General GDPR thoughts and ideas

[Hamantha]

Thanks Lauren!!

[Mouseketeer]

1 hour ago, Hamantha said:

It seems such a huge amount of work to record all this data ... I'm only on the children's spreadsheet and I've eaten all my chocolate already!

Welcome to the GDPR mad house Hamamtha ......running out of chocolate is a real tragedy ! 

[louby loo]

Well I've been to hall today- and all I can say it the scouts (well our group anyway) could be in big trouble considering the group that got fined over £42,000 over data protections leaks   ( I was only looking for a big bag  to borrow honest!!)

Anyway having a clear our of our cupboard it really got me thinking- in a kinda sad way.   

For many years we have had a travelling Ted complete with a diary that the children take home/holiday/days out,  then add photo and pictures etc. Do we now have to stop doing this, and maybe just send a blank card home with him?. We have books that go back years, and the children love looking through to find older siblings and cousins etc.  I guess I should be destroying all these now?  

 

I'm guessing much of this is a result of todays society that we live in,- and in years to come many people may want to be forgotten for who they  once were.

 

[finleysmaid]

5 minutes ago, louby loo said:

Well I've been to hall today- and all I can say it the scouts (well our group anyway) could be in big trouble considering the group that got fined over £42,000 over data protections leaks   ( I was only looking for a big bag  to borrow honest!!)

Anyway having a clear our of our cupboard it really got me thinking- in a kinda sad way.   

For many years we have had a travelling Ted complete with a diary that the children take home/holiday/days out,  then add photo and pictures etc. Do we now have to stop doing this, and maybe just send a blank card home with him?. We have books that go back years, and the children love looking through to find older siblings and cousins etc.  I guess I should be destroying all these now?  

 

I'm guessing much of this is a result of todays society that we live in,- and in years to come many people may want to be forgotten for who they  once were.

 

Well (and lets face it i am a GDPR novice!) Why are you collecting the data and for what purpose....to my mind you could say that this is for child development (EYFS) if you put in a processing note at the front of new books saying who has access etc then this might suffice????

Having read quite a lot today there doesn't seem to be much reference to stuff we already have ...just to the collection of future info...

[zigzag]

9 minutes ago, louby loo said:

Well I've been to hall today- and all I can say it the scouts (well our group anyway) could be in big trouble considering the group that got fined over £42,000 over data protections leaks   ( I was only looking for a big bag  to borrow honest!!)

Anyway having a clear our of our cupboard it really got me thinking- in a kinda sad way.   

For many years we have had a travelling Ted complete with a diary that the children take home/holiday/days out,  then add photo and pictures etc. Do we now have to stop doing this, and maybe just send a blank card home with him?. We have books that go back years, and the children love looking through to find older siblings and cousins etc.  I guess I should be destroying all these now?  

 

I'm guessing much of this is a result of todays society that we live in,- and in years to come many people may want to be forgotten for who they  once were.

 

Oh my goodness I hadn’t considered those points!  That would put a stop to Eric the Elf’s diary of adventure at Christmas time. ☹️  I also have several large floor sized and smaller photographic diaries of years gone by which our children love looking at, will I have to dispose of these now?😢😢

[zigzag]

Just going through a couple of my folders and come across development plans, parent questionnaires and staff meeting minutes from 2013 onwards that I have kept as evidence for Ofsted.  Now wondering if I should only be keeping recent (say current school year) things as evidence.  Any thoughts before I get the shredder out?

[FSFRebecca]

We've just posted #9 for those of you that are keeping up! 

[louby loo]

16 minutes ago, zigzag said:

Just going through a couple of my folders and come across development plans, parent questionnaires and staff meeting minutes from 2013 onwards that I have kept as evidence for Ofsted.  Now wondering if I should only be keeping recent (say current school year) things as evidence.  Any thoughts before I get the shredder out?

Once again I/we a really lucky with this one- because we had to reregister we have been told by ofsted NOTHING pre Feb 18 is 'ours' as it were.

