Privacy Notice

The Education Authority (EA) is the data controller of the personal information you provide to us. This means we are responsible for deciding how we hold and use the personal information we collect.

We are required under the General Data Protection Regulation (GDPR) to notify you of the information contained in this privacy notice.

This notice applies to all persons having contact with EA.

This privacy notice describes generally how we collect, store and use your personal information and what your information rights are, in accordance with the GDPR. When collecting information from you we will inform you whether you are required to provide certain information to us or if you have a choice in this.

We may update this notice at any time but if we do so, we will inform you as soon as reasonably practicable.

It is important that you read and retain this notice, together with any other privacy notice we may provide on specific occasions when we are collecting or processing personal information about you, so that you are aware of how and why we are using such information and what your rights are under the GDPR.

If you have any questions about this privacy notice or how we handle personal information, please contact our Data Protection Officer (DPO) who monitors EA’s data protection procedures to ensure they meet the standards and requirements of the GDPR.

The DPO can be contacted at the Education Authority, 40 Academy Street, Belfast, BT1 2NQ, by telephone at 028 8241 1300 or by email at dpo@eani.org.uk.

If you are unhappy with how EA have processed your personal data or that EA have not complied with your data protection rights, you can raise a Data Protection Complaint. Information of how to do this is available under Data Protection Complaints.

If you’re unhappy with our response, you can make a complaint to the Information Commissioner’s Office (ICO) or get advice from the ICO. Further details are available on how to contact the ICO via the ICO website.

We collect personal information about you either directly from you, your child’s school (where relevant) and sometimes third party agencies such as GPs and health care providers.

Personal information is information that identifies you and relates to you. We will collect, store and use the following categories of personal information about you:

• Personal information (such as your name)
• Contact information (such as correspondence address and telephone number)
• CCTV footage and other information obtained through electronic means
• Special categories of data (such as ethnicity, language, nationality)
   

The Education Authority collects and uses your personal information to enable us to fulfil our duties as a public service provider. For example:

• To ensure the provision of effective primary and secondary education
• To provide education support services (for example, to schools, Boards of Governors)
• To understand what we can do for you and inform you of other relevant services
• To deal with legal disputes to conduct data analytics studies to monitor performance of schools and external providers
• To respond to public consultations, complaints and enquiries
• To encourage, facilitate and promote shared education and the community use of school premises

Telephone Call-Recording

We may record incoming and outgoing telephone calls made to or from EA services for the following purposes:

• to improve customer service and staff training in relation to the delivery of EA services;
• to assist in the investigation and resolution of complaints / disputes; and
• to promote EA staff welfare and protect staff from abusive or nuisance calls

Where EA records telephone calls  for the purposes of improving customer service and staff training or to assist in the investigation and resolution of complaints / disputes, the lawful basis for this processing will be public task, as such processing will be for the purposes of ensuring the effective performance of our tasks in the public interest and exercise of our authority as a public body. Where EA records telephone calls for the purposes of promoting EA staff welfare and protecting staff from abusive or nuisance calls, the lawful basis for this processing will be legal obligation as EA has a legal duty of care to its employees. The additional condition for processing any special category data that may be recorded will be that the processing is necessary for a substantial public interest or for carrying out obligations and rights in the field of employment law.

Recordings will normally be retained for a period of 6 months but may be retained for longer if necessary for the purposes referred to above (e.g. to assist in the investigation and resolution of complaints / disputes). All recordings will be stored securely and will be securely disposed when they are no longer required.

The majority of the personal information you may provide to EA is provided on a voluntary basis. When collecting data, we will inform you whether you are required to provide this information or if your consent is needed. Where consent is required, we will provide you with specific and explicit information with regards to the reasons the data is being collected and how the data will be used.

You have the right to withdraw your consent for that specific processing at any time. To withdraw your consent, please contact our Data Protection Officer using the contact details stated above. Once we have received notification that you have withdrawn your consent, we will no longer process your personal information for the purpose you originally agreed to, unless we have another legitimate basis for doing so in law.

Personal information relating to employees, workers and contractors of EA is stored in line with the Public Record Office (NI) record management good practice guidance and our retention and disposal of records schedule. If you would like further information, please contact the DPO using the contact details above.

In some circumstances we may anonymise your personal information so that it can no longer be associated with you, in which case we may use such information without further notice to you.

We may have to share your personal information with third parties, including third-party service providers and other bodies such as:

• The Department of Education
• General Teaching Council for Northern Ireland
• Legal representatives
• Health & Safety Executive
• PSNI

We will share your personal information with third parties where required by law, or where we have another legitimate interest in doing so.

EA has robust processes in place to ensure that the confidentiality of personal information is maintained and there are stringent controls in place regarding access to it and its use. Decisions on whether EA releases personal information to third parties are subject to a strict approval process and based on a detailed assessment of:

• Who is requesting the personal information;
• The purpose for which it is required;
• The level and sensitivity of personal information requested; and
• The arrangements in place to securely store and handle the personal information.

To be granted access to personal information held by EA, organisations must comply with its strict terms and conditions covering the confidentiality and handling of the personal information, security arrangements and retention and use of the personal information.

We will not transfer the personal information we collect about you to any country outside the EA without telling you in advance that we intend to do so and what steps we have taken to ensure adequate protection for your personal information in those circumstances.

It is important that the personal information we hold about you is accurate and current. Please keep us informed if your personal information changes during your working relationship with us.

Under GDPR, you have the right to request access to information about you that we hold. To make a request for your personal information, contact the DPO using the contact details stated above.

We may need to request specific information from you to help us confirm your identity and ensure your right to access the information (or to exercise any of your other rights). This is another appropriate security measure to ensure that personal information is not disclosed to any person who has no right to receive it.

You also have the right to:

• Request access to personal information (commonly known as a "data subject access request"). This enables you to receive a copy of the personal information we hold about you and to check that we are lawfully processing it. You will not have to pay a fee to access your personal information (or to exercise any of the other rights). However, we may charge a reasonable fee if your request for access is clearly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances.

• Request correction of the personal information that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected.
• Request erasure of your personal information. This enables you to ask us to delete or remove personal information where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal information where you have exercised your right to object to processing (see below).
• Object to processing of your personal information where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground. You also have the right to object where we are processing your personal information for direct marketing purposes.
• Request the restriction of processing of your personal information. This enables you to ask us to suspend the processing of personal information about you, for example if you want us to establish its accuracy or the reason for processing it.
• Request the transfer of your personal information to another party.