Local authority and school privacy notice

This privacy notice explains how Portsmouth City Council (the Council, we, us) collects, uses, shares and protects personal information relating to children, young people, parents/carers and others when delivering local authority education functions and working with schools and education providers. It is written to align with the Council’s corporate data protection privacy notice and complies with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and guidance from the Information Commissioner’s Office (ICO).

This notice should be read alongside the Council’s corporate privacy notice, which provides general information about how the Council processes personal data across all services.

• Data Controller: Portsmouth City Council (Registration Number Z5578313)
• Address: Civic Offices, Portsmouth, PO1 2AL
• Data Protection Officer (DPO) Email: DataProtection@portsmouthcc.gov.uk
• Telephone: 023 9282 2251

If you have questions about this notice, or want to exercise your rights, contact the DPO using the details above.

• Children and young people, including pupils in schools, early years settings, alternative provision and pupil referral units
• Parents, carers and guardians
• School staff and education professionals, where relevant to local authority functions
• Other individuals involved in education, safeguarding or support services

Depending on the service being provided, we may collect and process the following types of personal information:

• Identity and contact details (for example name, address, date of birth, unique pupil number and contact details)
• Family and household information (such as parent/carer details and relationships)
• Education and learning information (including attendance, attainment, assessments, exclusions and previous education settings)
• Special educational needs and disability (SEND) information
• Safeguarding and welfare information (such as involvement with professionals or court orders)
• Health-related information where relevant to statutory duties (for example for public health or SEND purposes)
• Characteristics (such as ethnicity, language or eligibility for free school meals)

Some of this information may be special category personal data under UK GDPR. We only process this information where the law allows and with appropriate safeguards in place.

We use personal information to enable us to carry out our statutory duties and public functions, including to:

• Deliver and manage education and children’s services
• Assess and support children and young people’s learning, development and wellbeing
• Identify and meet special educational needs
• Fulfil safeguarding and child protection responsibilities
• Plan, monitor and improve education services
• Meet legal and statutory reporting requirements
• Produce statistical information to inform funding, planning and performance (in a way that does not identify individuals)

Under UK GDPR, the main lawful bases we rely on are:

• Article 6(1)(c) – processing is necessary to comply with a legal obligation
• Article 6(1)(e) – processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority

Where we process special category personal data, we also rely on:

• Article 9(2)(g) – reasons of substantial public interest (for example safeguarding and equality of opportunity)
• Article 9(2)(h) – health or social care purposes, where applicable

In limited circumstances, we may rely on consent. Where we do, this will be clearly explained and consent can be withdrawn at any time.

We may share personal information with:

• Schools, academies, early years providers and further education providers
• Other Council services
• Government departments and agencies, including the Department for Education
• Health services and public health bodies
• Youth support services
• Safeguarding partners, including police and emergency services, where required by law
• Organisations providing services on our behalf

We only share information where it is lawful, necessary and proportionate, and we have appropriate data sharing and security arrangements in place.

We keep personal information only for as long as necessary for the purposes for which it was collected. Retention periods are set out in the Council’s corporate retention schedule and are based on legal and business requirements.

We take the security of personal information seriously. We use appropriate technical and organisational measures to protect information, including access controls, staff training and secure systems. Where information is processed by third parties on our behalf, they are required to meet our security standards.

Under data protection law, individuals have rights in relation to their personal information, including the right to:

• Be informed about how their information is used
• Access their personal information
• Request correction of inaccurate or incomplete information
• Request deletion of information, in certain circumstances
• Restrict or object to processing, in certain circumstances
• Data portability, where applicable

Some rights may be limited where information is processed to meet statutory duties.

If you have a complaint or query about how we collect and use personal information, if you would like a change to be made to your record, or want to object to processing, please contact us using the details above.

If you are not satisfied with our response, you can complain to the Information Commissioner’s Office (ICO):

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Tel: 0303 123 1113 (local rate) or 01625 545 745 (national rate)

We may update this privacy notice from time to time. Any significant changes will be published on the Council’s website.