General GDPR thoughts and ideas

[Mouseketeer]

2 hours ago, zigzag said:

Just completed the EDUCARE  GDPR course and beginning to read  all Rebecca’s informative posts ready to get to grips with it all over Easter!

Was it worth doing Zigzag?

[zigzag]

It gives all the info but not EY specific.  To be honest I think the information that Rebecca has posted is equally informative and obviously more EY specific.  I did it really as evidence of completing actual training.  As I say I am going to work through all Rebecca’s steps during the Easter holidays.  As a PSLA member it did on,y cost £7.

[C1403]

Hi all.

I have been looking at our registration form and I don't think we have to make too many drastic changes but I want to make sure we get the parental consent/privacy statement in regards to date correct....

 

Our current statement (at the bottom of our form re data protection states:

...... Pre school is the data controller for the purposes of the Data Protection Act. We collect information about your child and use this personal data to:

-Support your child's development

-Monitor and report on your child's progress

We are required by law to share some of this information to ...... Council as the LA and the Department of Education through the early years census. This information includes your child's name, date of birth, address, number of funded entitlement hours and personal characteristics such as ethic group and any special educational needs.

 

Can anyone that's got this far share their privacy/consent statement as I think we may need to elaborate more on how we use your data and why. 

We also have a policy regarding data we keep, why, how it is used and how long it is kept for. 

Sorry, I'd this seems long winded or confusing....I am the chair so don't really have much dealing with the day to day running, trying to help the manager out by making a start (and ensuring it gets done!)

Thanks 

[Mouseketeer]

Well done on being the Chair and helping to sort it out....I bet it’s mostly being left to managers to ensure everything is in place.

I have like you added a statement to all my forms I ask parents to sign and return but now am thinking everything on those forms would either come under legal obligation or legitimate interest which doesn’t (I don’t think) need consent which is the ‘lawful basis’ (I think - is that right Rebecca?)but if asking for consent (I think) we have to also make them aware they can withdraw their consent at any time and if they withdrew consent for those forms I wouldn’t be able to have their child in the setting. 

I think I might start with what we hold and what we use it for and decide if I can make a case for it under one of the ‘get out of consent’ cards before working out what I need consent for, so far I’ve only come up with photos and their pets names 

Apolgies for all the ‘thinks’ 

Edited April 1, 2018 by Mouseketeer

[finleysmaid]

just thinking about the 'stuff' we have lying around (!) what will we do with registers? it needs to be available for fire drills ..so does that make it exempt from being locked away!!! We also have contact details in the grab bag for safety reasons. ....very tempted to do an april fool about this !!!

[zigzag]

The more I look into the whole thing the more ridiculous the whole flaming thing gets.  I think we will do away with toys and just have filing cabinets filling the room for everything that has to be locked away!  A bet that it is mostly us managers getting to grips with this in our holiday, anyone going to put hours down to be paid for it? 🤣

[Mouseketeer]

must be a least triple time zigzag 

[louby loo]

On 22/03/2018 at 16:09, Panders said:

Yes, quite correct, Sunnyday - this came across good and strong at the training evening I went to.  Parental permission had to be specific.

Consent - must be clear, affirmative, informed, freely given and unambiguous.  You cannot bundle items together and no imbalance of power, i.e. if you don't consent......

one obvious minefield is photographs,   each type of photograph needs to be specific, ie.  May we use your child's photograph (no name) for promotional purposes, i.e. prospectus, website, twitter.

Do you consent to your child's photograph being published by the press or media

So, do you think a grid type table with info in each box that parent tick (or not)- then one signature would do?  

I'm trying to completely cut down on the size of my registration forms- mainly to take less room and save paper ink etc.

[louby loo]

On 01/04/2018 at 10:37, finleysmaid said:

just thinking about the 'stuff' we have lying around (!) what will we do with registers? it needs to be available for fire drills ..so does that make it exempt from being locked away!!! We also have contact details in the grab bag for safety reasons. ....very tempted to do an april fool about this !!!

Just posted about this on a different thread.  

But as a total packaway everyday this is something we are used to anyway.  We have a small Ikea 4 hole unit on wheels - big enough for LJ and other daily needed important paperwork. Would you be able to do something like this?  it doubles up as a small desktop for diaries, registers visitors book + room divider.

[Panders]

3 hours ago, louby loo said:

So, do you think a grid type table with info in each box that parent tick (or not)- then one signature would do?  

I'm trying to completely cut down on the size of my registration forms- mainly to take less room and save paper ink etc.

Yes that's the impression I got, you could do one A4 sheet and parents opt in or out and sign for what they agree with, on an individual basis, not a blanket one signature at the bottom - does that make sense?  We are all alike I feel in ticking "terms and conditions" when we are on the internet - how many of us actually do read through them all.   So I intend to keep it straightforward, I will allow particularly existing parents to take the sheet home and read through.  I am considering that for  new parents all forms will need to be re-designed so individual consents can be given.

or you could have individual consents within a one off document, ie. you decide to do face painting, or you need it for sunscreen each year.  I'm thinking I will not bamboozle my parents with lots of consents all at once, but as they come up.  We don't do face painting everyday or sunscreen during the winter months, etc., so those can wait until we do.    However, photographing happens all the time, we don't however, use them for anything more than their learning journeys, so that simplifies things a little, no websites or advertising or going into the press.

