Inclusion and Youth Services (Including Additional Learning Needs) Privacy Notice

This notice sets out what the Inclusion and Youth Services Department of Powys County Council and the Welsh Government does with the education related information that it receives about children and young people. This is in accordance with data protection legislation (GDPR).

Introduction

The Inclusion and Youth Services Department in Powys County Council undertakes a wide variety of functions, and in doing so will gather personal data in order to complete these functions.

We are committed to protecting the rights of individuals in line with the current Data Protection Legislation. Therefore this notice is designed to give you information about the data we hold about children, young people and their families, how we use it, your rights in relation to it and the safeguards that are in place to protect it.

Why we collect your data

We collect and use the personal information of children, young people and their parents/carers so that members of the Inclusion and Youth Services Department can use the information to discuss their needs and give appropriate advice and support. Including:

• Council Officers,
• Educational Psychologists,
• Outreach Workers,
• Education Welfare Officers,
• members of our specialist Panels and
• other members of the Inclusion and Youth Services team as well as other Powys County Council colleagues and Health colleagues as appropriate

This may include the assessment of a child or young person if they have a learning difficulty, for example through an assessment as part of the local authority Individual Development Plan (IDP) process.

Information collected by us

Powys County Council, as a data controller, collects personal data in order to assess the needs of and to provide services to children, young people and families in Powys. We will only collect the personal data from you that we need in order to provide these services and process personal information in a fair and lawful way.

During our assessing and planning for support, and providing the most suitable educational provision, we collect the following information:

• Personal information - including name, address, contact details, date of birth, gender, parent/carer names and contact details
• Educational information - including school name, achievements and qualifications, progress data, attendance data and exclusion data
• Special category characteristics - including ethnicity, religion and medical information
• of additional learning needs (ALN) and disabilities and support provisions - including assessment scores, barriers to learning, strengths and needs, interventions, provisions, targets and intended outcomes
• Health information - including medical records, diagnoses, assessments of needs, professional opinions and records of involvement from health services
• Social Care information - including Looked After status, records of involvement from social care services and details of care arrangements or family circumstances
• Other information - including records of meetings, information given to us by families and information from voluntary agencies.

The information we collect may pertain to current or previous involvement from individuals and organisations.

We obtain this information in the following ways:

• Information provided by the child/young person and their family
• Information provided by schools, early years' education providers, Post-16 institutions and other education or training providers
• Information provided by other Powys County Council colleagues such as Social Care
• Information provided by health professionals
• Information provided by voluntary organisations.

Accurate information

It is important that we hold accurate and up-to-date information in order to assess the needs of the children, young people and families in Powys and ensure we deliver the most appropriate services. If any details have changed, or change in the future, please ensure that you tell us or ask the relevant school, health professional, care worker, or voluntary organisation to share this with us as soon as possible, so that we can update the records.

What is the lawful basis for processing the personal data

Legal obligation - It is necessary for us to gather and share some personal information in order to fulfil our legal obligations under the following legislation:

• Additional Learning Needs and Education Tribunal (Wales) Act 2018
• Additional Learning Needs Code (Wales) 2021
• Special Educational Needs Code of Practice for Wales 2002 (until 2025)
• Children and Families Act 2014
• Education Act 1996/2002

Public Interest - It is necessary for us to gather and share some personal information in order to exercise the Council's authority to carry out tasks in the public interest.  This could include ensuring equal opportunity and treatment and ensuring and reporting on the provision of education.

Request for local authority (LA) maintained IDP - It is necessary that you provide your consent for a referral for consideration of an LA IDP. In order to progress this request it will be necessary that we process your personal information. The legal basis for processing this information is in order to fulfil the legal obligation of our statutory duties as laid out in the ALN Act and Code. This will involve multi-agency information sharing but you will be provided with an opportunity to specify which agencies supporting your child you would like us to seek information from.

Access to other services and provisions from the Powys County Council Inclusion and Youth Services - It is necessary that you provide your consent for a referral to request support and in order to progress this request it will be necessary that we process your personal information. The legal basis for processing this information is in order to fulfil legal obligation of our statutory duties and to undertake tasks in the public interest.

Where additional services are accessed, your consent to the sharing of your personal information by this process is sought during the registration process. This is required in order to deliver those activities above and beyond our statutory functions and our public works.

When we will share your data

The Council will use your data for the purpose it was provided, and other compatible reasons to ensure children, young people and their families receive the services they are entitled to receive. This may involve sharing personal data within the Inclusion and Youth Services Department to ensure all appropriate support services are made available.

