Navigating data protection compliance often requires a careful balance between the rights and wishes of individuals against the wider benefits of using and sharing personal data.

We look at some key data protection issues which schools have recently asked us to advise on.

A parent has told us that the school is not to share information about them or their child with NHS Test and Trace under any circumstances. Where do we stand?

DfE guidance provides that a school's first port of call would be to contact the health authorities through the DfE helpline.  As such, we suggest treating such a request as a request to not share coronavirus (COVID-19) related information with health authorities more generally, not just Test and Trace.

Data protection law does not prevent a school from sharing information about pupils and parents with health authorities, even against their wishes. If a situation does in fact arise, any decision to pass information on should involve a balancing exercise based on the individual circumstances of the case, taking account of the wider benefits (for example, to public health) against individual data protection rights.

The school should look carefully at the reason for the objection and in many cases may well conclude that the balance lies in favour of disclosure. Any objection might count as a formal 'right to object' request under the GDPR.

Our sports facilities are used by the public. Is there anything specific we need to be aware of?

Organisations in the hospitality sector are required to keep records relating to staff and customers and share those records with NHS Test and Trace if requested. This may be relevant to school commercial activities, as the requirements apply to a number of different settings including cafes and indoor sport and leisure centres.

See the Government's latest guidance on this.

A pupil has tested positive for coronavirus. DfE guidance states that 'Schools must not share the names of people with coronavirus (COVID-19) unless essential to protect others.' Does this mean that we cannot tell staff?

This will require a careful judgement and should be considered on a case by case basis. Adopting a blanket rule that all staff will be informed is unlikely to be data protection compliant. There may be specific circumstances that would justify revealing the name of the pupil to specific staff members, for example, if a member of staff had been in close contact with the pupil and lived with a vulnerable individual.

We have purchased equipment to enable our school to carry out its own coronavirus tests on pupils and staff. What are the data protection considerations?

This will engage with many of the issues that the school might have already considered when handling personal data relating to the pandemic:

  • The school must be satisfied that what it plans to do is fair, necessary and proportionate. The school should also carry out a data protection impact assessment (DPIA), to help, identify, document and mitigate risks.
  • Pupils, parents and staff should be given clear information about how their personal data will be used, including information about who the tests results will be shared with (both within the school and with external agencies, such as the health authorities).
  • The school will also need to make sure that it has identified the relevant lawful basis under Article 6 of the GDPR. Health information counts as 'special category' data, so the school will also need to identify a condition for the processing (in addition to a lawful basis) under Article 9 of the GDPR / Schedule 1 of the Data Protection Act.

There will also likely be a number of wider issues to consider. For example, how the testing fits in with the school's health and safety obligations, employment law and the school's rights and duties under the parent contract.

Can we require pupils aged 16 and over to use the NHS Test and Trace app?

Data protection law does not prevent this in principle but such a policy would raise a number of additional legal and practical issues, particularly as DfE guidance states that pupils are not required to use the app. In addition, the app does not work on older devices and the school will also need to consider how such a policy would fit in with the school's existing mobile phone policies and practices.

Many of the points above in relation to using coronavirus testing equipment apply here as well.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.