This notice should be read in conjunction with our corporate privacy notice.
Who are we?
North Yorkshire Council is a ‘Data Controller’ as defined by Article 4(7) of the UK General Data Protection Regulation (UK GDPR).
What personal information do we collect?
In order to deliver education and skills and children and families service to our residents, we need to collect both personal and special category data depending on the specific service being delivered.
Personal data may include:
- name and contact details
- addresses
- date of birth
- case history
- financial information
- family and relationship details
- educational information (for example, qualifications)
- photographs or video recordings
Special category data may include:
- racial or ethnic origin
- religious or philosophical beliefs
- health information
- sex life information
- sexual orientation information
- health and safety information
Criminal conviction and offence history data may include:
- criminal offence data (including Disclosure Barring Service (DBS), Access NI or Disclosure Scotland checks)
Why do we collect your personal information and what is our lawful basis for processing?
We need to collect this information in order to fulfil our obligations in regard to the provision of the following services:
Service
Adult learning and skills service
Purpose
The adult learning and skills service (ALSS) is part of our education and skills department and is a government-funded special educational needs (SEN) provider. Adult learning and skills service provide adult learning opportunities for people who are 19 years of age or older as well as specialist further education for young people aged between 16 and 25 with physical disabilities and/or learning disabilities.
Lawful basis
UK GDPR Article 6 (1)(a) - processing is under consent where you have opted in to receive general updates from our service, such as newsletters or marketing material
UK GDPR Article 6(1)(c) - Processing is necessary for compliance with a legal obligation to which the controller is subject
UK GDPR Article 9(2)(g) – The processing of your special category data is necessary for reasons of substantial public interest (with a basis in law), meeting Schedule 1, Part 2 of the Data Protection Act 2018 as below:
- (16) Support for individuals with a particular disability or medical condition
- (8) Equality of opportunity or treatment
Service
Consultation and surveys
Purpose
Education and skills undertake consultations and surveys on occasion, specifically where there are statutory requirements to do so. These consultations cover a variety of situations, however, to ensure that duplicate surveys are not completed and to establish connections to the focus of the consultations, minimal personal information is collected. The feedback will be anonymised when reporting is undertaken.
Lawful basis
UK GDPR Article 6(1)(e) - processing is necessary for the performance of a task carried out in the public interest
Service
Elective home education
Purpose
The elective home education (EHE) team has a duty to ensure all children and young people who are electively home educated in North Yorkshire are receiving an efficient suitable full-time education for the child’s age ability and aptitude as set out in DfE Guidance 2019 ‘elective home education: departmental guidance for local authorities.
Lawful basis
UK GDPR Article 6 (1)(c) - processing is necessary for compliance with a legal obligation to which the controller is subject;
UK GDPR Article 6(1)(e) - processing is necessary for the performance of a task carried out in the public interest;
UK GDPR Article 9(2)(g) - the processing of your special category data is necessary for reasons of substantial public interest (with a basis in law), meeting Schedule 1, Part 2 of the Data Protection Act 2018 as below:
- (6) Statutory and Government purposes
UK GDPR Article 9(2)(h) - processing is necessary for the purposes of the provision of health and social care
Service
Free school meals
Purpose
The school welfare team are responsible for the assessment of free school meal eligibility.
Lawful basis
UK GDPR Article 6 (1)(c) - processing is necessary for compliance with a legal obligation to which the controller is subject
UK GDPR Article 6(1)(e) - processing is necessary for the performance of a task carried out in the public interest
Service
School admissions and home to school transport
Purpose
The school admissions and transport eligibility team are responsible for administering the process of allocating school places and, if applicable, assessing eligibility of home to school transport.
Lawful basis
UK GDPR Article 6 (1)(c) - processing is necessary for compliance with a legal obligation to which the controller is subject
UK GDPR Article 6(1)(e) - processing is necessary for the performance of a task carried out in the public interest
Service
Grow and learn
Purpose
We, alongside health professionals from Harrogate and district foundation trust and education settings are working together to help children grow and learn with a particular focus on children’s speech, language and communication needs. We will be running a pilot called “grow and learn” in the Whitby and East Ryedale areas over the next 12 months with programmes designed to help improve these important skills.
