Retention of Data and Erasure of Personal Information

Introduction

The College handles large quantities of paper and digital data. This includes records for the College business e.g. tax, insurance, staff, medical, health and safety records which are a legal requirement. We also hold information relating to pupils e.g. academic, medical, attendance details. Much of the data collected has to be retained for legal and other purposes. These procedures are covered in Part A: Retention of Data.

Additionally, under data protection law, individuals have a right to erasure, also known as ‘the right to be forgotten’. The basic principle is that the law enables individuals to request the removal or deletion of their Personal Data where there is no compelling reason for its continued processing. This is covered in Part B: Request to Erase Personal Data.

This page outlines;

• what records we hold;
• where they are broadly held;
• why we keep it;
• when it must or can be destroyed; and
• how people can apply to “be forgotten”.

PART A

Retention of Data

There is no legal single retention or destruction period which applies to every written electronic or paper record.  This Policy has been developed to instruct staff on how we retain and securely store records. This is influenced by the following elements:

1. Statutory duties and government guidance relating to schools.
2. Data protection legislation.
3. Legislation that imposes or implies rights to privacy or confidentiality.
4. Disclosure requirements in the course of any litigation.
5. Contractual obligations.

These elements inform not only minimum and maximum retention periods, but also what to keep and how to keep it.   It is also noted that in 2015, the Independent Inquiry into Child Sexual Abuse instructed all schools that they “must ensure that no line of investigation is curtailed by the premature destruction of files or records that later become required as evidence”. The College fully abides by this request.

Additionally, medical staff are to continue to retain ‘medical in confidence’ personal records in accordance with NHS and Clinical Governance rules.

What is a "Record”?

For the purpose of this document, a "record" means any piece of data which contains evidence or information relating to the College, its staff, Governors, parents/carers or pupils.  Some of this material, but not all, will contain Personal Data of individuals as defined by data protection legislation.  Many, if not most, new and recent records will be created, received and stored electronically.  Others (such as certificates or older records) will be original paper documents.  The format of the record is less important than its contents and the purpose for keeping it.

Digital Records

There are many types of digital records e.g. emails (whether they are retained electronically or printed as part of a paper file) are also "records" and may be particularly important; whether as disclosable documents in any litigation or as representing Personal Data of the sender (or subject) for data protection/data privacy purposes. 

The format is secondary to the content and the purpose of keeping the document as a record. A digital document's original metadata may indicate the date of its creation, its author or the history of its changes, so it is important that this information is preserved.

Paper Records

Paper can be damaged by poor storage conditions but safe keeping and security is vital, especially if the materials contain legally or financially sensitive data, as well as data personal to individuals.

Under data protection legislation, paper records are only classed as Personal Data if held in a "relevant filing system". This means organised, and/or indexed, such that specific categories of personal information relating to a certain individual are readily accessible, and therefore searchable as a digital database might be. It would therefore be expected that the College maintains good systems that are searchable.

When personal information is contained on print-outs taken from electronic files, this data has already been processed by us and falls under data protection legislation.

Storing, Archiving and Destruction of Records

All staff must be familiar with and follow our Staff Data Protection Policy and the E- Safety - Acceptable User Policy where issues such as security, recognising and handling Special Category data are explained. College staff with responsibility for the management of records must ensure the following:

1. Electronic data must be stored securely at all times (password and/or encryption for electronic data) so that access is available only to authorised persons and the records themselves are available when required and (where necessary) searchable.
2. Pupil files must only be kept in the school at which the pupil is currently studying. These files must not be kept for historical records in the Pre-Prep or the Prep School but must flow though the College with the pupil to the Senior School. Once a pupil leaves the Senior School, the record will be retained as in the attached table. If a pupil leaves either the Pre-Prep or the Prep School and does not stay in the College, their record will be securely archived in the last school of study [note in 2020 a new secure College wide archive will be established]. Records must be transferred to either the next school on campus or archived by secure archive within 3 months of the pupil moving on or leaving. These records must not be sent to another school and will only be accessible to authorised College staff.
3. Any current pupil or staff paper records containing identifiable Personal Data must be stored in locked drawers or metal cupboards. Access is available only to authorised persons and the records themselves are available when required and (where necessary) searchable.
4. Any paper records of ex-staff or ex-pupils must be retained as per the policy outlined in the attached table. Records will be stored in a secure location with access limited to authorised persons only.
5. The digital records of ex-staff or ex-pupils must be retained as per the policy outlined in the attached table. These will be stored securely with access limited to authorised persons only.
6. Data held on PASS of staff and pupils that have left the College will be securely stored in line with the policy below.

