Data Protection
Cara Junior School Data Protection Policy
This policy applies to personal data held by Cara Junior School and explains how such information should be protected, processed, stored and used.
It applies to school staff, the Board of Management, parents and guardians, students and others where the school handles or processes their personal data in the course of school business.
Purpose and Scope
The purpose of the policy is to assist the school in meeting its statutory obligations, to explain those obligations to school staff and to inform staff, students and parents or guardians how their data will be treated.
The policy is intended to help the school collect, process, retain and protect personal data in a consistent and responsible way.
Why Data Protection Matters
The school has legal responsibilities to comply with data protection law and to handle information carefully. The policy recognises that schools hold important and sometimes sensitive information about pupils, families, staff and school activity.
Types of Data Held
Staff Data
Personnel files, contact details, payroll information, attendance records, qualifications, references, vetting records and employment-related records.
Student Data
Personal details, school report cards, diagnostic reports, attendance records, assessments, IEPs, records of meetings, permissions, referrals and student work.
Administrative Data
Attendance reports, roll books, correspondence, accident reports, medication forms, behaviour records, book rental records and child protection records.
Board of Management Data
Names, contact details, Board membership records, appointments, minutes and Board correspondence.
Financial and Other Records
Creditors, PPS numbers, tax details, bank details, amounts paid and related records needed for school administration.
CCTV Images / Recordings
CCTV is used for safety and security of staff, students, visitors and school property, with restricted access to recordings.
Data Protection Principles
The policy applies data protection principles to personal data records held by the school. These principles guide how information is obtained, processed, stored, retained and shared.
- Obtain and process personal data fairly.
- Use and disclose personal data only in ways compatible with the purpose for which it was collected.
- Keep personal data safe and secure.
- Keep personal data accurate, complete and up to date.
- Ensure personal data is adequate, relevant and not excessive.
- Retain personal data only for as long as necessary.
- Provide a copy of personal data to the individual on request, where appropriate.
- Keep personal data only for specified, explicit and lawful purposes.
Sharing and Disclosure
Personal data may be shared where there is a lawful basis or appropriate reason, such as fulfilling educational, statutory, safeguarding or administrative responsibilities.
The policy refers to bodies such as the Department of Education, TUSLA, the NCSE, NEPS and other relevant agencies where appropriate.
Keeping Data Safe
The policy states that security measures should be taken against unauthorised access, alteration, disclosure or destruction of data and against accidental loss or destruction.
- Records may be kept in locked filing cabinets or locked offices.
- Access is restricted to appropriate school personnel.
- Some records are password protected.
- Child protection records are maintained securely.
- CCTV access is restricted to the Principal and Deputy Principal.
CCTV Images and Recordings
The policy notes that CCTV is installed externally in Cara Junior School as detailed in the CCTV policy. The purpose is safety and security of staff, students, visitors, property and equipment.
Access to images and recordings is restricted. Recordings may be retained for a limited period except where required for an incident investigation.
Data Access Requests
Individuals may be entitled to a copy of their personal data on written request. Requests should be responded to within one month, although an extension may be required in certain circumstances.
Providing Information Over the Phone
The policy advises employees dealing with telephone enquiries to be careful about disclosing personal information held by the school over the phone.
- Ask the caller to put their request in writing.
- Refer the request to the Principal for assistance in difficult situations.
- Do not feel forced into disclosing personal information.
Data Breaches
All incidents where personal data has been put at risk must be reported to the Office of the Data Protection Commissioner within 72 hours where required.
If a data processor becomes aware of a personal data breach, this must be brought to the attention of the data controller without undue delay.
Roles and Responsibilities
The Board of Management is the data controller of all school-held data. The Principal and school staff, under the direction of the Board, implement and monitor the policy.
Individual teachers should design, administer and record in-class testing and should store personal data held in their classrooms carefully. The Principal ensures records are maintained and stored securely.
Ratification, Communication and Review
The policy states that the agreed Data Protection Policy will be circulated within the school community and that the full policy will be available to staff.
The original policy was implemented on 06/06/2018. The revised policy was implemented from 10/11/2020 following ratification at a Board of Management meeting on 9 November 2020. The document notes a minimum review date in the school year 2024–25.
Contact the School Office
If you need guidance in relation to school data protection procedures, please contact the school office.
Cara Junior School
Banduff Road, Mayfield, Cork, T23 TA12
Phone: 021 4643060
Email: office@carajs.ie