Lancashire Virtual School

In order to comply with the UK General Data Protection Regulation (UK GDPR), where personal data relating to a data subject is collected, Lancashire County Council would like to provide you with the following details.

Identity and contact details of the data controller

  • Lancashire County Council, PO Box 78 County Hall, Fishergate, Preston, Lancashire, PR1 8XJ

Contact details of the data protection officer

  • Our Data Protection Officer is Paul Bond. You can contact him at dpo@lancashire.gov.uk or Lancashire County Council, PO Box 78 County Hall, Fishergate, Preston, Lancashire, PR1 8XJ

Purposes for processing

Lancashire Virtual School is responsible for:

  • Carrying out the Local Authority statutory duties relating to promoting educational outcomes for looked after children and previously looked after children as referred to in the Children's Act 1989, amended by Children and Families Act 2014 and Children and Social Work Act 2017, The Care Planning, Placement and Case Review Regulations 2010 and Statutory Guidance to Promoting the education of looked after children and previously looked after children 2017.
  • Provision of alternative education provision for those groups of pupils of statutory school age for whom this is the statutory responsibility of the local authority i.e. pupils permanently excluded from school, are medically unfit to attend their school or who otherwise would not access education as required by the Education (Provision of Full-Time Education for Excluded Pupils) (England) Regulations 2007, as amended by the Education (Provision of Full-Time Education for Excluded Pupils) (England) (Amendment) Regulations 2014 and Statutory Guidance amended 2017, Section 19 of the Education Act 1996 and Equality Act 2010 and Statutory Guidance on Ensuring a good education for children who cannot attend school because of health needs 2013.
  • Maintaining an update roll of Lancashire looked after children in nursery, school or college settings wherever they reside and gather information on their education placement, attainment and progress.
  • Ensure sufficient information on a child's mental health, SEN or disability is available to their education setting so that needs can be met appropriately.
  • Inform Head Teachers and Designated Teacher if they have a Lancashire looked after child on their roll.
  • Ensure all looked after children have an up to date, effective and high quality Personal Education Plan.
  • Report regularly on looked after children's educational progress, attainment and attendance through the LA corporate parenting structures.
  • Ensure that the education of looked after and previously looked after children are a priority of the Local Authority.
  • Ensure that pupils permanently excluded from school have access to full time alternative provision from Day 6 of the exclusion.
  • Commission sufficient alternative education provision to meet the needs of the local authority for all cohorts that are the responsibility of the LA.
  • To quality assure alternative provision and track progress and outcomes for pupils for whom the LA has commissioned provision.
  • To ensure that pupils too ill to attend school, who are inpatients in Lancashire general hospitals, NHS mental health units, or require education delivered in the home, have access to appropriate education provision that takes account of their medical needs.
  • To liaise with other LA services and health partners to ensure needs of all pupils are met.

We require information about you to help us to:

  • deliver services to support you/your child;
  • enable co-ordinated working with other teams and organisations;
  • carry out statutory duties for which we are responsible;
  • assess your/your child's needs to identify appropriate provision and specialist equipment
  • manage those services we provide you/your child;
  • help investigate any concerns or complaints you have about the support we provide;
  • evaluate the quality of services;
  • Complete statistical returns to government departments.

We are required to pass on some information, but does not identify individual children, to the Department for Education (DfES) who use it to help with their policy development, performance management and funding, and to assist with the development of good practice.

Dollywood Foundation

Lancashire County Council has entered into a partnership with the Dollywood Foundation for the provision of books for children looked after in care within Lancashire from the ages of 0-5 on a monthly basis.

Lancashire County Council processes and shares personal data for the provision of this service, relying on the consent of responsible carers or parents where appropriate.

Category of personal data being processed

  1. Personal data (information relating to a living, identifiable individual)
  2. Special category personal data (racial, ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation)

Legal basis for processing personal data

The legal basis for processing your personal data, in accordance with the UK GDPR is:

(a) Consent: the individual has given clear consent for you to process their personal data for a specific purpose.

(c) Legal Obligation: the processing is necessary for you to comply with the law. You must reference the applicable legislation if you wish to rely on this basis for processing.

(e) Public Task: the processing is necessary for you to perform a task in the public interest or for your official functions, and the task or function has a clear basis in law. You must reference the applicable task/function and its' basis in law if you wish to rely on this basis for processing.