The old owner has that responsibility.  We've had a big clear out of all our paperwork ready for collection for her to deal with. (Hence my time in hall this morning)

[Lauren]

As far as I understand it, you can't keep historical data if you don't have a lawful reason under the new rules. So, if you were relying on consent, and that consent was assumed then you'd need to go and get 'proper' explicit consent now. As a starting point for all the stuff you've been collecting for years, I'd go and have a look at what kind of agreement you got for it in the first place. If we look at the travelling ted pictures for example, did they know that that diary is shown to future year groups of children and that you intended to keep hold of the pictures, but they gave you them anyway? Do you have any proof of that? 

If you can't prove that you had explicit consent to hold onto the data, then maybe the next thing to think about is can the person actually be identified from it? So with pictures, the answer is probably yes, unless you start blurring out faces, but for things like questionnaires, you might be able to keep the answers as long as you remove the name.

I guess the final thing you might want to have a think about, is are you actually relying on consent? Maybe one of the other lawful reasons for processing will cover you? 

[finleysmaid]

6 minutes ago, Lauren said:

As far as I understand it, you can't keep historical data if you don't have a lawful reason under the new rules.

But loads of that stuff is collected for legal purposes...so therefore should be covered under legal rights. Minutes for meetings are supposed to be kept (according to the PSLA ) for 10 years Safeguarding information up until the child is 21 complaints for 10 etc etc all these should be covered shouldn't they? The GDPR rules don't explicitly talk about 'past' information that i can find...it only appears to deal with what we are going to collect from May. ????

[Mouseketeer]

[zigzag]

19 minutes ago, Mouseketeer said:

Me too Mousie!!  Where is Sunnyday and her balaclavas when you need one, think I might quite like to stick my head in one at the moment!

[louby loo]

52 minutes ago, Mouseketeer said:

Me too!

I think we should all have this picture on our ' Avitar -whatever you call it' like when you change your Facebook status 

[louby loo]

34 minutes ago, zigzag said:

Me too Mousie!!  Where is Sunnyday and her balaclavas when you need one, think I might quite like to stick my head in one at the moment!

Sunnyday had been very quiet (hope all is ok ) and is going to be in for a shock when she next logs in. 

[Rafa]

Oh my goodness!  This is thread is so helpful but also so mournful (is that a word?) - going dizzy!

I have loooaads of old photos of past little people in albums etc and occasionally we all Ooo and Ahhh in fond rememberance of when they attended and the great fun activities we did (long before paperwork was invented)

In those days we would never (rightly or wrongly) thought about consent!!  Looks like my whole working past  is about to be incinerated!!

On the bright side though shall be rather liberating and I shall have Rooooommmm in my office!! 

And thank you Rebecca and Lauren 😍

[Mouseketeer]

I’m not sure helpful is the right word Rafa...I think we’re raising more questions than we’re solving, It is Just as well Rebecca and Lauren are here to keep us grounded.

[finleysmaid]

i wouldn't go around destroying any photos as yet....there is still guidance to be confirmed!

[finleysmaid]

also if you had permission slips from parents to take photos then that may cover you i think!

[zigzag]

Is it wrong that last night I dreamt about GDPR then woke at 3am and thought of something else to change because of it🙄😳🤯

[FSFRebecca]

I think that we need to keep in mind the idea of what is 'reasonable'. When GDPR comes into effect you need to be compliant, it will be the law. If you have thoroughly audited how you collect, handle and manage data and have taken all necessary steps to ensure compliance then you are meeting the GDPR. For photos of children who left your setting years ago you may or may not have consent to share them with others. If you don't have consent for historical photographs then (personally) I wouldn't be sharing these out of my setting. I would, however, still let children and staff look at them together in the setting to talk about 'the good old days'  I would also make sure that they were kept in a safe place (maybe in a filing cabinet drawer) between 'shares'. For me, this would be ok because I would be using them in the manner that the original photographee would have understood was my purpose, and indeed probably took and gave me the picture themselves - and I would be prepared to argue that. I would make this a short term solution (maybe a term?) - in the meantime I would be getting consent for my 'travelling ted' book entries from my existing parents on behalf of their children so that I can continue to make the lovely books for the future. If I was in contact with any of the families in the old books I might just ask them to sign consent too, but I wouldn't be trawling the electoral roll to find children who left many moons ago. I certainly wouldn't be destroying anything! (Now I need to add all that to my own 'to do' list!) 