[zigzag]

I have spent the afternoon having a major clean out on the computer and memory sticks, it was actually quite cathartic!  Have also tweaked the welcome pack to try and shorten it down a bit and have begun looking at the application forms, which I think are actually ok.  Just need to add a fair processing note to the application forms and I think that bit is done. I have started working through the spreadsheet of data we hold that Rebecca posted but am not sure I am remembering everything!  Going to work tomorrow to have a major empty out of old paperwork.  Does everyone use a data shredding company? I was just going to shred and burn all my stuff, but now I am worried that this will not be sufficient.  What are the rules exactly?

[louby loo]

Thinking about all this,  it's a bit like when all the allergies stuff came into force a few years ago.  

I remember my husband coming home from work and asking me if I could make  another display poster (a copy of the preschool one) for him to give to the burger-van man near his workplace. The first the burger man new about it was when my husband asked him about it, after he'd helped me do ours.

[louby loo]

7 minutes ago, zigzag said:

I have spent the afternoon having a major clean out on the computer and memory sticks, it was actually quite cathartic!  Have also tweaked the welcome pack to try and shorten it down a bit and have begun looking at the application forms, which I think are actually ok.  Just need to add a fair processing note to the application forms and I think that bit is done. I have started working through the spreadsheet of data we hold that Rebecca posted but am not sure I am remembering everything!  Going to work tomorrow to have a major empty out of old paperwork.  Does everyone use a data shredding company? I was just going to shred and burn all my stuff, but now I am worried that this will not be sufficient.  What are the rules exactly?

I just burn mine.... I put that on audit sheet.  

[Mouseketeer]

35 minutes ago, zigzag said:

 What are the rules exactly?

You've got to swallow it zigzag...keep up  ....I think I read (somewhere) a cross-shredder is fine really, will try and remember where I read this.

[louby loo]

3 hours ago, zigzag said:

I have spent the afternoon having a major clean out on the computer and memory sticks, it was actually quite cathartic!  Have also tweaked the welcome pack to try and shorten it down a bit and have begun looking at the application forms, which I think are actually ok.  Just need to add a fair processing note to the application forms and I think that bit is done. I have started working through the spreadsheet of data we hold that Rebecca posted but am not sure I am remembering everything!  Going to work tomorrow to have a major empty out of old paperwork.  Does everyone use a data shredding company? I was just going to shred and burn all my stuff, but now I am worried that this will not be sufficient.  What are the rules exactly?

 

2 hours ago, Mouseketeer said:

You've got to swallow it zigzag...keep up  ....I think I read (somewhere) a cross-shredder is fine really, will try and remember where I read this.

We are all going to turn into some kind of coding experts like says........ in our diaries we will write thing like-     LK9.30AGreSALTtk30/50

[Mouseketeer]

Haha z=1, y=2.....and the desk diary will now have to be known as the drawer diary in case a tornado sweeps through the building and flips a page open .....I am taking this seriously, honestly 

[zigzag]

9 hours ago, Mouseketeer said:

Haha z=1, y=2.....and the desk diary will now have to be known as the drawer diary in case a tornado sweeps through the building and flips a page open .....I am taking this seriously, honestly 

We all need those secret diaries with the padlock on them like 10 year old girls have!  The more I go into it all, the  less able I am to take it totally seriously!!    Blooming good job Ofsted no longer require the SEF we are all far to busy with GDPR!  

I wonder if Ofsted will ask much about it in an inspection or not?

[louby loo]

26 minutes ago, zigzag said:

 

I wonder if Ofsted will ask much about it in an inspection or not?

Probably not even aware of it   

Not many people seem to be at the moment. My sister in law is involved with the WI and we were discussing  it at the weekend, she is on the committee (or something) and she did say she was vaguely aware and was looking into it for their group. 

I got an email form the virtual college about re-registering due to it, so I guess it is filtering through though. Hopefully  it might mean a lot less spammy type emails

My daughter had someone in to do training - they are a small company.  It was at the end Feb, she was  given 15 mins  notice and it was the first she'd heard of it.  It turned out it was a friend of the boss who had decided to launch his own  ' GDPR Training Sessions' and they were his guinea pigs!!  She still has no idea what it is!

[finleysmaid]

ok so ive skimmed through most stuff on here but haven't had the time to 'process' !! (first gdpr joke !)

so what Legal basis are we going for, for processing. I have completely freaked myself out. I am suggesting putting the business trustees as the processors and myself and admin as controllers. But having read the 'legal basis' info i am somewhat confused....we seem to come under several categories if you also add in the process of sensitive data for staff including criminal convictions then i'm really losing the plot.

