresses, telephone numbers, date of birth, National Insurance numbers, photographic ID such as passport and driver’s license, bank details. This information is also required for Disclosure and Barring Service checks (DBS) and proof of eligibility to work in the UK. This information is sent via a secure file transfer system to UKCRBs for the processing of DBS checks.
ABC Childcare Services Cheshire Limited uses Cookies on its website to collect data for Google Analytics, this data is anonymous.
2) The right of access
At any point an individual can make a request relating to their data and ABC Childcare Services Cheshire Limited will need to provide a response (within 1 month). You do not have the right to access information about any other child. ABC Childcare Services Cheshire Limited can refuse a request, if we have a lawful obligation to retain data i.e. from Ofsted in relation to the EYFS, but we will inform you of the reasons for the rejection.
If you think your data has been misused or that we have not kept it secure, please discuss with us.
You have the right to complain to the ICO if you are not happy with the decision. If you’re unhappy with our response or if you need any advice you should contact the Information Commissioner’s Office (ICO). ICO helpline 0303 123 1113 (local rate)
3) The right to erasure
You have the right to request the deletion of your data where there is no compelling reason for its continued use. However, ABC Childcare Services Cheshire Limited has a legal duty to keep children’s and parent’s details for a reasonable time, ABC Childcare Services Cheshire Limited retain these records for 3 years after leaving ABC, children’s accident and injury records for 19 years (or until the child reaches 21 years), and 22 years (or until the child reaches 24 years) for Child Protection records. Staff records must be kept for 6 years after the member of leaves employment, before they can be erased. This data is archived securely onsite and shredded after the legal retention period. A copy of this Risk Assessment can be provided upon request.
4) The right to restrict processing
Parents, visitors and staff can object to ABC Childcare Services Cheshire Limited processing their data. This means that records can be stored but must not be used in any way, for example reports or for communications. 5) The right to data portability ABC Childcare Services Cheshire Limited requires data to be transferred from one IT system to another; such as from ABC Childcare Services Cheshire Limited to the Local Authority, to shared settings and to Tapestry’ Online Learning Journal. These recipients use secure file transfer systems and have their own policies and procedures in place in relation to GDPR.
6) The right to object
Parents, visitors and staff can object to their data being used for certain activities like marketing or research.
7) The right not to be subject to automated decision-making including profiling.
Automated decisions and profiling are used for marketing based organisations. ABC Childcare Services Cheshire Limited does not use personal data for such purposes.
Storage and use of personal information
All paper copies of children’s and staff records are kept in locked offices in ABC Childcare Services Cheshire Limited. Members of staff can have access to these files but information taken from the files about individual children is confidential and these records remain on site at all times. These records are shredded after the retention period.
If a child is identified as a child in need (section 17 of the Children Act 1989) we will, normally with the parent’s permission, give appropriate information to referring agencies. We adhere to section 11 of the Children Act 2004 and make necessary arrangements to safeguard and promote welfare.
Parents must inform the setting Manager of any changes in the child’s home circumstances, care arrangements or any other change which may affect the child’s behaviour such as a new baby, parents’ separation, divorce, bereavement, domestic violence etc.
All information shared will be kept confidential and will not be disclosed without the parent’s consent, except as required by law, for example, if there appears to be a child protection concern. Please see our Safeguarding policy.
Information about individual children is used in certain documents, such as, a weekly register, medication forms, referrals to external agencies and disclosure forms. These documents include data such as children’s names, date of birth and sometimes address. These records are shredded after the relevant retention period.
ABC Childcare Services Cheshire Limited collects a large amount of personal data every year including; names and addresses of those on the waiting list. These records are shredded if the child does not attend or added to the child’s file and stored appropriately.
Our procedure is to keep all confidential records secure and in a locked filing cabinet accessible by senior members only. The details are accessible if any information is required for inspection by Ofsted.
Information regarding families’ involvement with other agencies is kept in a locked filing cabinet. These records are shredded after the relevant retention period. Any information shared with other agencies electronically, is sent via Cheshire East’s secure system called egress.
Upon a child leaving ABC Childcare Services Cheshire Limited and moving on to school or moving settings, data held on the child may be shared with the receiving school/setting. This information is hand delivered or collected and a transfer of document form is signed and dated by those parties.
ABC Childcare Services Cheshire Limited stores personal data held visually in photographs or video clips or as sound recordings, unless written consent has been obtained via the consent form, no names are stored with images in photo albums, displays, on the website or on ABC Childcare Services Cheshire Limited ’s social media sites unless consent has been given.
Access to all Office computers and Tapestry Online Learning Journal is password protected. When a member of staff leaves the company, these passwords are changed in line with this policy and our Safeguarding policy.
GDPR means that ABC Childcare Services Cheshire Limited must;
* Manage and process personal data properly
* Protect the individual’s rights to privacy
* Provide an individual with access to all personal information held on them
Policy reviewed annually.