There may be occasions when personal information is shared, internally within the Council and also with external organisations where we are required to do so by law.  Or in order to undertake a multi-agency assessment.  Any information shared will only be on a need to know basis, with appropriate individuals. Only the minimum information for the purpose will be shared.

Council organisations we may share information with include:

• Admissions and Transport team
• Passenger Transport team
• Children's Services
• Adult Services
• Legal department
• Finance department

External organisations we may share information with include:

• Schools, early years education providers, Post-16 institutions and other education or training providers
• Flying Start
• Careers Wales
• Health professionals
• Education Tribunal for Wales (ETW)
• SNAP Cymru - if requested by families
• Private legal companies - if legal proceedings are commenced or families request that we communicate with their legal representatives.
• Other Local Authorities
• Welsh Government

We will not:

• Use personal information for marketing or sales purposes.
• Send or store data outside the European Union (unless in the situation of a family moving outside that geographical area)
• Make decisions about you based on automated processing

Data processors

Data processors are third parties who provide elements of our service for us, such as IT systems and suppliers who handle or collect personal data on behalf of the Council.

We have contracts and data processing agreements in place with our data processors. This means that they cannot do anything with your personal information unless we have instructed them to do so. They will not share your personal information with any organisation apart from the Council unless this is by prior agreement. Data processors are required to hold any personal information securely and to retain it for the period we instruct. Current data processors are:

• Ceredigion County Council - host provider of the Teacher Centre information management system
• Gwynedd County Council - host provider of the Tyfu Individual Development Plan software system
• CIVICA UK Ltd - data management software
• CareWorks (UK) Ltd (WCCIS) - data management software

The supplier of our information storage software systems may also have access to your data, this will only ever be used in the context of administering and supporting the system.

How we keep your data safe

We will take appropriate steps to make sure personal information we hold, in paper format or electronically, is kept securely and only used by people who are authorised to do so.

The Council's security measures include encrypting personal data and equipment, system access controls and training in data protection for all staff. The Council has internal policies in place to ensure data that it processes is not lost, accidently destroyed, misused, or disclosed. Furthermore, data is not accessed by employees except in the performance of their duties.

Where another company or organisation processes personal information on behalf of the Council, they will only process information in line with the Council's instructions.  They are obliged to provide security assurances to the Council.

How long will we keep data

We will only keep information for the minimum period necessary. The Council retention schedules outline the periods of time for which information for different purposes must be kept.

Your rights

Subject Access Request - you are able to make a request to see and be provided with a copy of information about you or your child that is being used by Powys County Council. This includes why information is being held and what sorts of decisions are being made using that information.

To make this request please fill in a Subject Access Request Form

Right to be informed - you have the right to be supplied with information explaining why and how we use your information. These notices are called Privacy Notices.

Right of rectification - you are entitled to have personal information put right or completed if you feel it inaccurate or not complete.

Right to be forgotten - you have the right to request that personal information about you is erased where we have no compelling reason to continue using it.

Right to block or restrict - you are able to ask that we stop using your personal information for certain reasons and in certain ways.

Right to portability - dependent upon the reasons and the way in which we use your information you may be entitled to obtain and reuse your information, to move your information from one IT system to another.  This applies only when it is information you gave us, you consented to us using it, or we are using it because of a contract, and the use of information is undertaken by a computer.

Right to object - you are able to object to us using your information in some cases, such as direct marketing.

Rights related to automated decision-making including profiling - where you are able to request human intervention in the decision-making process.

How to make an enquiry or lodge a complaint

The Council has a legal basis for gathering and processing of information necessary for the delivery of services.  You have the right to request that the Council stop or restrict using your personal data in relation to any Council service. However, this may cause delays or prevent us delivering a service to you.  Where possible, we will seek to comply with such requests, but this may not be possible where the Council is required to do so by law, to safeguard public safety, where there is a risk of harm and/or in emergency situations.

Contact details for enquiries:

Email Tyfu@powys.gov.uk Tel: 01597 827108.

The Council's Data Protection Officer can be contacted at information.compliance@powys.gov.uk and by phone on 01597 826400

For independent advice about data protection, privacy and data sharing issues, you can contact the Information Commissioner's Office (ICO) at:

Tel: 0303 123 1113 (local rate) or 01625 545 745 if you prefer to use a national rate number.

Alternatively, visit ico.org.uk or email by using the following link ICO.org.uk

This privacy notice does not provide exhaustive details of all aspects of our collection and use of personal information. However, we are happy to provide any additional information or explanation needed on request.