Common questions when completing data protection documentation for your local authority, multi academy trust or school.

Last edit 4th May 2022

Are you currently registered with the Information Commissioners Office?

We are registered as required under GDPR (General Data Protection Regulation) with the Information Commissioner, number ZA33530.

Summarise why you have identified the need for a DPIA

A DPIA is required as ReadingWise programmes involve the use of personal information including pupil names.

Describe the flow of information

Pupil names and optionally gender, DOB, FSM / SIMD, and SEN details are added by the school into the system. Each pupil has a unique username and password. Teachers are able to access pupils’ use of ReadingWise e.g. minutes on, scores, progress charts. Pupils are able to view their use of ReadingWise e.g. scores, progress charts.

Data is stored on Amazon AWS servers in Ireland.

Personal information can be updated in the account settings at any point by teachers to correct account information. Leavers can have their account deleted and teachers can request that pupil data is deleted at any time.

Describe the sort of personal data that will be processed.

Pupil code (UPN number); first name; middle name(s); surname; date of birth; gender; first language; free school meal status; SIMD data; nationality; assessment data; special educational needs data; data pertaining to Pupil performance; class group; reading assessment data.

Legal Basis

What is the legal basis for processing the personal data?

Scotland

Article 6(1)(e) – Public task on the basis of the obligations placed on the Authority to track and monitor pupil progress as outlined in the legislation below:

• Education (Scotland) Act 1980
• Education (Additional Support for Learning) (Scotland) Act 2009
• Scottish Schools (Parental Involvement) Act 2006
• Standards in Scotland’s Schools etc. Act 2000
• Children and Young People (Scotland) Act 2014

How will you tell individuals about the use of their personal information?

Schools will be required to publish a privacy notice detailing how pupil data will be used. This will be issued to parents at the start of the academic session via email/letter and also shown on the school website.

Describe the purpose(s) of processing personal data in the project.

The purpose of using ReadingWise is to enhance the learning experience and attainment of pupils and to ensure progress is documented and accessible to further improve reading outcomes.

Have you identified retention periods for the personal data that will be processed?

Personal data will be held in the system for as long as a school is subscribed to the service. The school may request the deletion of any data at any time. Once requested, this data will be deleted within 60 days.

Describe what consideration has been given to pseudonymisation (removing generally known identifiers) or encryption of the personal data.

Schools could identify pupils with pseudonyms and the ReadingWise system makes this possible. However, this could be confusing for staff and pupils. Currently only first names are required for pupils. Using first names helps pupils identify with their account and their own work. Using pseudonyms risks reduction in engagement and ownership, compromising educational attainment.

Rights of Data Subjects

Will it be possible to retrieve all of an individual’s personal data in response to a subject access request?

Yes, ReadingWise will retrieve all associated data within 60 days of an account access request. Data can also be exported from the system by school staff.

Will it be possible to delete an individual’s personal data in response to a request?

Yes, ReadingWise will delete all associated data within 60 days of an account deletion request.

Will it be possible to omit an individual’s personal data from particular processing in response to a request?

Yes.

Will it be possible to cease processing (but retain) an individual’s personal data from all processing in response to a request?

Yes.

Profiling

Does the processing involve making a decision by automated means? If so, describe the processing involved.

No.

Does the processing involve automated processing of personal data to evaluate certain things about an individual or predict behaviour or outcomes, i.e. profiling? If so, describe the processing involved.

No.

Location

Which country or countries will the personal data be stored in?

Ireland.