Processed lawfully, fairly and transparently

To obtain and process the information fairly, schools/ETBs must have legitimate grounds for collecting and using the data which are clearly explained to the data subject. It is important to have a Data Protection Policy in place to explain how the school/ETB uses the information.

Fairly obtaining data

To obtain data fairly the data subject (i.e. the living individual whom the data is about) must, at the time the personal data is being collected, be made aware of:

The name of the data controller (i.e. School/ETB)
The purpose in collecting the data (i.e. rationale for collecting the data) and any secondary uses of their personal data which might not be obvious to them
The persons or categories of persons to whom the data may be disclosed (e.g. Department of Education and Skills, other third parties operating in the education and welfare sphere including the National Council for Special Education, the National Education Welfare Board, NEPs, SESS, the HSE, TUSLA, An Garda Siochana etc), or other third parties with whom the School contracts, such as cloud-based school administration software companies, accountants, insurance companies, lawyers, etc.
Whether replies to questions asked are obligatory and the consequences of not providing replies to those questions (i.e. does the data subject have to answer the specific question and if not, what is the alternative to their not responding)
The existence of the right to access their personal data (i.e. that the individual has a right to access their personal data).
The right to rectify their data if inaccurate or processed unfairly.
Any other information which is relevant so that processing may be fair and to ensure that the data subject has all the information that is necessary so as to be aware as to how their data will be processed. The aim is to ensure that the school’s practices are open and transparent.

Fairly processing data

To process personal data fairly it must have been fairly obtained and the processing must be based on legitimate grounds.

A periodic review should be carried out of the various channels by which information is collected, (forms, website etc.) to ensure it is collected fairly.

Collection of Information via website cookies
If the school/ETB collects information from individuals via its website (e.g. cookies or “Contact us” forms), it is legally required to seek consent from the website user and have a privacy statement on its website. For further information on the legal requirements regarding websites and cookies, see our template Privacy Policy.