Data Protection Acts

See also the following policies: Multimedia: CCTV; Photographs and Camera Usage; Confidentiality: Record Keeping. 

Purpose

Our Lady’s Nursery will conform to the provisions of the Data Protection Act 1998 and the Data Protection (Amendment) Act 2003.

Scope

Under the provisions of the Act’s Our Lady’s Nursery has appointed a “Data Controller” to manage the storage of personal information about staff, children and families in its computerised and manual records. (Siolta Standard 8: Planning and Evaluation, Siolta Standard 9: Health and Welfare, Siolta Standard 12: Communication, Siolta Standard 15; Legislation and Regulation) (National Standard 4: Records)

Policy & Procedure

Our Lady’s Nursery will follow the following principles in relation to keeping data on:

• Obtain and process information fairly.
• Ensure that the data subjects know what information is being held about them and for what purpose
• Keep information for lawful purposes.
• Process information in ways compatible with the purpose for which it was given originally.
• Ensure that the information is adequate, relevant and not excessive.
• Retain the information no longer than is necessary.
• Give a copy of personal information to the individual concerned on request.
• Amend information held on employees if the employee indicates that the information is incorrect.
• Adhere to the ‘need to know principle’ – only personal data necessary for the purpose should be collected and staff should only be able to access the personal data that they need to carry out their functions.
• Have adequate access controls, firewalls and virus protection and do not forget manual files.
• Have retention policies for the various categories of data 

Informing Staff on Data Protection Acts

Our Lady’s Nursery Board of Mmanagement will ensure that:

• The basic principles of data protection are explained to staff and clients.
• There are regular updates to guidance material and staff training and awareness, so that data protection is a “living” process aligned to the way the Our Lady’s Nursery conducts its business.
• There are documented procedures, for example with regard to accuracy and have regular security reviews.
• They allocate responsibility for compliance and set-out what in-house sanctions may be imposed if correct procedures are not followed.
• They set out the circumstances in which personal data may be disclosed to third parties, including Gardaí and other enforcement agencies.
• They make staff aware that from October 2007 the principles of data protection apply to both computer and manual records, including those created before July 2003.

Our Lady’s Nursery will provide for:

• Periodic audit checks and reviews.

• A procedure for complaints handling.

• Plans for remedial steps if things go wrong.

• Privacy/Data Protection Statements on Forms and Websites and an internal    e-mail and Internet use policy.

Storage of data 

The security of personal information relating to children and families is a very important consideration under the Data Protection Acts.  Appropriate security measures will be taken by Our Lady’s Nursery against unauthorised access to this data and to the data it is collecting and storing on behalf of the OMCYA.

A minimum standard of security will include the following measures:

• Access to the information should be restricted to authorised staff on a “need-to-know” basis.

• Manual files will be stored in a lockable filing cabinet located away from public areas

• Computerised data will be held under password protected files with a limited number of users

• Any information which needs to be disposed of, will be done so carefully and thoroughly

• Premises will be secured when unoccupied 

Data collected on behalf of OMCYA for ECCE 

The personal information which parents will be required to provide on application forms for the above schemes including their Personal Public Service Number (PPSN) are protected by the Data Protection legislation.   

The following principles should be observed to ensure that the information supplied by parents meets the required levels of data protection.

Obtain and process information fairly

To fairly obtain the data, the data subject must, at the time the personal data is being collected, be made aware of the identity of the data controller/the purpose in collecting the data, and the persons or categories of persons to whom the data may be disclosed.  To fairly process the data it must have been fairly obtained and in this case, the data subject must have consented to the processing.

Parents who return completed forms to a service provider for the purpose of the ECCE scheme should be aware of and consent to the transmission of the information to the OMCYA.

Where a parent’s declaration is not verified by the OMCYA’s checks, a letter will be issued to inform them that the subvention applied for does not apply.  We will correct our register of the subventions due to parents, and supply the parent with the letter, stating that as a result we will not receive grant aid to reduce the fee charged. We will not retain this letter, or a copy of it, for more than 1 month.  If in the verification of information a parent disputes the outcome, they should contact the OMCYA directly.

Keep it only for one or more specified, explicit and lawful purposes & use and disclose it only in ways compatible with these purposes

Under data protection legislation, Our Lady’s Nursery will only keep data for specific, lawful and clearly stated purposes and the data will only be processed in a manner compatible with the purpose(s).

In this case, only information required on the ECCE official form is to be requested from parents for the purposes of the scheme.  We will not retain copies of this form which will be forwarded to the OMCYA. Unless otherwise directed. 

The information contained in these forms should not be used for further purposes or disclosed to third parties, other than the OMCYA, by St Brigid’s Day Nursery.  Requests for information from third parties should be referred to the OMCYA for reply.  The PPSN in particular is also protected under Social Welfare legislation.

Retain the information for no longer than is necessary for the purpose

In order to comply with this requirement, Our Lady’s Nursery will comply with the retention period set out for these schemes by the OMCYA.  

Data collected through Garda Vetting

Our Lady’s Nursery process their Garda Vetting requests through the HSE for employees.  Our Lady’s Nurseryunderstand that sensitive information may be identified through Garda Vetting.  In the event that an employee’s Garda vetting raises concerns the information will be dealt with on a confidential basis.  Our Lady’s Nursery appointed liaison person in relation to Garda vetting will share the information with the Manager. The Manager with the liaison person will meet with the employee to address the concerns in relation to Gardaí Vetting.  All information pertaining to such a situation must be stored in the same way as other data.  

Our Lady’s Nursery will not pass on a copy of an employee’s Garda Vetting Form to any other party. 

Dealing with Access Requests

Our Lady’s Nursery will ensure that that they follow the guidelines set down by the Data Protection Office. Every individual about whom a data controller keeps personal information has a right to request a copy of the data which is kept about them.  The service provider should only hold limited personal information on an individual. A copy of this information should be included along with other personal information held about the individual making the access request.  

On making an access request any individual about whom you keep personal data is entitled to:

• a copy of the data you are keeping about him or her
• know the categories of their data and your purpose/s for processing it
• know the identity of those to whom you disclose the data
• know the source of the data, unless it is contrary to public interest
• know the logic involved in automated decisions