Cookie Consent by Free Privacy Policy Generator website
Schools and education

Schools Privacy Notice

We keep the Schools Privacy Notice under review. It was last reviewed and updated in December 2021.

If you have any questions about this Privacy Notice contact the council’s Data Protection Officer.

View the privacy and transparency information for all of the City of York Council (CYC).


Using personal data

We use personal data about children and young people to enable us to carry out specific functions for which we are responsible. We also use this personal data to derive statistics which inform decisions we make, for example regarding the funding of schools, to assess their performance and to set targets for them.

These statistics are used in such a way that individual children cannot be identified.

Youth Support Services

For pupils aged 13 and over, schools are legally required to pass certain personal data to the provider of Youth Support Services in their area. This is the local authority support service for young people in England who are aged 13 to 19.

Primary Care Trusts (PCTs)

PCTs use personal data about pupils for research and statistical purposes, to develop, monitor and evaluate the performance of local health services. These statistics will not identify individual pupils.

It is necessary for certain health information about children, such as their height and weight, to be retained for a certain period of time (designated by the Department of Health). PCTs maintain children’s names and addresses for this purpose.

PCTs may also provide individual schools and Local Authorities (LA) with aggregated health information which will not identify individual children.

Education and training

We hold personal data about young people living in our area, including about their education and training history. This is to support the provision of their education up to the age of 20 (and beyond this age for those with a special education need or disability).

Education institutions and other public bodies, including the Department for Education (DfE), police, probation and health services may pass information to us to help us to do this.

As a rule, we do not transfer your personal data to third party processors outside the European Economic Area (EEA).

We may use Zoom Pro or Business version of Zoom (version 5) to host some public facing meetings, training sessions etc across different services in the council. Where these meetings are recorded, recordings will be kept locally on our server and will not be retained by Zoom.

Some personal data will be stored securely on Zoom’s system in the USA (that is, outside the EEA) in compliance with the EU, USA Privacy Shield Framework. This data may include a user's:

  • name
  • email address
  • telephone number where applicable
  • IP address
  • MAC address
  • other device ID (UDID)
  • device type
  • operating system type and version
  • client version
  • type of camera, microphone or speakers
  • connection type

Zoom does not sell personal data to third parties; collects only the personal data required to provide Zoom services; and retains that data only for so long as is necessary for the provision of those services.

View Zoom’s certification.

View Zoom’s privacy policy.

If you want to see a copy of information about you that we hold, please contact the Data Protection Officer.


Sharing personal data

We share some of the personal data we collect with the DfE to enable them to:

  • produce statistics
  • assess our performance
  • determine the destinations of young people after they have left school or college
  • evaluate government funded programmes

We may also share personal data with post-16 education and training providers to secure appropriate support for them.

We may also share data with education establishments which shows what their pupils go on to do after the age of 16.

The DfE may share individual level personal data that we supply to them with third parties. This will only take place where legislation allows it to do so and it is in compliance with Data Protection legislation.

Decisions on whether the DfE releases this personal data to third parties are subject to a robust approval process and are based on:

  • a detailed assessment of who is requesting the data
  • the purpose for which it is required
  • the level and sensitivity of data requested
  • the arrangements in place to store and handle the data

To be granted access to pupil level data, requesters must comply with strict terms and conditions covering the confidentiality and handling of data, security arrangements and retention and use of the data.

See guidance on GOV.UK regarding the national pupil database.

See guidance on GOV.UK regarding DfE external data sharing, for information on which third party organisations (and for which project) pupil level data has been provided to.

If you require more information about how we and DfE store and use your personal data please see Our privacy statement or information on GOV.UK regarding the DfEs data protection policy.

Sharing data under Data Protection legislation

We may be required or permitted, under data protection legislation, to disclose your personal data without your explicit consent, for example if we have a legal obligation to do so, such as for:

  • law enforcement
  • fraud investigations
  • regulation and licensing
  • criminal prosecutions
  • court proceedings

We must protect public funds and may use personal data and data-matching techniques to detect and prevent fraud, collect taxes and ensure public money is targeted and spent in the most appropriate and cost-effective way. To do this, your personal data may be shared with other bodies responsible for auditing or administering public funds, including the Department for Work and Pensions, HM Revenue and Customs, the Police and other local authorities.


Retaining personal data

At the end of any defined data retention period, we may pass any relevant information to the City Archives where it is required or appropriate to do so.


Further processing of personal data

If we wish to use your personal data for a new purpose, not covered by this Privacy Notice, then we'll provide you with a new notice.

The new notice will:

  • explain this new use before we start the processing
  • set out the relevant purposes and processing conditions

Where and whenever necessary, we'll seek your consent to the new processing, if we start to use your personal data for a purpose not mentioned in this Privacy Notice.


Your rights relating to personal data

For children under 16, a parent or guardian can ask that no information other than their child’s name, address and date of birth (or their own name and address) be passed to a LA. This right transfers to the child on their 16th birthday. Pupils and/or a parent/guardian will need to inform the school/LA if this is what they wish.

When we collect your personal data we'll tell you how we are going to use it. Where we process your personal data, you have a number of rights under data protection law.

See further details of your rights relating to personal data.


Also see

Data Protection Officer

West Offices, Station Rise, York, YO1 6GA

Telephone: 01904 554145