EA's Privacy Notice For Children & Young People and Their Parents/Families/Carers/Legal Guardians

The Education Authority (EA) collects, uses and is responsible for certain personal information about you. The EA takes your privacy very seriously. Please read this privacy notice carefully as it contains important information on who we are, how we collect, store, use and share your personal information and what your information rights are.

When we collect or use your personal information, we are subject to the UK General Data Protection Regulation (UK GDPR) and Data Protection Act 2018 (“data protection laws”) and we are responsible as the “data controller” of that personal information. As a data controller, we are required to notify you of the information contained in this privacy notice.

This privacy notice applies to children & young people and their parents/families/carers/legal guardians. We may update this notice at any time but if we do so, we will inform you as soon as reasonably practicable.

When collecting personal information from you we will inform you whether you are required to provide certain information to us or if you have a choice in this. The majority of pupil information you provide to us is information which you are legally obliged to provide but some information is provided to us on a voluntary basis.

It is important that you read and retain this notice, together with any other privacy notice or statement we may provide on specific occasions when we are collecting or processing personal information about you, so that you are aware of how and why we are using such information and what your rights are under the data protection laws.

If you have any questions about this privacy notice or how we handle personal information, please contact our Data Protection Officer (DPO) who monitors the EA’s data protection procedures to ensure they meet the standards and requirements of the data protection laws.

The DPO can be contacted at the Education Authority, 40 Academy Street, Belfast, BT1 2NQ, by telephone at 028 8241 1300 or by email at dpo@eani.org.uk.

You have the right to make a complaint at any time to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection issues. The ICO’s details are as follows:

The Information Commissioner’s Office – Northern Ireland

3rd Floor

14 Cromac Place,

Belfast BT7 2JB

Telephone: 028 9027 8757 / 0303 123 1114

Email: ni@ico.org.uk

We collect personal information about children & young people and their parents/families/carers/legal guardians either directly from you (in person, by telephone, written correspondence, text or email) or your child’s school or from cookies on our website.

We might also collect personal information from:

• The Department of Education
• other government departments or agencies
• examination boards
• previous schools attended by the child
• GPs and health care providers.

Personal information is information that identifies you and relates to you. We will collect, store and use the following categories of personal information:

• Personal information (such as name, age, date of birth, photographs)
• Contact information (such as correspondence address, email address, emergency contact information and telephone number)
• Attendance information (such as sessions attended, number of absences and absence reasons)
• Assessment information (such as statutory assessment process, GCSE and post-16 qualifications and standardised tests provided by commercial companies)
• Exclusion and behavioural information
• CCTV footage captured in school and other information obtained through electronic means
• Financial information (such as that contained within Student Finance applications)
• Non-sensitive characteristic information (such as free school meal eligibility)
• Special categories of personal information (such as ethnicity, language, country of birth, nationality, sexual orientation, biometric information, information regarding health, special educational needs, allergies and disability).

We will collect, store and use the following categories of personal information about parents/families/carers/legal guardians:

• Personal information (such as name, age, date of birth and photographs)
• Contact information (such as correspondence address, email address and telephone number)
• Financial information (such as bank account details and details of income and savings as provided in Student Finance applications)
• CCTV footage and other information obtained through electronic means 3
• In limited circumstances we may collect, store and use special categories of personal information about parents/families/carers/legal guardians (such as ethnicity, language, country of birth, nationality, information regarding health, allergies and disability).

Under data protection law, we can only use your personal information if we have a proper reason to do so.

Most commonly, we will use personal information relating to children & young people and their parents/families/carers/legal guardians where it is needed for us to perform a task in the public interest and exercise our authority as a public body.

We will also use personal information relating to children & young people and their parents/families/carers/legal guardians where we need to comply with our legal obligations. We collect and use information under the Education Act (Northern Ireland) 2014 and other legislation. You may find the specific legislation on the Department of Education website.

In some cases we may use personal information outside the scope of our tasks as a public authority where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests. For example, the EA has a legitimate interest in safeguarding and promoting a child’s welfare.

We may also use your personal information, less frequently to protect a child or their family’s (or someone else's) interests. For example, when investigating a complaint made by another child.

We keep personal information electronically on our information management systems, IT network, or manually in indexed filing systems. Situations in which we will use personal information, including special category information, include:

Whilst the majority of the personal information provided to the EA is required for us to perform a task in the public interest and exercise our authority as a public body, to comply with our legal obligations or for our legitimate interests (or those of a third party), some of that information is provided on a voluntary basis through parental consent (namely, a parent’s/carer’s/legal guardian’s express agreement). A child aged 13 or over is considered capable of giving consent themselves and will not require express agreement from a parent/carer/legal guardian. However, if a child is not considered capable of giving consent themselves (for example, due to an identified special educational need), an adult with parental responsibility may exercise the child’s data protection rights on their behalf.

Where we need your consent (for example, EATV filming or medical consents for activities at Magilligan Field Centre), EA will provide the person with parental responsibility for a child or, if aged 13 or over and capable of giving consent, the child themselves, with a specific and clear notice which explains the reasons why the personal information is being collected and how the personal information will be used. You should be aware if you do not consent to our collection of this type of data, it will not affect the standard of the service we deliver.

If we ask for your consent to use personal information, you can take back this consent at any time. Please contact the DPO if you would like to withdraw any consent you have given.

Please be aware that we do not need to obtain parental consent if personal information is to be processed for the purposes of obtaining counselling services for the child.

We will only keep your personal information for as long as necessary to fulfil the purposes for which we collected it, including for the purposes of satisfying any legal, accounting, or reporting requirements.

We do not store personal information forever; we only hold child and parent/family/carer/legal guardian information for as long as we are legally able to do so.

