Department of Education - Privacy Notice

Introduction

Your privacy is important to us and the Department of Education for Northern Ireland will process your personal data, in line with the requirements of the Data Protection Act 2018 - UK General Data Protection Regulation (UK GDPR) from 25 May 2018.  

1. What is the Department of Education?

The Department of Education is a Public Authority and is often referred to as DE and this abbreviation is used in this Privacy Notice.

DE has two offices located at:

• Rathgael House in Bangor, which is DE’s headquarters office, and
• Waterside House in Derry/Londonderry, where DE handles its work to pay working teachers their salaries and retired teachers their pensions.

The address and contact details for both offices can be found at point 15 of this Privacy Notice.

2. What does DE do?

DE’s main legal duties are to promote through co-operation improvements to the well-being of children and young people including:
 

• Physical and mental health;
• The enjoyment of play and leisure;
• Learning and achievement;
• Living in safety and with stability;
• Economic and environmental well-being;
• The making by them of a positive contribution to society;
• Living in a society which respects their rights;
• Living in a society in which equality of opportunity and good relations are promoted.

And, the promotion of education of children in Northern Ireland and to deliver the Minister of Education’s decisions and policies.

DE’s main areas of responsibility are:

• 0-4 (pre-school) provision;
• primary;
• post-primary;
• special education and
• the youth service.

In addition, DE is also responsible for the policies that govern teachers and the school curriculum. 

It is important to note DE does not actually employ teachers who work in schools in Northern Ireland. Rather, employing authorities like the Education Authority, the Council for Catholic Maintained Schools and in some cases schools like Voluntary Grammar schools are actually teachers’ employers and not DE.

However, DE is responsible for the payment of teachers’ salaries and pensions for many of the employing authorities and therefore for most of the teachers in Northern Ireland. However, some schools like Voluntary Grammar Schools pay their teaching staff directly and not through DE. The Department does not pay non-teaching staff. That function is carried out either by the Education Authority or individual schools themselves.

In addition to schools, DE is supported in delivering its legal role and functions by a range of other organisations (many of whom are shown through this link: https://www.education-ni.gov.uk). Collectively, this is often referred to as the wider education sector.

3. UK GDPR lawful basis for processing personal data

The UK GDPR requires every organisation that processes personal data to have a lawful basis for doing so.  The UK GDPR provides five different lawful bases for public authorities to process personal data and organisations like DE must outline which lawful basis allows it to process your personal data.  No one basis is ‘better’ or more important than the others and DE must have a lawful basis for doing so and at least one of the following must apply:

(i)  Consent: an individual must give DE clear consent for us to process their personal data and then only for a specific purpose;

(ii) Contract: the processing is necessary for a contract DE has with an individual, or because they have asked for specific steps to be taken before entering into a contract;

(iii) Legal obligation: the processing is necessary for DE to comply with the law (not including contractual obligations);

(iv) Vital interests: the processing is necessary to protect someone’s life;

(v) Public Task: the processing is necessary for DE to perform a task in the public interest or for the Department’s official functions, and the task or function has a clear basis in law;

The processing that DE carries out is most likely to fall under III and V above, based on legislation such as the Education Reform Order (NI) Order 1989, which can be accessed through this link:

http://www.legislation.gov.uk/nisi/1989/2406/part/II

4. Description of the personal data processed by DE

The personal data processed by DE relates to:

• Pupils;
• Other young people;
• Parents/Guardians
• Representatives;
• Teachers;
• School Governors;
• Employees; 
• Customers and clients; 
• Suppliers and service providers; 
• Advisers, consultants and other professional experts, and 
• Complainants and enquirers. 

The categories of personal data processed by DE include:

• Personal details; 
• Contact details;
• Family, lifestyle and social circumstances; 
• Financial details; 
• Employment and education details; 
• Goods or services provided;  
• Details in relation to school inspections carried out by the Education Training Inspectorate (ETI); 
• Offences (including alleged offences);
• Criminal proceedings, and 
• Court decisions/rulings.

In addition, the following Special Category Personal Data (formerly known as Sensitive Personal Data) may be processed:

• Racial or ethnic origin;
• Political opinions;
• Religious or philosophical beliefs;
• Trade union membership;
• Processing of genetic information;
• Biometric information;
• Health, and
• Sexual orientation.

We will only process Special Category Personal Data, where it is necessary and for the original purpose for which it was obtained, in line with the requirements of the UK GDPR.   

