Schools may gather ‘clear and defined-purpose data’
The DPC has responded to criticism of its guidance to schools on data collection at pre-enrolment stage.
The watchdog said that it was a matter for each school to determine whether, and at what point in the enrolment or admission process, it was necessary to collect specific or special categories of personal data (relating to special needs, religion, ethnicity or other matters.
“Where there may be an obligation on a school to collect specific information about a child to assess special-needs provision, for example, this would give rise to such a necessity,” the DPC has clarified.
The initial DPC guidance, expresses concern that some schools collect too much information at the pre-enrolment stage.
‘Clear and legitimate purpose’
The DPC told the Law Society Gazette this morning (22 September) that it did not seek to restrict the data that schools collected.
Rather, the regulator said, it sought “to ensure that schools comply with data-protection law by only collecting personal data for which there is a clear and legitimate purpose, and by avoiding the collection of excessive or irrelevant data”.
The regulator accepted that, where there might be an obligation on a school to collect specific information about a child to assess special-needs provision, for example, this would give rise to such a necessity.
The DPC stated that its 28 August , ‘Processing Personal Data During Pre-Enrolment – What Schools Need to Know’, was published following engagement with a sample of schools to assist with identifying “the potential for the collection of excessive personal data in certain cases”.
Intention to ‘guide’ schools
The post was intended to guide schools in the ‘pre-enrolment’ stage, when parents express an interest in enrolling their child, the DPC said.
The guidance did not address the information that the schools would collect on admission (when the family accepts a place at the school), which would be more extensive, the data regulator added.
“Schools should only collect personal data of children at pre-enrolment for which they have a clear and defined purpose, and avoid collecting unnecessary additional information,” the data regulator said.
“It may be more appropriate to collect additional information once the child moves forward to the admission stage, and will become a student of the school,” the DPC commented.
The DPC published a for schools in late 2024, to help schools to understand and meet their data-protection obligations.