Sometime in the Autumn the introduction of ‘The General Data Protection Regulations’ seemed a very long way away. As I write this it is this week after Friday the 25th of May and by then things seemed to have escalated into a hysterical frenzy!
As a part of our role in school we are all very aware of safeguarding etc. and would like to think, that by and large, we are all aware of data protection and our responsibilities. Many of us act as Data Protection Officers for our schools. However, as the great day loomed even larger I found myself overwhelmed with more and more privacy notices and information by every possible communication method, I bet you were all the same. It wasn’t just at work but at home as well!
I got caught up in the frenzy – amongst the new privacy notices, policy and staff training, I found myself writing copious lists of every provider we have ever used – everyone I could think of – all these people to send ‘Controller Processor Contracts’ to, so many people to contact, to get information from, and so little time! After several days of wiping my damp brow a little light bulb came on. I think it started with a well-known school photography company when I actually studied the information they had sent me. They don’t hold any identifiable data – the photographs are catalogued by number – Eureka!
Identifiable data is the key to this. I reviewed our provider list again. From all these companies, mostly software providers, who do we actually share identifiable data with, and how do we share it?
It’s still a minefield in many ways but after the ICO website had crashed last Friday l was listening to the news on the way home. The ICO advice – they didn’t expect us to be compliant by Friday but wanted to see evidence of ‘working towards’. So I’m dealing with it logically now, bit by bit, certainly more aware than I was of how much data we share with all sorts of people, and how we need to be careful what we do.
It may take until Christmas before I feel confident that we have done everything we can. So just remember this:-
“He’s making a list
He’s checking it twice
He’s going to find out whose naughty or nice”
Father Christmas may will be in contravention of Article 4 of
The General Data Protection Regulations!
By Rowena Morris - June 2018