This page sets out our privacy notice concerning school pupils' data and how we process it. It explains how we comply with General Data Protection Regulation (GDPR) regulations.
In accordance with General Data Protection Regulation (GDPR) which came into force on 25 May 2018, this notice sets out how Careers Wales manages and shares the education related information that it holds about young people up to the age of 18 who reside or are educated in Wales.
The information in this notice will be kept under review to incorporate any further changes communicated by the Information Commissioner’s Office (ICO) and updated versions will be available on our website careerswales.gov.wales.
In order to deliver our statutory function of the provision of careers advice and guidance to school pupils and the adult population in Wales, it is necessary for us to collect and use (or ‘process’) their personal data. The purpose of this notice is to allow us to be open, honest, and upfront about the purpose of why we collect your personal data, and also to identify the sources and type of data we receive from other organisations and how we share information the data we hold. This will provide confidence that the personal data we hold is being used in the right way and your privacy is protected.
Data Controller
Career Choices Dewis Gyrfa Ltd trading as Careers Wales is the data controller for the personal data we process. We are registered as a data controller with the Information Comissioner's Office (ICO), registration number: Z276256.
Purpose
The purpose of this privacy notice is to provide information about how we use, collect and share the data that we hold as a company.
1. Why we process the personal data
The purpose of processing personal data is to:
- Provide impartial careers advice, support and guidance to pupils between the age of 13 and 19 who are based in schools and colleges or home educated
- Inform you of events and training opportunities that maybe of interest to you
- Allow you to complete surveys and questionnaires to help us provide tailored career advice and guidance
- Inform you of apprenticeships or work related opportunities that maybe of interest to you
- Provide work experience placements
- Evaluate our services, both internally and externally
- Report on equality and diversity matters and to meet our public sector equality duties
- Help inform government policies
- Reduce the number of pupils in Wales who are Not in Education Employment or Training (NEET). Further information can be obtained by accessing the Welsh Government Guidance on the Youth Engagement and Progression Framework. Youth Engagement and Progression Framework: Handbook on the GOV.WALES website
- Produce statistics for the Welsh Government, for example destination surveys
- Allow you to transition smoothly from compulsory to post-compulsory education by providing appropriate and impartial information, support and guidance
- Help understand pupils’ aspirations. Career check is a survey which is done in year 10. It helps the careers adviser work out what individual support is needed. During the session they may also discuss labour market information or future options. We ask for consent to share this information with the school to allow them to understand learners’ aspirations
2. Our lawful basis for processing personal data
Our lawful basis for processing personal information is to deliver our statutory function of providing careers advice and guidance is:
Public Task, Article 6 (e) – Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
The primary legislation, regulations and guidance that supports this includes:
- Education (Work Experience) Act 1973
- The Education (Extension of Careers Education) (Wales) Regulations 2001
- Employment and Training Act 1973
- Education Act 1997
- The Learning and Skills Act 2000
- The Education (Special Educational Needs) (Wales) Regulations 2002
- Careers and the World of Work 2008
- Learning and Skills (Wales) Measure 2009
- Implementation plan youth engagement and progression framework 2013
Legitimate interest, we use this to share English pupil data with Local Education Authorities based in England.
Consent Article 6(a) - the data subject has given consent to the processing of his or her personal data for one or more specific purposes.
Where consent is the lawful basis for processing it will be sought from students or parents (depending on pupil age) prior to the personal data being collected.
Necessary for reasons of substantial public interest, Article 9(2)(g)
Schedule 1, Part 2, Para 6 Statutory etc and government purposes
This Condition is met if the processing:
- Is necessary for a purpose listed in sub-paragraph (2)
- Is necessary for reasons of substantial public interest
Those purposes are:
- The exercise of a function conferred on a person by an enactment or rule of law
- The exercise of a function of the Crown, a Minister of the Crown or a government department
3. Who and where we get the personal data from
We may receive personal information from the following organisations:
- Direct upload of pupil data from school (up to three times a year)
- Local Education Authorities in England and Wales
- Youth Offending Services
- Pupils
- Discussions with school staff
- Parents
- Training Providers
- UCAS
- Work Experience Providers
- Welsh Government Plasc Data
4. The categories of personal data we process
We process the following categories of data relating to pupils in schools:
- Personal details - name, Unique Pupil Number (UPN) and unique learner number, gender and date of birth, national insurance number
- Contact details - address, telephone, personal and school email address, mobile number
- Characteristics such as ethnicity, free school meal eligibility, child looked after status, language
- Information relating to education, qualifications, training, skills, talent and life experience
- Assessment and attainment data, projected grades
- Relevant medical or health information
- Information relating to additional learning needs, copies of Individual Development Plan (IDP)
- First destination upon leaving school, work details, apprenticeship details, university/college/training provider admission data including the area of study
- Safeguarding information
- Information relating to behaviour and exclusions
- Criminal data
- Home educated pupil data
- Date of leaving school
- Work placements, location, dates, hours placed, attendance information and employer feedback
- Career discussions and intended future destination plans
5. Who we share personal data with
We share personal data with the following key organisations to fulfil our statutory functions. It should be noted that not all the personal data outlined above is shared with every organisation. Only relevant information is shared in relation to the purpose.
Here is a list of who we share personal data with and why data is shared:
- Welsh Government - Learning and Skills Plan (LSP) Funding application, statistic information and reporting
- Estyn - Inspection purposes
- Local Education Authorities Engagement and Progression Co-ordinators and support services - Personal details of pupils who have not transitioned into employment, education or training (NEET)
- Schools and other related parties - To identify pupils who are at risk of becoming NEET
- Training Providers - To initiate training opportunities (only under consent)
- Evaluation Companies and Research companies (ENWIS) - To evaluate the service we provide and also allow researchers to review effectiveness
- Specialist colleges - Sharing of additional needs information to support the application process
- School and Local Education Authority safeguarding teams and Prevent Teams - Safeguarding concerns
- Employers - Work experience opportunities
For research and evaluation purposes will only provide data for a specific purpose and for a limited time period, after which the organisation must confirm that it has been destroyed. For research purposes wider than education, we will use techniques that ensure the data are anonymised before any research takes place. Sharing of anonymised data is outside of the GDPR.
6. How do we keep your personal data safe?
We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those of our employees who have a business need to know. They will only process your personal data on our instructions and they are subject to a duty of confidentiality. We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.
7. How long do we keep your personal data?
We will only keep your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements. To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.
Details of retention periods for different aspects of your personal data are available in our retention policy which you can request from us by contacting our data privacy team using the contact details set out below. In some circumstances we may anonymise your personal data (so that it can no longer be associated with you) for research or statistical purposes or for reporting information to our funders in which case we may use this information indefinitely without further notice to you.
8. Individual rights
Under GDPR, you have the following rights in relation to the personal information you provide. Specifically you have the right:
- To access a copy of your own data
- For us to rectify inaccuracies in that data
- To object to or restrict processing (in certain circumstances)
- For your data to be ‘erased’ (in certain circumstances)
- To lodge a complaint with the Information Commissioner’s Office (ICO) who is our independent regulator for data protection.
The contact details for the Information Commissioner’s Office are Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. Phone: 01625 545 745 or 0303 123 1113. www.ico.org.uk
9. Further Information
Careers Wales Data Protection Officer can be contacted in relation to data protection matters, by post at, Unit 4 Churchill House, 17 Churchill Way Cardiff CF10 2HH or Email, personal.data@careerswales.gov.wales