Staff who originate and manage records must review them annually, in line with the guidance in the attached table. This is to ensure that all information being kept is still relevant and, in the case of Personal Data, necessary for the purposes for which it is held (and if so, that it is accurate and up-to-date). As a double check, documents in the shaded boxes in the attached table must not be destroyed by the staff responsible without first discussing their destruction with the Bursar.

No records are to be destroyed without the authorisation outlined in the table at the end of this page.

Documents and items of historical interest that do not contain Personal Data are to be offered to the College Archivist before destruction.

Secure Disposal of Data

Confidential, Special Category or personal information must be securely disposed of in a way that content cannot be either read or reconstructed. Such material must not be placed in skips or 'regular' waste disposal. Each school and central administration has at least one high security paper shredder. There is also a bulk confidential waste facility available. If staff are unsure, contact a School Office or the Bursary for further advice.

Any destruction or permanent erasure of records undertaken by a third party must be carried out securely, with no risk of the re-use or disclosure, or re-construction of any records or information contained in them. Destruction must be confirmed by a certificate from the third party.

Paper records containing Personal Data, including photographs, must be shredded; media including CDs/DVDs/memory cards, portable hard drives and other digital storage devices should be passed to the IT Department for appropriate disposal.

Photographs of any pupil taken for admission purposes and who are not admitted must be securely destroyed within 6 months. Other photographs and CCTV footage disposal is dealt with in the Taking, Storing and Using Images of Children Policy.

Retention Periods

The table below has four functions in that it;

1. identifies the key types of document concerned;
2. focusses on any particular issues associated with those types of document;
3. lists the minimum retention period; and
4. identifies the broad location where the records are stored.

The precise storage location of all paper record cabinets and drawers must be recorded on a College Data Storage Register held by the Assistant Bursar.

PART B

Requesting Erasure of Personal Information

As indicated above, individuals have a right to erasure known as ‘the right to be forgotten’. There is no absolute right to be ‘forgotten’. Pupils, parents, Governors and staff have a right to request that their Personal Data is erased and to prevent its processing, where one of the following relevant grounds apply:

1. Their data is no longer necessary in relation to the purpose for which it was originally collected or processed
2. They withdraw consent
3. They object to the processing and there is no overriding legitimate interest for continuing the processing
4. Their data was unlawfully processed
5. Their data has to be erased in order to comply with a specific legal obligation.

Reacting to a Request

There are specific circumstances where the right to erasure does not apply and we can refuse to deal with a request. This would apply for the following reasons:

1. The College’s right to exercise the right of freedom of expression and information.
2. To comply with a legal obligation or for the performance of a public interest task or exercise of official authority e.g. Dept. for Education, County Council.
3. For public health purposes in the public interest.
4. Archiving purposes in the public interest, historical research or statistical purposes.
5. The exercise or defence of legal claims.

Pupil Requests to Erasure

If a pupil has given consent to processing their data after the age of 12 and they later request its erasure, this may need special consideration. This is because a pupil may not have been fully aware of the risks involved in the processing at the time of consent. Further advice on this can be obtained from the Assistant Bursar.

Data Passed to Another Organisation

If the College has legally disclosed to another third party, an individual’s Personal Data and they want it erased, we have a duty to inform the third party about the erasure request, unless it is impossible or involves disproportionate effort to do so. The College will endeavour to comply with this request as best we can.

Make an Erasure Request

Individuals wishing to make an erase request under these regulations need to email the Bursar with the request, outlining exactly what they would like erased with as much detail as possible.

