Privacy Notice (Information Governance Team)

This privacy notice explains how the Education Authority (EA) Information Governance Team collects, uses, protects and otherwise processes your personal information when you contact us or when we process information as part of our statutory functions.

The Education Authority is the data controller for the personal information described in this notice. We are committed to protecting your privacy and handling your information lawfully, fairly, and transparently.

The Information Governance Team is responsible for managing:

• Data protection matters (including Subject Access Requests)
• Freedom of Information (FOI) and Environmental Information Regulations (EIR) requests
• Information governance advice and assurance
• Data breach management and reporting
• Records management and information rights compliance

We collect and use personal information to:

• check who you are, or confirm that someone has permission to act for you
• handle your request for information under the Freedom of Information Act 2000 or the Environmental Information Regulations 2004
• handle your request to access your own personal information or use any of your other data protection rights
• review information about you when it is included in someone else’s subject access request, where the law requires us to do so
• help the Education Authority meet its legal duties under data protection and information governance law
• give advice and support to EA staff and services on information governance issues
• look into complaints, incidents and concerns, including data breaches and concerns raised with the Information Commissioner’s Office
• respond to ICO enquiries, investigations, audits and complaints, and share information with the ICO where we are required or permitted to do so
• share information with the police or other bodies with investigation powers, where this is lawful and necessary to prevent or detect crime or support legal action
• share information with schools, health and social care bodies, government departments or other public authorities where this is lawful and necessary to protect you or someone else, including for safeguarding reasons
• use information to support decisions, improve our services and keep proper records of what we do
• We only collect personal information that is necessary and relevant for these purposes.

Depending on the nature of your contact with us, we may collect and process:

• Your name and contact details (such as email address, postal address or telephone number)
• Information contained in your request, correspondence or enquiry
• Information required to verify your identity and/or proof of authority to act on behalf of others (where legally required)
• Personal information relating to you or others that is included in records we are required to review or disclose. We encourage you not to provide more personal information than is needed.

We collect personal information:

• Directly from you (for example, via email, online forms, letters or telephone calls)
• From EA staff or services involved in responding to your request, or investigating your complaint or concern
• From schools or other public bodies, when lawful and necessary
• From third parties, where permitted by law

We process your personal information under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. 

Our lawful bases include:

• Legal obligation – to comply with FOI, data protection and records management legislation
• Public task – where processing is necessary to perform our statutory functions
• Legitimate interests

We rely on the following conditions as per Article 9 (2) of the UK GDPR:

•  vital interests, legal claims and judicial acts, substantial public interest – where applicable and lawful

Your personal information is:

• Accessed only by staff who need it to carry out their duties
• Stored securely in line with EA security.
• Retained for two years, unless there is an ICO investigation.
• Used only for the purposes described in this notice

We may share your personal data with other public bodies where this is lawful and necessary to help us carry out our duties, protect children and young people, support safeguarding, prevent or detect crime, or comply with legal and regulatory requirements. We may share your personal data with:

• Relevant EA services or staff
• Schools or Boards of Governors
• Other public authorities or regulatory bodies such as:
  •  ICO
  • Police Service Northern Ireland
  • Northern Ireland Housing Executive
  • Northern Ireland Public Services Ombudsman
  • Northern Ireland Audit Office
  • National Crime Agency
  • Health Trusts
  • Legal Services Agency
  • Government Departments
• We do not sell your personal information or share it for marketing purposes.

You have rights under data protection law, including the right to:

• Access your personal information
• Request correction of inaccurate information
• Request erasure or restriction of processing (in certain circumstances)
• Object to processing (where applicable)
• Lodge a complaint with the Information Commissioner’s Office (ICO)

Your rights are not absolute and may be limited where exemptions apply.

If you have questions about this notice, how we handle your personal information or wish to make a complaint, you can contact:

Information Governance Team
Education Authority
40 Academy Street
Belfast BT1 2NQ
Email: Further information on our data protection complaint process:  dpo@eani.org.uk.

We may update this privacy notice from time to time. The latest version will always be available on the Education Authority website. You can find more information on how EA handles your data in other services: EA Privacy Notices | Education Authority Northern Ireland.