Like anyone involved in the field of Data Protection I am incredibly busy at the moment discussing contracts, running training, mentoring staff, proof reading policies and procedures, and answering the day-to-day queries my clients are coming up with. It has been heartening to see real progress being made by schools who, in some case, only a few short weeks ago were at a loss to know how to approach GDPR compliance.
I'm still getting annoyed every time I see another article in the press or on hear someone say on TV or radio that nobody will be able to process personal data in future unless they have the data subject's consent and that organisations will have to destroy all the information they hold if the data subject asks them to do so...
NOT TRUE!
Consent remains one possible condition for processing personal data and, for the vast majority of data held by schools and academies, will not the condition relied upon for much of the data they process as "statutory duty" and "necessary for the performance of a contract" are likely to apply to nearly all pupil and staffing data.
The real problem will be the fact that the general public are likely to believe what they see and hear, only to receive a reality check when they ask for data to be deleted when consent is not actually the legal basis for processing their data. I'm sure a lot of schools will have angry parents and carers who insist "it must be right because I saw it on TV"!