Probably a load of drivel ...just needed to offload 

[zigzag]

14 minutes ago, finleysmaid said:

ok so ive skimmed through most stuff on here but haven't had the time to 'process' !! (first gdpr joke !)

so what Legal basis are we going for, for processing. I have completely freaked myself out. I am suggesting putting the business trustees as the processors and myself and admin as controllers. But having read the 'legal basis' info i am somewhat confused....we seem to come under several categories if you also add in the process of sensitive data for staff including criminal convictions then i'm really losing the plot.

Probably a load of drivel ...just needed to offload 

Stop confusing the issue with in depth questions!!  Where’s Rebecca when we need her😉

[finleysmaid]

1 minute ago, zigzag said:

Stop confusing the issue with in depth questions!!  Where’s Rebecca when we need her😉

have gone back to basics .....ICO stuff just too much to deal with this morning!

[FSFRebecca]

9 minutes ago, zigzag said:

Stop confusing the issue with in depth questions!!  Where’s Rebecca when we need her😉

Urm, eating chocolate. I'm here now ... I'll have a read through and then Lauren and I will be in to help 

I'm very proud of you all for your weekend work  

[finleysmaid]

8 minutes ago, Rebecca said:

Urm, eating chocolate. I'm here now ... I'll have a read through and then Lauren and I will be in to help 

I'm very proud of you all for your weekend work  

personally i'd keep eating the chocolate!!

[FSFRebecca]

Lauren and I are talking about this now:

We would say that in terms of consent and contract these are the differences:

• Consent: Things that you give parents a choice about but which are not 'deal breakers' for attendance e.g. knowing a child's religion - if a parent said "No, it's none of your business" then the child can still attend your setting, you just don't know what their religion is.
• Contract: Things which you write into your setting contract that you are not prepared to allow parents to 'opt out of' e.g. statutory framework requirements or storing their data on Tapestry

Permissions are slightly different.  You need to get permission as you always have done for certain things you want to do at nursery. However,this isn't always a thing under GDPR. If it concerns data about the child (e.g. they are allergic to sun cream), data about the parent (e.g. they don't want to receive your newsletter) or data about staff (e.g they don't want to tell you any medication they are taking) would come under GDPR. Permissions to go for a walk, or change a nappy or soiled clothing don't come under GDPR, but you get permission as you always have done to meet your other statutory requirements.

In terms of tick boxes, these do need to be individualised so that people can opt in or out of individual things. But they don't need to tick, sign and date every one. A series of ticks and one dated signature is ok. Just make sure you are being really clear about the choices that you are giving people.

In terms of registers during sessions, you are already controlling who is coming into your setting and who has access to that data. You don't need to lock it away while you are in session, lock it away when you are not there - because it is then, that you are not controlling who comes into your building.

Just to let you know, Lauren and I are looking at privacy notice forms and also enrolment forms and will post when we have something to share.

[Hamantha]

My first ever post - driven to it by the GDPR! 

I am ploughing my way through my spreadsheet (Thank you so much Rebecca!) but think I am starting to lose it...do we need to be thinking about and recording in our audit every time we have a child's name written down? I am thinking of where the managers have a list of when children's reports need to be done (we do ours every 6 months) - the list has child's full name, D.O.B.  and report dates and is just kept in a file in the office. 

It seems such a huge amount of work to record all this data ... I'm only on the children's spreadsheet and I've eaten all my chocolate already!

[zigzag]

21 minutes ago, Hamantha said:

My first ever post - driven to it by the GDPR! 

I am ploughing my way through my spreadsheet (Thank you so much Rebecca!) but think I am starting to lose it...do we need to be thinking about and recording in our audit every time we have a child's name written down? I am thinking of where the managers have a list of when children's reports need to be done (we do ours every 6 months) - the list has child's full name, D.O.B.  and report dates and is just kept in a file in the office. 

It seems such a huge amount of work to record all this data ... I'm only on the children's spreadsheet and I've eaten all my chocolate already!

If it wasn’t only 12:15 I would suggest alcohol to replace the chocolate!  Well done on your first post and welcome to the wonderful world that is this forum.  I seriously do not know what I would do without it.😃

[Hamantha]

Thanks for the welcome zigzag! I agree about the forum - it is so helpful!! Especially with the GDPR - Rebecca's series of posts on the subject have been invaluable.

As to a drink..I think another cup of coffee may help.

[FSFRebecca]

Welcome to the forum Hamantha, lovely to have you on board! 

You do need to document everything individually - sorry .... get more coffee

[Hamantha]

Thanks Rebecca (for clarifying this and ALL of your great GDPR advice). I'll keep on adding to my spreadsheets... might have to get some biscuits too! 

 

[FSFRebecca]

1 minute ago, Hamantha said:

Thanks Rebecca (for clarifying this and ALL of your great GDPR advice). I'll keep on adding to my spreadsheets... might have to get some biscuits too! 

 

Also Lauren is here- she's so GDPR!! Between us we have put these bits together - share the love!