Lawful basis
UK GDPR Article 6(1)(e) - processing is necessary for the performance of a task carried out in the public interest
UK GDPR Article 9(2)(h) - processing is necessary for the purposes of the provision of health and social care
Service
Grow and learn text service
Purpose
This service will inform parents about services they can use at the library, the times and dates of baby sessions at their local library and giving tips on reading, singing and chatting to their baby.
Lawful basis
UK GDPR Article 6 (1)(a) - processing is under consent where you have opted in to receive general updates from our service, such as newsletters or marketing material.
Service
Holiday activities fund
Purpose
The Department for Education has made funds available to every local authority in England to coordinate free holiday club provision, including healthy food and enriching activities, for children on benefits-related free school meals for the Easter, Summer and Christmas holidays. We have engaged with a number of providers to offer engaging and enriching activities for eligible children in school years reception to Year 11.
Lawful basis
UK GDPR Article 6(1)(e) - processing is necessary for the performance of a task carried out in the public interest
UK GDPR Article 9(2)(h) - processing is necessary for the purposes of the provision of health and social care
Service
Music services
Purpose
The music service provides musical instruments and tuition. It stores and processes your data in order to fulfil its contractual obligations with music service users.
Lawful basis
UK GDPR Article 6(1)(b) – processing is necessary for a contract the controller has with an individual
UK GDPR Article 6(1)(c) - processing is necessary for compliance with a legal obligation to which the controller is subject
UK GDPR Article 9(2)(g) – The processing of your special category data is necessary for reasons of substantial public interest (with a basis in law), meeting Schedule 1, Part 2 of the Data Protection Act 2018 as below:
- (16) support for individuals with a particular disability or medical condition
- (8) equality of opportunity or treatment
Service
Specialist careers service
Purpose
The specialist careers service is a traded service which mainly provides specialist careers information, advice and guidance to children and young people with special educational needs and/or disabilities, high needs pupils and those with additional support needs.
Lawful basis
UK GDPR Article 6(1)(e) - processing is necessary for the performance of a task carried out in the public interest;
UK GDPR Article 9(2)(g) - processing is necessary for reasons of substantial public interest with processing meeting Schedule 1, Part 2 of the Data Protection Act (2018) as below:
- (6) Statutory and Government purposes
- (16) Support for individuals with a particular disability or medical condition
Service
Virtual school
Purpose
The virtual school is a statutory service which consists of all the children in care of North Yorkshire, whether they are placed in a North Yorkshire school or elsewhere in the country. The virtual school is a specialist support team responsible for raising the attainment, progress and aspirations of North Yorkshire's looked after children and previously looked after children.
Lawful basis
UK GDPR Article 6 (1)(c) - processing is necessary for compliance with a legal obligation to which the controller is subject
UK GDPR Article 9(2)(h) - processing is necessary for the purposes of the provision of health and social care
Service
Inclusion service
Purpose
The inclusion service is responsible for carrying out duties under the Children and Families Act 2014 in relation to statutory assessment processes and the ongoing monitoring of children and young people who have an education, health and care plan.
Lawful basis
UK GDPR Article 6 (1)(c) - processing is necessary for compliance with a legal obligation to which the controller is subject
UK GDPR Article 9(2)(g) - processing is necessary for reasons of substantial public interest with processing meeting Schedule 1, Part 2 of the Data Protection Act (2018) as below:
- (8) Equality of opportunity or treatment
Service
SENDIASS
Purpose
The Special Educational Needs Disability Advice Support Service offers free, confidential and impartial information, advice and support to parents and carers of children and young people aged 0 to 25 with special educational needs and/or disabilities (SEND) and to young people aged 16 to 25.
Lawful basis
UK GDPR Article 6 (1)(c) -processing is necessary for compliance with a legal obligation to which the controller is subject
UK GDPR Article 6(1)(e) - processing is necessary for the performance of a task carried out in the public interest
UK GDPR Article 9(2)(c) - processing is necessary to protect the vital interests of the data subject or of another natural person where the data subject is physically or legally incapable of giving consent
UK GDPR Article 9(2)(h) - processing is necessary for the purposes of the provision of health and social care
Who do we share this information with?