UK GDPR Article 6 (1) (c) Legal Obligation and UK GDPR Article 6 (1) (e) Public Task are relied upon by virtue of the following legislation:

  • Children and Families Act 2014
  • Children and Social Work Act 2017
  • The Care Planning, Placement and Case Review Regulations 2010
  • Statutory Guidance to Promoting the education of looked after children and previously looked after children 2017
  • Provision of Full-Time Education for Excluded Pupils (England) Regulations 2007, as amended by the Education (Provision of Full-Time Education for Excluded Pupils) (England) (Amendment) Regulations 2014
  • Statutory Guidance amended 2017, Section 19 of the Education Act 1996
  • Equality Act 2010
  • Statutory Guidance on Ensuring a good education for children who cannot attend school because of health needs

Legal basis for processing special categories of personal data

The legal basis for processing your special categories of personal data, in accordance with the UK GDPR is:

(a) The data subject has given explicit consent to the processing of this personal data.

(g) Processing is necessary for reasons of substantial public interest.

(h) Processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services.

Where Lancashire County Council relies on UK GDPR Article 9 (2) (g) Substantial Public Interest and UK GDPR Article 9 (2) (h) it does so by virtue of the following legislation,

Data Protection Act 2018 Schedule 1 Part 2 (6) Statutory etc. and government purposes.

Where Lancashire County Council relies on Article 9 (2) (h) it does so by virtue of the following legislation,

  • Children and Families Act 2014
  • Children and Social Work Act 2017
  • The Care Planning, Placement and Case Review Regulations 2010
  • Statutory Guidance to Promoting the education of looked after children and previously looked after children 2017
  • Provision of Full-Time Education for Excluded Pupils (England) Regulations 2007, as amended by the Education (Provision of Full-Time Education for Excluded Pupils) (England) (Amendment) Regulations 2014
  • Statutory Guidance amended 2017, Section 19 of the Education Act 1996
  • Equality Act 2010
  • Statutory Guidance on Ensuring a good education for children who cannot attend school because of health needs

Recipients of the data

  • internal departments, i.e. services/teams within LCC working to improve outcomes for children and young people;
  • schools, colleges and early years providers as well as wider education or training providers;
  • partner organisations where necessary, which may include NHS teams, health visitors, external providers of LCC Public Health services, midwives, district councils, housing providers, police, school nurses, doctors and mental health workers;
  • the Department for Education;
  • a Court of Law
  • other local authorities (education, social care or health provider and employment and other services)
  • Commissioned services who provide educational provision and support to enable the LA to fulfil its statutory duties.
  • Dollywood Foundation UK – in order to allocate the books as well as the foundation's book distributor, acting as data processor on behalf of the Dollywood Foundation UK.

Information we share

We will process the following categories of personal data about you:

  • name
  • address
  • contact details
  • date of birth
  • parent/carer name(s) and contact details
  • school/college/training provider contact details.
  • education information

We will process the following categories of special category personal data about you:

  • ethnicity
  • physical and/or mental health details
  • special educational needs
  • medical history when this impacts on educational provision.
  • health, social care or other services
  • Reports relating to your situation e.g. safeguarding and other assessments
  • information such as from court/tribunal orders or judgments and professional involvement

Any transfers to another country

  • Yes – specifically for the provision of the delivery of the Dollywood Foundation work, The Dollywood Foundation UK's servers are situated in the USA

Retention periods

Lancashire County Council will only store your information for as long as is legally required or in situations where there is no legal retention period they will follow established best practice.

File type Description Security Retention period
Email Emails held in Outlook that haven't been exported or moved for longer term retention. Encryption used when emailing personal data to partners. Retained in accordance with appropriate internal retention guidelines
Register of Looked After Children-excel spreadsheet Details of all Lancashire looked after children and care leavers, personal information, education providers, key involvements. Stored on R drive – restricted to Virtual Schools staff Destroy at end of academic year-new academic register created.

