MANAGING YOUR PTA – Legal guidance FAQs Data protection
Victoria Cetinkaya from the Information Commissioner’s Offi ce (ICO) provides advice on how to comply with data protection law when using parents’ personal details and contacting them for fundraising...
We want to send out a letter asking parents for their email addresses so we can contact
them easily. Can we do this? Do we need to include any special wording? You can, as long as parents would reasonably expect to hear from the PTA by letter and they
haven’t asked you not to contact them. You should clearly explain why the PTA wants to collect the information and what you intend do with it, including what you’ll be using it to contact parents about. The PTA needs to give parents a choice and obtain their opt-in consent for you to contact them by email or SMS. The ICO has helpful guidance on this.
The school sends out a contact form every academic year. Should the PTA do the same? Absolutely! It would be good practice to do this on an annual basis to check the accuracy and
relevance of the information you hold. You can also use it to check parents’ preferences on how they’d like you to stay in contact with them – whether that’s by email, SMS, letter or not at all.
We keep a spreadsheet of parents’ email addresses and phone numbers – does our PTA
need to register as a ‘data controller’? As long as your PTA is working regardless of whether you have
charitable status – you are not required to register as a data controller. You still have to comply with the Data Protection Act 1998 though. Some of the principles relevant for PTAs require you to make sure that the information you hold is: Processed for limited purposes. Adequate, relevant and not excessive. Accurate and up-to-date. Not kept for longer than is necessary. Held securely. This includes keeping it safe so that unauthorised individuals
Many PTAs use Facebook to communicate with parents – is there anything we need to know? There are a variety of ways in which social media sites can be used to communicate – some of
which might be compliant from a data protection point of view, and some that will not be. Just because parents have a publicly accessible social media account it doesn’t mean organisations can use that information as they wish as parents might not want to be contacted in this way. As mentioned earlier, you need consent
can’t access it, and not disclosing it to anyone – including other parents – so if your PTA is emailing parents, make sure you use the ‘Bcc’ option to hide personal details from other recipients. Also, a new law is coming into force on 25 May 2018. The General Data Protection Regulation (GDPR) builds on the principles set out above, but in addition you’ll have to demonstrate that you comply with data protection laws, for example by having data protection policies and procedures in place, and keeping evidence of parents’ consent to use their details. The ICO has published guidance on how to prepare for this new law –
ico.org.uk/for-organisations/ guide-to-data-protection.
Is there any criteria for making sure that contact information is held securely? It depends what the risks are – for example, the nature of the data, how it is stored and the
harm that could be caused if the information was disclosed. I would suggest that if the information is just names and addresses, the database should be password protected. Those who have access to it should understand that they need to keep it safe and not let unauthorised people view or access it unless it is appropriate to do so.
from parents to be able to contact them electronically. However, if you set up a private group and let parents know the details, including how the PTA will use the group to contact parents, they can choose whether to join or not.
Last year we ran a PTA shopping night. I have been contacted by a local nursery to ask for details
of our stallholders – can I pass these on? No! Unless you made it clear, when you originally collected the stallholders’ data, that you may
share this with third parties, then you shouldn’t pass this on. I’d suggest that you email your stallholders to ask that they get in touch with the nursery direct if they want to be involved.
Are there any data protection issues with sharing photos or videos taken at PTA events? When taking photographs or videoing people in order to publish on your noticeboard or
website you should get their consent, explaining what you intend to do with the photograph/footage. For younger children, consent must be given by a parent or guardian on their behalf. Consent should not be necessary when photographing/ videoing a crowd where the individuals remain relatively anonymous. For more information, visit
ico.org.uk
pta.co.uk AUTUMN 2017 27
IMAGE: HANIERIANI/
THINKSTOCK.CO.UK
Page 1 |
Page 2 |
Page 3 |
Page 4 |
Page 5 |
Page 6 |
Page 7 |
Page 8 |
Page 9 |
Page 10 |
Page 11 |
Page 12 |
Page 13 |
Page 14 |
Page 15 |
Page 16 |
Page 17 |
Page 18 |
Page 19 |
Page 20 |
Page 21 |
Page 22 |
Page 23 |
Page 24 |
Page 25 |
Page 26 |
Page 27 |
Page 28 |
Page 29 |
Page 30 |
Page 31 |
Page 32 |
Page 33 |
Page 34 |
Page 35 |
Page 36 |
Page 37 |
Page 38 |
Page 39 |
Page 40 |
Page 41 |
Page 42 |
Page 43 |
Page 44 |
Page 45 |
Page 46 |
Page 47 |
Page 48 |
Page 49 |
Page 50 |
Page 51 |
Page 52 |
Page 53 |
Page 54 |
Page 55 |
Page 56 |
Page 57 |
Page 58 |
Page 59 |
Page 60