In the course of delivering education and skills, we may need share your information with a number of external agencies who are key to delivering our services. These include:
- education providers, including educational establishments attended by your child(ren), early years providers, schools where we are providing tuition services in partnership with the school and other local authorities where children attend schools outside of North Yorkshire
- relevant regulatory authorities, such as Ofsted and the relevant examining bodies;
- the NHS or other healthcare providers
- local and central government agencies, such as the Department of Education, Department of Work and Pensions and the Arts Council
- coordinators and providers of holidays activities
- financial organisations who process payments on our behalf
- organisations we need to share information for safeguarding reasons, including the Police, Youth Offending Services and Adoption Agencies
- any other persons or organisations that parents, carers, or young person’s requests as part of the statutory process. Examples are sports coaches, physiotherapists, speech therapists, depending on the needs of the child.
We will also share data appropriately with other agencies in the following circumstances:
- where there is a serious risk of harm to you or others
- where there are concerns for the welfare of an adult at risk
- where a court requires us to share information about you
How long do we keep your information for?
Adult learning and skills service
| Data held | Retention period |
|---|---|
| Personal data | 6 years from financial year end after end of course or until 31 December 2030 if ESF-funded provision |
Consultation and surveys
| Data held | Retention period |
|---|---|
| SNAP survey results | 6 months after consultation concludes |
| Anonymised consultation responses / reports | Indefinitely |
Elective home education
| Data held | Retention period |
|---|---|
| Elective home education pupil records | 25 years from date of birth |
Free school meals
| Data held | Retention period |
|---|---|
| Records relating to free school meal eligibility | 6 years |
School admissions and home to school transport
| Data held | Retention period |
|---|---|
| Primary and secondary school admissions | 6 years |
| Primary and secondary school transport eligibility assessments | 6 years |
Grow and learn
| Data held | Retention period |
|---|---|
| School readiness file of intervention | 25 years from date of birth |
| Registration form | 5 years |
| WellComm and Early Talk Boost assessment information | 5 years |
Grow and learn text service
| Data held | Retention period |
|---|---|
| Contact list for texting | 6 months after person signs up or deleted once removed from the list |
Holiday activities fund
| Data held | Retention period |
|---|---|
| Applications for the holiday activity and food programme | 7 years from date of application |
Music services
| Data held | Retention period |
|---|---|
| Records relating to music tuition | 6 years after the last lesson received |
Specialist careers service
| Data held | Retention period |
|---|---|
| Data relating to children with special needs | 25 years from date of birth |
| Careers action plan | 25 years from date of birth |
Virtual school
| Data held | Retention period |
|---|---|
| Looked after children case files | 75 years from date of birth or 15 years from date of death (if the young person dies before the age of 18) |
Inclusion service
| Data held | Retention period |
|---|---|
| Data relating to children with special needs (EHCP plans and/or other related information) | 25 years from the child’s date of birth |
SENDIASS
| Data held | Retention period |
|---|---|
| Personal data and special category data relating to the child or young person places | 25 years from the child’s date of birth |
Other data that we may hold about you is only kept for as long as is necessary and all data is retained in line with our record retention and disposal schedule (RRDS).
Other relevant transparency information
The legislation, policies and guidance that relates to these services include, but is not limited to:
- Department for Education Guidance 2019 `Elective Home Education: Departmental Guidance for Local Authorities’
- Working Together to Safeguard Children 2018
- Children and Social Work Act 2017
- Children and Families Act 2014
- Local Government Act - Education and Inspections Act 2006
- Children Act 2004 Placement
- Care Planning, Placement and Case Review (England) Regulations 2010
- Education Act 1996
- European Conventions of Human Rights, Article 2 of Protocol 1
- Early Education and Childcare Statutory Guidance for Local Authorities
- Special Educational Needs and Disability (SEND) Code of Practice: 0 to 25 years
- Body of Persons Approval (BOPA)
- Localism Act 2011 section 1 (1)
- Apprenticeships, Skills, Children and Learning Act 2009
For more information about how we use your data, including your privacy rights and the complaints process, please see our corporate privacy notice.