College Data Retention Storage Table - February 2018 

These items must not be destroyed without first discussing the matter with the Bursar

Type of Record	Statutory Provisions	Minimum Retention Period	Storage	Responsible Department	Reason for retention	Staff responsible for Annual Review of data
Accidents and medical treatment to children	Social Security (Claims and Payments) Regulations 1979 Regulation 25. Social Security Administration Act 1992 Section 8. Limitation Act 1980	Date of birth plus 25 years unless safeguarding incident where it may be kept for indefinitely	PASS then Secure Archive	Medical	Legal challenges, litigation	Lead Nurse
Accounting records (to enable accurate financial position to be ascertained)	Financial Regulations	Minimum 6 years from the end of the financial year in which the transaction took place	Paper/e then Secure Archive	Finance	Legal	Head of Finance
Allegations made against staff investigated by the Police		Indefinitely- reviewed by Headmaster and Bursar	Staff PF – either digital,  or paper then Secure Archive	HR	Legal challenges or investigations	Bursar
Allegations made against staff investigated by Social Service		Indefinitely - reviewed by Headmaster and Bursar	Staff PF – either digital, or paper then  Secure Archive	HR	Legal challenges or investigations	Bursar
Annual curriculum		From end of year: 7 years (or 3 years for other class records e.g. marks/ timetables/ assignments)	PASS	MIS	Allows for legal investigations	Head of MIS
Annual reports of the College		Permanent	Digital and paper then Secure Archive	Bursary	Legal and Historical archive record	Bursar
Asbestos: training records	Control of Asbestos at Work Regulations 2002	40 years	Scanned or paper file then Secure Archive	Estates	Legal challenges or investigations	Estates Manager
Asbestos: suspect incidents of potential exposure to individual	Control of Asbestos at Work Regulations 2002	40 years	Scanned or paper file then Secure Archive	HR	Legal challenges or investigations	HR Manager
Attendance Register		10 years from last date of entry, then archived for 25 years	PASS	MIS	Allows for legal investigations	MIS Manager
Budget and financial reports		Current plus 3 years from the end of the financial year	Digital or paper	Finance	Legal	Head of Finance
Bursary Applications All held separately from pupil file		25 years from DOB of pupil’s youngest sibling	Paper	Bursary	Legal challenges or investigations	PA to the Bursar
Certificates of Incorporation		Permanent (or until dissolution of the Company)	Paper to Secure Archive	Bursary	Legal	PA to the Bursar
Central Register		Permanent record of all mandatory checks that have been undertaken	Digital to Secure Archive	HR	Legal challenges, litigation or investigations	HR Manager
Contracts and Agreements (ALL) Signed or final/concluded agreements (plus any signed or final/concluded variations or amendments)		7 years from completion of contractual obligations or term of agreement, whichever is the later.	Paper or scan to Secure Archive	Bursary	Legal challenges	Bursar
Complaints about staff Raised by family members/ individuals		Minimum of 25 years. Extension to be reviewed by Headmaster and Bursar	Staff PF –digital  or paper then Secure Archive	HR	Legal challenges or investigations	Bursar

Contracts of employment			7 years from effective date of end of contract.	Staff PF – either digital, scanned then Secure Archive	HR	Legal challenges, litigation or investigations.	HR Manager
DBS Disclosure certificates (if held)	DBS Code of Practice		No longer than 6 months from decision on recruitment, unless DBS specifically consulted - but record of checks being made must be kept	Staff PF then securely destroy	HR	Legal challenges, litigation or investigations	HR Manager
Deeds (or contracts under seal)			13 years from completion of contractual obligation or term of agreement	Paper to Secure Archive	Bursary	Legal challenges	PA to the Bursar
Employee appraisals or reviews		Duration of employment plus minimum of 7 years		Staff PF – either digital,  or paper to Secure Archive	HR	Legal challenges, litigation or investigations.	HR Manager
Employment Health Questionnaire	Management of Health and Safety at Work Regulations 1999	During employment plus 7 years		Staff PF – either digital,  or paper to Secure Archive	HR	Legal requirement	HR Manager
Examination results (external or internal)		25 years date of birth		Digital	MIS	Legal or references	MIS Manager
Governors' meetings Minutes		Permanent		Paper or scan to Secure Archive	Bursary	Historical records	Bursar