[Mouseketeer]

51 minutes ago, zigzag said:

Is it wrong that last night I dreamt about GDPR then woke at 3am and thought of something else to change because of it🙄😳🤯

Not as long as you tell us what it was in case we haven’t thought about it :-D 

I am going to do the educare training this morning so I can say I’ve done something  (apart from spending most of yesterday rearranging the office to fit another filing cabinet in and lots of research) 

I’d be interested to know for managers having to take this epic task on how many are going to be paid an increment, other staff get small increments for taking on roles but as manager I just seem to be expected to take all the extra work that comes along as part of the job’, I don’t remember seeing GDPR coordinator (or pensions coordinator for that matter) on my job description  

[Lauren]

16 hours ago, finleysmaid said:

But loads of that stuff is collected for legal purposes...so therefore should be covered under legal rights. Minutes for meetings are supposed to be kept (according to the PSLA ) for 10 years Safeguarding information up until the child is 21 complaints for 10 etc etc all these should be covered shouldn't they? The GDPR rules don't explicitly talk about 'past' information that i can find...it only appears to deal with what we are going to collect from May. ????

Yeah, so one lawful reason for processing is 'processing is necessary for compliance with a legal obligation to which the controller is subject', so if legally you have to keep minutes, then there's your reason - you don't have to get consent on top of that. 

I don't think the regulation specifically says anything about previously collected data either, but equally it doesn't say that 'from now you have to do a,b, and c (and d, and e, and f, and g....)'. It sounds as though if you want to process data then you have to follow these rules, regardless of when you got it. I don't know this for sure, but when I was looking into it, I saw a few articles that indicated that laws sometimes have  'grandfather provisions', which basically means a different rule for old cases, but GDPR doesn't have that. 

[louby loo]

I am beginning to look at this whole process as a form of 'Swedish Death Cleaning' and I might just go and and completely destroy anything and everything photo wise up until Feb this year!  It would be sad- but I guess at some point the stuff needs to go.

I think I am extremely lucky, as as I said before we had to re-register and are now technically 'new'..  I have repeatedly contacted previous owner to collect paperwork - but I'm thinking about the traveling ted type stuff and old photos. 

My other point is, what do I do with it if she fails to collect ? Quite frankly the way she's behaved towards the setting and staff- I am very tempted to just report them to the ICO myself and done with.

 

 

[starsky]

Hi 

I have another question....

When we take a general phone enquiry we used to log down parents details as well as an email or phone number. How will this work? Can a verbal request for the information count as permission for us to hold the data?

[FSFRebecca]

Hello starsky,

I think that if you make a note of contact details as a result of an approach to you regarding the service you offer then you have a legitimate reason to hold that data for a short period of time. This means that if they contact again or ask for further information you are able to fulfill their request. I would say that if they haven't visited, signed up or contracted you again in 4 weeks you should delete the data. Obviously, you should only use the data for the purposes it was sent to you - an enquiry about  a vacancy for example, not to advertise your summer fete!

[Mouseketeer]

I’ve gone with ‘legitimate interest’ for sustainability purposes for booking enquiries/forms.

[finleysmaid]

So ...hold on to your hats

Our lea have just sent us a 'sign up' to GDPR agreement for which they would like to charge us £95 a year! ....it appears from running through it to be a sort of insurance for doing what they should be doing in the first place!

I am both confused and furious in equal measure....watch this space ive sent a load of questions to them!!!!

[sunnyday]

2 hours ago, finleysmaid said:

So ...hold on to your hats

Our lea have just sent us a 'sign up' to GDPR agreement for which they would like to charge us £95 a year! ....it appears from running through it to be a sort of insurance for doing what they should be doing in the first place!

I am both confused and furious in equal measure....watch this space ive sent a load of questions to them!!!!

Crikey - that's all I can say really

[Stidston]

I was wondering if anyone had any ideas on how  paper visitors sheets are going to be used as I have googled it and a name on a sheet with others is a breach of data, I have looked at GDPR compliant visitors books but they are exhorbitant and we do not have internet for an online system. Any thoughts ????!!!!!

[SueFinanceManager]

30 minutes ago, Stidston said:

I was wondering if anyone had any ideas on how  paper visitors sheets are going to be used as I have googled it and a name on a sheet with others is a breach of data, I have looked at GDPR compliant visitors books but they are exhorbitant and we do not have internet for an online system. Any thoughts ????!!!!!

Visitors books were discussed in this thread