5. How does DE obtain personal data?

In order to carry out our official functions and respond to queries from data subjects on education issues we may obtain information from:

• Data subjects and/or their representatives;
• Application forms completed by data subjects or their representatives, including those which may be hosted on NI Direct; https://www.nidirect.gov.uk/
• Correspondence and affidavits lodged by data subjects or their representatives;
• Family and/or representatives of the data subject;
• Educational organisations and examining bodies;
• Other Northern Ireland government departments and organisations working as their agents;
• Non Departmental Public Bodies/Arm’s Length Bodies/Sectoral Bodies
• Central government;
• European Union organisations;
• Current, past and prospective employees/employers;
• Suppliers and service providers;
• Financial organisations such as banks and building societies;
• Taxation authorities such as HM Revenue & Customs;
• Courts, tribunals and parties to litigation;
• Police forces;
• The courts on production of a valid court order;
• Publicly accessible sources, and
• Social media and other public platforms.

  6. Who does DE share your personal data with?

DE sometimes needs to share the personal data we process with the data subject and also with other organisations. Where this is necessary or required we will comply with the UK GDPR and we will only share the information that we have to, in order to carry out a specific role or function, which the law allows us to.

What follows is a description of the types of organisations we may need to share personal data with:

• Data subjects and/or their representatives;
• Family and/or representatives of the data subject;
• Educational organisations and examining bodies;
• Non Departmental Public Bodies/Arm’s Length Bodies/Sectoral Bodies
• Other Northern Ireland government Departments and organisations working as their agents;
• Central government;
• Credit Reference Agencies
• Debt collection and tracing agencies
• European Union organisations;
• Current, past and prospective employees/employers;
• Suppliers and service providers;
• Financial organisations such as banks and building societies;
• Taxation authorities such as HM Revenue & Customs;
• Courts, tribunals and parties to litigation;
• Police forces; and
• The Courts on production of a valid court order.
• The Northern Ireland Audit Office

7. Parents/Guardians

If you write to us about your child, we may ask you to confirm your identity as their parent/guardian before we can action your correspondence.  Further, we may ask you to provide evidence that they have given you their consent to write to us on their behalf, because under data protection law, their personal data belongs to them and we may need evidence of their consent before we action your request. In addition, we may need to share your correspondence with specific education bodies such as the Education Authority, in order to help DE answer it.  

8. Transfer of personal data to other countries

If it is ever necessary for DE to transfer your personal data overseas to be processed, any transfers made will be in full compliance with all aspects of the UK GDPR.

9. How long does DE keep your personal data for?

DE will only retain personal data for as long as it is required, for the purpose(s) for which it was obtained and in line with DE’s Retention and Disposal Schedule, which is approved by The Public Record Office for Northern Ireland (PRONI). 

10. Your rights under the Data Protection Act 2018 – UK GDPR

• You have the right to obtain confirmation that your personal data is being processed, and access to your personal data
• You are entitled to have personal data rectified if it is inaccurate or incomplete
• You have a right to have personal data erased and to prevent processing, in specific circumstances
• You have the right to ‘block’ or suppress processing of personal data, in specific circumstances
• You have the right to data portability, in specific circumstances
• You have the right to object to the processing, in specific circumstances
• You have rights in relation to automated decision making and profiling

The web link below will take you to the ICO website where you will find more information about your Rights under UK GDPR:

• ICO website - guide to UK GDPR

11. If you are unhappy with how any aspect of this Privacy Notice or how your personal data is being processed, please contact:

12. If you are still not happy, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO):

13. Changes to this Privacy Notice

We keep this Privacy Notice under regular review and we will place any updates on DE’s website page. This Privacy Notice was last updated on 25 May 2018.

14. Alternative Formats

If you need a copy of this Privacy Notice in an alternative format or language, please contact DE’s Data Protection Officer at the address above and we will do our best to provide you with it, as soon as possible.

15. DE has two offices, Rathgael House and Waterside House:

16. Other DE Privacy Notices

Teachers' Pay and Pensions Team

A Privacy Notice specifically relating to the work of TPPT can be viewed through this link:

TPPT - Privacy Notice

Analytical Services Unit

A privacy notice specifically relating to the work of ASU can be viewed through this link:

ASU - Privacy Notice

UK COVID-19 Inquiry Privacy Notice

UK COVID-19 Inquiry Privacy Notice