Skip to main content

Child vision screening: no change is needed to comply with GDPR

Posted by: , Posted on: - Categories: General information, School entry screening
Close up of girls eyes
Child vision screening is to detect problems early so your child can receive effective treatment

May 2018 saw the introduction of the General Data Protection Regulation.

GDPR updated the law for the digital age and strengthened the rights individuals have over the use of their personal data. GDPR is complex and, unsurprisingly, has led to some misunderstandings.

In particular, some schools think they need the permission of parents before they can share children’s data with the providers of school health services. This is not the case.

Under GDPR, the lawful basis for this sharing is not provided by consent – instead, it is provided by other, equally important provisions of the GDPR.

PHE advice

Public Health England (PHE) has produced an advice letter for headteachers to explain the lawful basis for sharing children’s data with school health service providers.

This letter explains that no change is needed from our previous guidance for this sharing to be lawful under the GDPR.

This advice has been reviewed by the Information Commissioner’s Office, the UK’s independent data protection authority, which has confirmed that it is consistent with GDPR.

This means schools will not be falling foul of GDPR if they follow PHE guidance on sharing children’s data with school health service providers.

Opt-in and opt-out both lawful for vision screening

A young boy sitting in chair with an eye patch on and holding a sheet with letters on
PHE guidance on sharing children's data with school health service providers is compliant with the GDPR

There have been particular misunderstandings about vision screening because PHE guidance is that local authorities can choose whether to adopt an ‘opt in’ or ‘opt out’ approach.

Both approaches are equally acceptable under the GDPR. Again, this is because the lawful basis for this screening is provided by other provisions of GDPR, not by consent.

The government's data protection toolkit for schools includes information on GDPR compliance.

Schools can be referred to both the advice letter from PHE – which can be obtained by contacting PHE – and the data protection toolkit.

PHE Screening blogs

PHE Screening blogs provide up to date news from all NHS screening programmes. You can register to receive updates direct to your inbox, so there’s no need to keep checking for new blogs. If you have any questions about this blog article, or about population screening in England, please contact the PHE screening helpdesk.

Sharing and comments

Share this page