Health records relating to employees		7 years from end of contract of employment.		Staff PF – either digital,  or paper to Secure Archive		HR		Legal challenges, litigation		HR Manager
Health and Medical Records Relating to pupils			25 years from DOB (subject to any relevant safeguarding issues). Any material which may be relevant to potential claims should be kept for the lifetime of the pupil.		Scan direct entry into PASS to Secure Archive		Medical		Legal challenges, litigation		Lead Nurse
Health surveillance and air monitoring and/or biological monitoring.	Control of Substances Hazardous to Health Regulations 2002		7 years		Digital scan		Estates		Legal challenges, litigation		Estates Manger
Health surveillance Any Individual medical records	Control of Substances Hazardous to Health Regulations 2002		40 years in respect of specific individuals.		Digital scan to PF then Secure Archive		HR		Legal challenges, litigation		HR Manager
Ionizing Radiation Records			50 years after last entry		Digital to Secure Archive		Estates		Ionizing Radiations		Estates Manager
Immigration records of staff			7 years from end of contract of employment		Paper or scan to PF		HR		Investigations		HR Manager
Insurance policies			Duration of policy (or as required by policy) plus until it is possible to calculate that no living person could make a claim		Paper or scan to Secure Archive		Bursary		Legal challenges, litigation		Assistant Bursar
Insurance correspondence related to claims/ renewals/ notification.			Minimum -  7 years		Digital		Bursary		Legal challenges, litigation		Assistant Bursar
Intellectual property - Assignments of to or from the school			As above in relation to contracts (7 years) or, where applicable, deeds (13 years)		Digital		Bursary		Legal challenges		Bursar
Internal investigations against staff		Minimum of 25 years. Extension to be reviewed by Headmaster and Bursar		Staff PF – either digital, or paper then Secure Archive		HR		Legal challenges or investigations.		HR Manager
IT/IP agreements including software licences and ancillary agreements e.g. maintenance; storage; development; co-existence agreements; consents		7 years from completion of contractual obligation concerned or term of agreement		Digital or paper		IT		Legal challenges		IT Manager
Learning Support files to be risk assessed individually		Date of birth plus up to 35 years (allowing for special extensions to statutory limitation period)		Direct Entry to PASS to Secure Archive		MIS		Legal challenges, litigation or investigations.		MIS Manager
Maintenance records of plant		10 years from date of last entry		Paper or scan		Estates		Legal challenges, litigation		Estates Manager
Occupational Health Records - health surveillance and medical records relating to risk assessments or incidents occurring at work	Management of Health and Safety at Work Regs 1999 Noise at Work Regs 1989	Perpetuity NOTE: Limitation period for personal injury claims is three years after the condition become known		Digital scan to PF to Secure Archive		HR		Legal challenges		HR Manager
Occupational Health Records where reason for termination of employment is connected with health, including stress related illness	Management of Health and Safety at Work Regs 1999 Noise at Work Regs 1989	Perpetuity NOTE: Limitation period for personal injury claims is three years after the condition become known		Digital scan to PF to Secure Archive		HR		Legal challenges		HR Manager

Open Morning/ Evening Contact details (Pupils, parents addresses etc.)		1 year. Data from these forms must be entered onto PASS. All paper copies must be securely destroyed within 1 month of receipt If pupil not admitted within 5 years, all digital data held on PASS must be destroyed.	PASS	School Admissions	Aid admission process	School Admissions Officers
Payroll salary, maternity pay records	Statutory Maternity Pay (General) Regulations 1986 (SI 1986/1960), revised 1999 (SI 1999/567)	10 years	Digital	HR	Legal challenges, litigation or investigations.	HR Manager
Pensions or other benefit schedule records		Permanent	Digital to Secure Archive	HR	Pensions payments	HR Manager
Prospectus or admission requests		5 years from enquiry.	PASS	Admissions	Aid admissions process	School Admissions Officers
Pupil files (Admitted) Pupil reports Pupil performance records Admission application form Assessment of admission Record of admission decision Any important or significant parent correspondence	Limitation Act 1980	35 years from DOB (subject where relevant to safeguarding considerations). Any material which may be relevant to potential claims should be kept for the lifetime of the pupil	PASS and paper file to Secure Archive	MIS	Legal challenges, litigation or investigations	MIS Manager