On conclusion of IICSA (independent investigation into child sexual abuse)
Pupil case files-looked after children, Care leavers.
  • Pupil Premium applications;
  • Pupil Premium Impact reports;
  • Personal Educational Plans (PEPs)
  • School placements
  • Assessments
  • PEP meeting minutes
  • Emails/letters
 Stored on R drive – restricted to Virtual Schools staff Retain until age 25 or 31 (if SEND)

On conclusion of IICSA
Tracking data for looked after children and care leavers- excel spreadsheets
  • Name DOB
  • Education provider
  • Attendance
  • Progress
  • Behaviour
 Stored on r drive-restricted to Virtual School Retain until age 25 or 31 (if SEND)

On conclusion of IICSA
Career plans consisting of set questions answered by pupils and agreed plans/action-word documents Action plan Stored on r drive restricted access. Consent of young person to engage with process. Retain until age 25 or 31 (if SEND)

On conclusion of IICSA
Pupil data for those in medical education provision/alternative provision; LCC central school data system.
  • Name
  • School setting
  • Provision
  • Attainments
  • Progress
  • Attendance
 Secure LA system- Impulse with restricted access- APEX Retain until age 25 or 31 (if SEND)

On conclusion of IICSA
Referral forms and information for medical education pupils Reports for the services, LCC senior managers, and data required for DFE requirements. Held in LCC secure systems with restricted access Impulse/APEX

Referral submitted via School Portal or secure email for schools and NHS colleagues who does not have access to Portal		 Retain until age 25 or 31 (if SEND)
Data required to allow commissioned providers to deliver support/education-word, secure email, on line systems. Name DOB
Education placement,
Additional needs that impact on access to education.		 Inputted onto secure on line systems or by secure email. For LCC:

Retain for 3 years to inform annual reports and Ofsted.

Provider:

To be retained for the relevant academic year and while commission
Documents.; summative data Word, form templates, Virtual School
Annual report, Improvement Plans, reports-for SLT, Ofsted, Cabinet officers		 Some held on LCC secure CSC system. Shared with partners when needed via secure email, saved in secure Virtual School folders on r drive of LCC network- access limited Retain for 3 years to inform annual reports and Ofsted inspections: perm retention of Annual Reports offer to Lancashire Archives.
Details of children looked after in care shared with the Dollywood Foundation for the provision of books Name, DOB, Address Parent's/carers details The data is kept of a secure database in the USA. They implement a variety of security measures to maintain the safety of your personal information and offer the use of a secure server. All supplied sensitive/credit information is transmitted via Secure Socket Layer (SSL) technology and then encrypted into their Payment gateway provider’s database only to be accessible by those authorized with special access rights to such systems, and are required to keep the information confidential. The data is retained by the foundation until the child's 5th birthday.

Your rights

You have certain rights under the UK General Data Protection Regulation (UK GDPR), these are the right:

  • to be informed via Privacy Notices such as this.
  • to withdraw your consent. If we are relying on your consent to process your data then you can remove this at any point.
  • of access to any personal information the council holds about yourself. To request a copy of this information you must make a subject access request in writing. You are entitled to receive a copy of your personal data within 1 calendar month of our receipt of your subject access request. If your request is complex then we can extend this period by a further two months, if we need to do this we will contact you. You can request a subject access request, either via a letter or via an email to Information Governance Team, address below.
  • of rectification, we must correct inaccurate or incomplete data within one month.
  • to erasure. You have the right to have your personal data erased and to prevent processing unless we have a legal obligation to process your personal information.
  • to restrict processing. You have the right to suppress processing. We can retain just enough information about you to ensure that the restriction is respected in future.
  • to data portability. We can provide you with your personal data in a structured, commonly used, machine readable form when asked.
  • to object. You can object to your personal data being used for profiling, direct marketing or research purposes.
  • in relation to automated decision making and profiling, to reduce the risk that a potentially damaging decision is taken without human intervention.

If you want to exercise any of these rights then you can do so by contacting:

Information Governance Team
Lancashire County Council
PO Box 78
County Hall
Preston
PR1 8XJ

Or email: dpo@lancashire.gov.uk

To ensure that we can deal with your request as efficiently as possible you will need to include your current name and address, proof of identity (a copy of your driving licence, passport or two different utility bills that display your name and address), as much detail as possible regarding your request so that we can identify any information we may hold about you, this may include your previous name and address, date of birth and what council service you were involved with.

Further information

If you would like more information about this specific service then please contact Virtualschool@lancashire.gov.uk

For more information about how we use personal information see Lancashire County Council's full privacy notice.

If you wish to raise a complaint on how we have handled your personal data, you can contact the Information Governance team who will investigate the matter.

Lancashire County Council, PO Box 78 County Hall, Fishergate, Preston, Lancashire, PR1 8XJ or email: dataprotection@lancashire.gov.uk

If you are not satisfied with our response or believe we are processing your personal data not in accordance with the law you can complain to the Information Commissioner’s Office (ICO).