May 2018 saw the introduction of the General Data Protection Regulation.
GDPR updated the law for the digital age and strengthened the rights individuals have over the use of their personal data. GDPR is complex and, unsurprisingly, has led to some misunderstandings.
In particular, some schools think they need the permission of parents before they can share children’s data with the providers of school health services. This is not the case.
Under GDPR, the lawful basis for this sharing is not provided by consent – instead, it is provided by other, equally important provisions of the GDPR.
PHE advice
Public Health England (PHE) has produced an advice letter for headteachers to explain the lawful basis for sharing children’s data with school health service providers.
This letter explains that no change is needed from our previous guidance for this sharing to be lawful under the GDPR.
This advice has been reviewed by the Information Commissioner’s Office, the UK’s independent data protection authority, which has confirmed that it is consistent with GDPR.
This means schools will not be falling foul of GDPR if they follow PHE guidance on sharing children’s data with school health service providers.
Opt-in and opt-out both lawful for vision screening
There have been particular misunderstandings about vision screening because PHE guidance is that local authorities can choose whether to adopt an ‘opt in’ or ‘opt out’ approach.
Both approaches are equally acceptable under the GDPR. Again, this is because the lawful basis for this screening is provided by other provisions of GDPR, not by consent.
The government's data protection toolkit for schools includes information on GDPR compliance.
Schools can be referred to both the advice letter from PHE – which can be obtained by contacting PHE – and the data protection toolkit.
PHE Screening blogs
PHE Screening blogs provide up to date news from all NHS screening programmes. You can register to receive updates direct to your inbox, so there’s no need to keep checking for new blogs. If you have any questions about this blog article, or about population screening in England, please contact the PHE screening helpdesk.