Education Improvement Service - 16-19 Education and Skills Team

In order to comply with articles 13 and 14 of the UK General Data Protection Regulation (UK GDPR), where personal data relating to a data subject is collected, Lancashire County Council would like to provide you with the following details.

Identity and contact details of the Data Controller

Lancashire County Council, PO Box 78 County Hall, Fishergate, Preston, Lancashire, PR1 8XJ

Contact details of the Data Protection Officer

Our Data Protection Officer is Paul Bond. You can contact him at DPO@lancashire.gov.uk or Lancashire County Council, PO Box 78 County Hall, Fishergate, Preston, Lancashire, PR1 8XJ

Purposes for processing

Lancashire County Council's 16-19 Education and Skills Team collects information about young people from schools, post 16 education and training providers and other local authorities. This information is used to support young people to overcome any barriers to participation in post 16 education and training; provide information and support on training or employment opportunities; reduce the risk of young people not being in education, employment or training (NEET); and to ensure that young people make a successful and sustained transition after leaving school.

As part of this, data is shared with a mailing house which allows for information from post 16 education and training providers to be sent to young people and/or their parents or carers. This includes information such as details of open events, course information and employer events. The young people referred to for this purpose are those in Years 10-13.

Category of personal data being processed

Personal data (information relating to a living, identifiable individual)
Special category personal data (racial, ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation)

Please note that no special category data is shared or processed as part of the mailing house work mentioned above.

Legal basis for processing personal data

In relation to sharing data with the Department for Education (DfE), the legal basis for processing your personal data, in accordance with the UK GDPR is:

(a) Consent: the individual has given clear consent for you to process their personal data for a specific purpose.

(e) Public Task: the processing is necessary for you to perform a task in the public interest or for your official functions, and the task or function has a clear basis in law. You must reference the applicable task/function and its basis in law if you wish to rely on this basis for processing.

In relation to sharing data with post 16 education and training providers and relevant partners, the legal basis for processing your personal data, in accordance with the UK GDPR is:

Lancashire County Council is required by law to pass some of your information to the Department for Education (DfE) under the Education and Skills Act 2008 and the Apprenticeship, Skills, Children and Learning Act 2009 to encourage, enable and assist young people aged 13-19 (and young adults with learning difficulties or disabilities up to the age of 25) to participate in education or training. The DfE use this data to monitor the performance of local authorities in delivering their statutory duties, specifically the tracking and supporting of 16-17 year olds.

The legal basis for sharing data with post 16 providers and the mailing house are focused on promoting individual wellbeing. An individual's wellbeing includes their participation in work, education, training or recreation. The legal gateways include the following:

Section 507B of the Education Act 1996, with specific reference to subsections 1a, 5c, 5h and 13b
Section 68 of the Education and Skills Act 2008
Section 10 of the Education and Skills Act 2008
Section 1 of the Care Act 2014
Section 2 of the Local Government Act 2000
Section 10 of the Children Act 2004

In terms of compliance with the General Data Protection Regulation (GDPR), LCC has considered that sharing young peoples' contact information in this way relates to:

Article 6 (1) (c) Legal Obligation: the processing is necessary for compliance with a legal obligation to which the controller is subject
Article 6 (1) (e) Public Interest: the processing is necessary for you to perform a task in the public interest or for your official functions and the task or function has a clear basis in law.

In the absence of there being a legal obligation to share your personal information with schools, Lancashire County Council will only share information with the consent of the young person.

Legal basis for processing special categories of personal data

The only type of special category data processed by the 16-19 Education and Skills Team is 'ethnicity'.

The legal basis for processing your special categories of personal data, in accordance with Article 9 (2) of GDPR is (g) Legal Obligation: the processing is necessary for you to comply with the law. This only relates to sharing of data with the Department for Education (DfE) as outlined above.

Schedule 1 Part 2 Para 6 to the Data Protection Act (2018) establishes that statutory and government purposes are substantial public interest conditions.

Recipients of the data

Other departments within Lancashire County Council
Department for Education (DfE)
Schools
Post 16 education and training providers and relevant partners
Mailing House, on behalf of post 16 education and training providers
Local authorities

Information we share

Secondary schools – individualised destinations data of former pupils once they have left the school. Lancashire County Council will only share the following information with schools with the consent of the young person:

Name
Date of Birth
Destination data

Post 16 education and training providers and relevant partners – personal information of young people who are not participating in post 16 education or training or whose participation status is not known so that guidance and support can be provided, in line with various statutory duties.

Relevant departments within Lancashire County Council – destinations data of young people who are known to other Lancashire County Council services.

Mailing House – names and addresses are shared with the mailing house so that information can be sent in relation to post 16 education and training options and opportunities.

Local Authorities – personal information of young people who are either educated or residing in Lancashire who will be moving to another Local Authority so that guidance and support can be provided, in line with statutory duties.

Department for Education (DfE) – information is provided to the DfE in line with statutory duties.

Any transfers to another country

Retention periods

Lancashire County Council will only store your information for as long as is legally required or in situations where there is no legal retention period they will follow established best practice.

File type	Description	Security	Retention period
Email/paper files/database	Information about young people either being educated in, or who are resident within Lancashire	Encrypted used when emailing personal data to partners.	For mainstream pupils, information is stored for 5 years after pupils have reached their 18^th birthday. For pupils with an EHCP, information is stored for 3 years after pupils have reached their 25^th birthday.

Your rights

You have certain rights under the UK GDPR and these are:

The right:

to be informed via privacy notices such as this.
to withdraw your consent. If we are relying on your consent to process your data then you can remove this at any point.
of access to any personal information the council holds about you. To request a copy of this information you must make a subject access request in writing. You are entitled to receive a copy of your personal data within one calendar month of our receipt of your subject access request. If your request is complex then we can extend this period by a further two months - if we need to do this we will contact you. You can submit a subject access request by writing to Information Governance Team at the address below.
of rectification. We must correct inaccurate or incomplete data within one month.
to erasure. You have the right to have your personal data erased and to prevent processing unless we have a legal obligation to process your personal information.
to restrict processing. We can retain just enough information about you to ensure that the restriction is respected in future.
to data portability. We can provide you with your personal data in a structured, commonly used, machine readable form when asked.
to object. You can object to your personal data being used for profiling, direct marketing or research purposes.
in relation, to automated decision making and profiling, to reduce the risk that a potentially damaging decision is taken without human intervention.

If you want to exercise any of these rights then you can do so by contacting:

Information Governance Team
Lancashire County Council
PO Box 78
County Hall
Preston
PR1 8XJ

Or email: dataprotection@lancashire.gov.uk

To ensure that we can deal with your request as efficiently as possible you will need to include your current name and address, proof of identity (a copy of your driving licence, passport or two different utility bills that display your name and address), as much detail as possible regarding your request so that we can identify any information we may hold about you, this may include your previous name and address, date of birth and what council service you were involved with.

Further information

If you would like more information about this specific service, please contact post16participation@lancashire.gov.uk. Please contact this email address if you would prefer not to receive any information from the mailing house.

For more information about how we use personal information, see Lancashire County Council's full privacy notice.

If you wish to raise a complaint on how we have handled your personal data, you can contact the Information Governance team who will investigate the matter.

If you are not satisfied with our response or believe we are processing your personal data not in accordance with the law, you can complain to the Information Commissioner’s Office (ICO).