Personal information relating to children & young people and their parents/families/carers/legal guardians is stored in line with is stored in line with the EA’s Retention and Disposal of Records Schedule, which is available online at EA Privacy Notices or can be requested by telephone by calling 028 8241 1300 or by emailing dpo@eani.org.uk. This sets out information about how long we keep personal information.

In some circumstances we may anonymise your personal information so that it can no longer be associated with you, in which case we may use such information without further notice to you.

We have put in place appropriate security measures to protect personal information and prevent it from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal information to those employees, agents, contractors and other third parties who have a need to know. They will only process personal information on our instructions and they are subject to a duty of confidentiality.

We have put in place procedures to deal with a personal data breach and will notify you and any applicable regulator (currently the Information Commissioner’s Office) of a breach where we are legally required to do so.

We may have to share a child’s or young person’s or their parent’s/family’s/carer’s/legal guardian’s personal data with third parties, including third-party service providers and other bodies such as:

• The child’s school or education establishment
• Any schools previously attended by the child • Any schools to be attended by the child
• The Boards of Governors in relation to the above-named schools
• The Department of Education
• Northern Ireland Council for Curriculum Examinations and Assessments
• Council for Catholic Maintained Schools
• Northern Ireland Council for Integrated Education
• Comhairle na Gaelscolaíochta
• Northern Ireland Commissioner for Children and Young People
• General Teaching Council for Northern Ireland
• Controlled Schools Support Council
• The Governing Bodies Association
• Middletown Centre for Autism
• Youth Council for Northern Ireland
• Exceptional Circumstances Body
• Libraries NI
• Department of Health, Public Health Authority and Health & Social Care Trusts
• PSNI
• Legal Representatives
• Data Systems such as KACE Service Desk
• Examination Boards such as AQA, CCEA and Excel
• Commercial standardised test providers
• Student Finance NI
• Other government departments, non-governmental public bodies and agencies.

We may disclose and exchange information with law enforcement agencies and regulatory bodies to comply with our legal and regulatory obligations.

We will only share your personal information with third parties where there is a lawful basis for doing so. We may share your personal information where it is necessary for the performance of our statutory functions or because we are legally obliged to do so. For example we are required to share personal data of a child or young person with the Department of Education on a statutory basis. This information sharing underpins funding and educational attainment policy and monitoring.

We may also share your personal information where we are satisfied that it is necessary to do so for a legitimate interest purpose pursued by EA or a third party. For example, the EA has a legitimate interest in sharing personal information for the purpose of safeguarding and promoting a child’s welfare. EA may also share your personal information with other public authorities where it is necessary to do so for the purposes of a legitimate interest (such as fraud prevention).

EA may share your personal information with law enforcement authorities (including the PSNI and Northern Ireland Government Departments) where we have a legal obligation to do so or because there is a legitimate interest in doing so for the prevention or detection of crime or for the apprehension or prosecution of offenders.

There may also be some circumstances in which it will only be appropriate to share your personal information if you have consented to us doing so.

We also use data processors, who are third parties that process personal information on EA’s behalf to enable us to provide our services. We have contracts in place with our data processors which confirm that they cannot do anything with your personal information unless we have instructed them to do it.

We will not transfer the personal information we collect about you to any country outside the UK without telling you in advance that we intend to do so and what steps we have taken to ensure adequate protection for your personal information in those circumstances.

If we intend to make decisions based solely on automated processing (i.e. decisions made by automated means without any human involvement), including profiling, that have legal or similarly significant effects on you, we will make you aware of this, provide meaningful information about the logic involved in the process, explain the significance and envisaged consequences, and explain how you can ask for a review of such decisions.

It is important that the personal information we hold is accurate and current. Please keep us informed if your personal information changes during your relationship with us.

Under the data protection legislation, you have certain rights in relation to the personal information that we hold about you. Under certain circumstances, a child (who is competent to do so) or young person or a parent/carer/legal guardian has the right to:

• Request access to personal information (commonly known as a "data subject access request"). This enables you to receive a copy of the personal information we hold about you and/or your child and to check that we are lawfully processing
• Request correction of the personal information that we hold about you and/or your child. This enables you to have any incomplete or inaccurate information we hold corrected.
• Request erasure of personal information. This enables you to ask us to delete or remove personal information where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal information where you have exercised your right to object to processing (see below).
• Object to processing of personal information where we are processing for a task in the public interest or exercise of our authority as a public body, or relying on a legitimate interest (or that of a third party) and there is something about your particular situation which makes you want to object to processing on these grounds. You also have the right to object where we are processing you and/or your child’s personal information for direct marketing purposes.
• Request the restriction of processing of your personal information. This enables you to ask us to suspend the processing of personal information about you, for example if you want us to establish its accuracy or the reason for processing it.
• Request the transfer of your personal information to another party.

We may need to request specific information from you to help us confirm your identity and ensure your right to access the personal information (or to exercise any of your other rights). This is another appropriate security measure to ensure that personal information is not disclosed to any person who has no right to receive it.

If you write to us about your child, we may ask you to confirm your identity as their parent/legal guardian before we can action your correspondence. Further, we may ask you to provide evidence that they have given you their consent to write to us on their behalf, because, under data protection law, their personal information belongs to them and we may need evidence of their consent before we action your request.

You will not have to pay a fee to access your personal information (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances.

Please contact the EA if you wish to exercise any of the above rights by telephone by calling 028 8241 1300 or by emailing dpo@eani.org.uk.

The EA has published further privacy notices (including privacy notices for the general public and for EA employees) which are available online at EA Privacy Notices.  

This privacy notice was published on 25 May 2018 and last updated on 2 August 2023.