Pupil files (not admitted after application) Admission application form Assessment of admission Record of admission decision Any important or significant parent correspondence		10 years from decision. This can reduce to 5 if there is no potential for younger sibling applications		Digital scan to PASS to Secure Archive		Admissions		Legal challenges or investigations		School Admissions Officers
Recruitment of staff Job application and interview/rejection records and interview notes (unsuccessful applicants)		Interview plus 6 months but no longer than 1 year. All such records and interview notes MUST be returned to HR IMMEDIATELY after selection		Paper		HR		Feedback to applicants. Time limits on litigation		HR Manager
Redundancies: Facts of case: Where less than 20 redundancies		7 years from the date of redundancy		Digital scan to PF		HR		Time limits on litigation		HR Manager
Redundancies: Facts of case: Where 20 or more redundancies		12 years from the date of the redundancies		Digital scan to PF		HR		Limitation Act 1980		HR Manager
Registration documents of Schools		Permanent		Scanned to Secure Archive		Bursary		Legal		Bursar
Risk assessments for Occupational Health matters.		7 years from completion of relevant project, incident, event or activity.		Scanned		Estates		Legal challenges, litigation		Health and Safety Officer
Safeguarding Policies and Procedures		Keep a permanent record of historic policies.		Digital to Secure Archive		Safeguarding		Legal challenges, litigation or investigations.		School DSLs

Safeguarding Incident reporting		Keep record for as long as any living victim may bring a claim (NB civil claim limitation periods can be set aside in cases of abuse). Files to be reviewed every five years by Bursar and DSP.	Secure Digital storage to Secure Archive	Safeguarding	Legal challenges, litigation or investigations.			School DSLs
Staff File (including appraisals and reviews)		Duration of employment plus a minimum of 10 years. No information to be deleted relevant to safeguarding	Digital scan to PF to Secure Archive	HR	Legal challenge or enquiries			HR Manager
Staff Discipline Oral/verbal warning - brief note on file (subject to satisfactory conduct and performance)		6 months on open file then kept but disregarded	Digital scan to PF	HR	In accordance with College Procedures			HR Manager
Staff Discipline Written warning - including notes of disciplinary hearings kept on file (subject to satisfactory conduct and performance).		1 to 2 years on open file depending on level of warning, then kept but disregarded	Digital scan to PF	HR	In accordance with College Procedures.			HR Manager
Staff Grievance hearing documentation relating (notes, reports etc.)		2 years. NOTE: Grievance Committee members must hand in all paperwork at the end of a meeting/hearing to avoid retention of duplicate documents. Any digital copies must also be removed from their PC’s	Digital scan to PF	HR	Allows for appropriate appeal mechanism and monitoring future grievances			HR Manager
Staff disciplinary meeting Minutes		Minimum of 25 years. Extension to be reviewed by Headmaster and Bursar.	Digital scan to PF to Secure Archive	HR	Legal challenges or invest.			HR Manager

Staff personnel file Only be retained by the HR Department		In perpetuity. P Files can be weeded after 10 years so they only contain facts of employment (dates of appointments, positions held etc.		Digital scan or paper to Secure Archive	HR		To provide references and confirmation employment. Legal challenges, litigation or investigations		HR Manager
Staff use of hazardous substances		7 years from end of date of use.		Digital	Estates		Legal challenges, litigation		Estates Manager
Tax returns		7 years from the end of the financial year.		Paper	Finance		Legal		Finance Manager
Titles - formal documents of (trade mark or registered design certificates; patent or utility model certificates)		Permanent (in the case of any right which can be permanently extended, e.g. trade marks); otherwise expiry of right plus minimum of 7 years.		Paper to Secure Archive	Bursary		Legal challenges		Bursar
UK Visa Home Office records		25 years from DOB (subject where relevant to safeguarding considerations). Any material which may be relevant to potential claims should be kept for the lifetime of the pupil.		Digital to Secure Archive	Headmaster		Legal challenges, litigation or investigations		PA to Headmaster
VAT returns		7 years from the end of the financial year.		Paper or digital	Finance		Legal		Finance Manager

Sources include: IBSA, College practice, ICO