Privacy Notices (formerly FPN)

Suggested text and guidance for issuing Privacy Notices

The Information Commissioner has recommended that the term 'Fair Processing Notice' be replaced by 'Privacy Notice'. The DCSF is therefore adopting this approach in its data collections from now on, and has reviewed the whole process of issuing Privacy Notices.

In the past, the suggested text has included the use of school information made available by the LA or the DCSF. However, the new process will mean much simpler Privacy Notices, where details of any organisations with which the LA and DCSF share data are contained on the LA and DCSF websites, with links from the Privacy Notices. This means that Privacy Notices do not need reissuing on an annual basis. The aim is to make the Privacy Notices issued to children and staff general and constant. Any changes to the details of organisations with which school or LA data is shared can be updated on the LA and DCSF websites.

To ensure this new approach to Privacy Notices works effectively:

The LA and/or DCSF will need to make hard copies of their website information available to those without web access.
The LA will need to include details of their Primary Care Trusts, Connexion Services and local ContactPoint services and other local bodies with which they share data.
The DCSF will include details of organisations it shares data with, such as Managing Information Across Partners (MIAP), Ofsted, the examination boards, the Training and Development Agency, the General Teaching Council for England, and the central ContactPoint organisation.

The new approach is that a single, short and easily understandable Privacy Notice can be provided to learners and staff by the school or LA at the same time as other communications that they issue. For example:

A learner might receive the Privacy Notice as part of a school brochure or induction pack, or in a school diary, and it could be posted on the school notice board.
For staff, the Privacy Notice might be included as part of a contract, induction pack, and posted on the staff notice board, etc.
A child receiving Social Care Services or a child looked after might receive their Privacy Notice as part of other information about the services that they are being offered.

It is anticipated that staff, and young people over the age of 12 with the maturity to make their own decisions, should generally be able to request to see their personal information themselves under the Subject Access Provisions (S.7) of the Data Protection Act. For children under 12, their parents will act on their behalf. In any event, it will be for the school, as data controller, to assess whether the child is capable of understanding the personal information in question, and so decide whether the parent needs to make the request on the child's behalf.

As always, these are only suggested texts and the DCSF recommends that your own legal advisors should review them so that they can be amended to suit local needs.