DATA PROTECTION POLICY

Rationale:

To function properly Watcombe Children’s Centre Nursery needs to collect and use certain types of information about staff, children and other individuals who come into contact with the nursery. We are also obliged to collect and use data to fulfil our obligations to SureStart and other bodies. The Data Protection Act 1998 specifies safeguards which must be adhered to concerning the collection, recording and use of data collected, whether on paper or on a computer, and we accept and conforms to these safeguards.

Strategies:

All personal information is only processed if it is:

· Needed for a specific purpose.

· Adequate, relevant and not excessive to its purpose.

· Accurate and kept up-to-date when necessary.

Information is only kept for as long as is necessary.

Certain records must be kept on the premises and some must be retained for a period of 2 years under Children’s Act Regulations. These are:

Registers, that is the daily record of the names of the children looked after, their hours of attendance and the names of the persons looking after them;

Accident Records;

Medication Records.

Complaints records will be kept for 10 years.

There is no general agreement about the length of time other records should be kept but current European Court of Human Rights judgements imply it could be as long as 21 years. However, as a minimum, records should be kept until after the next inspection.

We will ensure that people, whose information is held, are informed and have correct access to their information and the right to prevent processing in certain circumstances and the right to correct, rectify, block or erase wrong information.

All children’s records for the nursery will be kept in a locked cabinet in the main centre office.

We will treat everyone fairly whatever their age, religion, disability, gender, sexual orientation, ethnicity and so on when dealing with requests for information.

Any forms used to collect information concerning anything personal states the reason for collection, the purposes the data is held and the right to access. Information under Data Protection is available for inspection by prior appointment via the admin staff.

Data held in the computer concerning children and parents is regularly updated as necessary. Any data “challenged” as inaccurate will be marked as such until the inaccuracy has been resolved. If the dispute cannot be resolved, it will be referred to the Board of Directors and both sets of data kept.

Data such as children/staff that have left will be checked regularly and deleted as appropriate, and not kept longer than necessary. Any paper copies of information relevant to Data Protection is shredded and logged by admin staff.

If someone asks to check their data it is essential that they only receive information about themselves, therefore, a formal request form needs to be completed.

Authorised Legal Disclosures:

Normally we will only disclose information with the individual’s consent, however, there are some circumstances when we can disclose without consent.

These circumstances would include:-

1. Data requested by Sure Start as part of the monitoring process of the Centre.

2. Children’s data disclosed to authorised recipients in respect of the children’s health, safety and welfare.
3. Children’s data disclosed to parents in respect of their child’s progress, achievements and so on within the nursery.
4. Staff data disclosed to relevant authorities in respect of payroll and administrative matters – all staff information are kept locked in the office.
5. Unavoidable disclosures for example to an engineer during maintenance of the computer system – in such circumstances, the engineer would be asked to sign a form promising not to disclose data outside the nursery.
6. Only authorised and trained staff are allowed to make disclosures of personal data; these authorised people in Watcombe Children’s Centre Nursery include the Nursery Manager, or administrative staff.

Practical Measures:

· Physical Security – please see Site Security Policy.

• All office computer equipment is locked in the main office which has a punch code lock.
• Security software is installed on the computers which contain personal information and passwords.
• All staff and parents sign permission slips for photographs of children to be used.

Procedural Security:

Any queries or possible breaches of security should be referred to administrative staff in the first instance. A deliberate breach of the Data Protection Policy would be treated as a disciplinary matter.

Conclusion:

Watcombe Children’s Centre Nursery is committed to complying fully with the Data Protection Act and regular checks and monitors its procedures.

Data Protection – Access to personal data request

(Data Protection Act 1998 Section 7)

Date of Issue:

Enquirer’s surname:

Enquirer’s forename:

Enquirer’s address:

Enquirer’s postcode:

Telephone No.

Are you the person who is the subject of the records you are enquiring about YES/NO?

(I.e. the “Data Subject”)?

If NO, do you have parental responsibility for a child who is the “Data Subject” for the records you are enquiring about? YES / NO

If YES, name of child or children about whose personal data records you are enquiring:

Description of concern / area of concern:

Description of Information or topic (s) requested (in your own words):

Additional information:

Please despatch reply to: (if different from enquirer’s details as stated on form)

Name:

Address:

Postcode:

Data Subject Declaration:

I request that Watcombe Children’s Centre Nursery search its records based on the information supplied above under Section 7 (1) of the Data Protection Act 1998 and provide a description of the personal data found from the information described in details outlined above relating to me (or my child/children) being processed by the Nursery. I agree that the reply period will commence when I have supplied sufficient information to enable the Nursery to perform the search.

I consent to the reply being disclosed and sent to me at my stated address, the despatch name and address above which I have authorised to receive information).

Signature of the “Data Subject” (or Subject’s parent)

Name of “Data Subject” (or subject’s parent) (PRINTED)

© 2010