Category: News

Whether we like it or not AI is here and rapidly becoming a fact of life.  In order for schools to embrace and harness the potential of AI, it is essential to take strategic control, incorporating principles, practices, tools and governance.

In July 2024 the Audit and Risk Assurance Committee Handbook was updated to include a section on AI. This update requires MATs to be able to answer questions around AI, including:

• Who owns your AI strategy at Executive level.
• What appropriate expertise you have to oversee AI Development, and
• How prepared you are for new regulation.

As a result, we have devised a training session to bolster senior leaders in schools knowledge of this area which will enable them to confidently instruct and advise the remainder of school staff.

Delivered by our Education Data Hub Team Manager, Clare Wilson, this session will cover:

• What is AI?
• Regulation and The Regulators.
• AI Governors, Principles and Policy.
• Personal Data collected by AI.
• Where to get started.
• DPIAS.

We have upcoming sessions that individual can book onto:

–          29th January 2025 at 3:30pm via Microsoft Teams.
–          14th May 2025 at 4pm at The Quad, Chesterfield.
–          17th September 2025 at 3:30pm via Microsoft Teams.
–          12th November 2025 at 3:30pm via Microsoft Teams.

Please contact us at [email protected] if you require any assistance with booking training.

We are honoured to share that Education Data Hub has been awarded the Data Privacy Team of the year award at the PICCASO awards Europe.

Our team were shortlisted for the award alongside huge industry champions such as Royal Mail, Deliveroo, Revolut, and Visa.

This prestigious recognition is a testament to our continued commitment to support best practices in data protection, data privacy, and cyber risk in the education sector.

Big thanks go to the judges for their recognition, to our dedicated team, our loyal schools and MATs, and to our supportive partners. Your continued support inspires us to strive for even greater heights.

We now look forward to the Real Cyber Awards later on this month, with fingers crossed for a similar win in the Cyber Public Service category.

What is an Environmental Information Request?

The Environmental Information Regulations 2004 were created to provide public access to environmental information held by public authorities to encourage greater awareness of issues that affect the environment.

Schools have two main obligations under the Regulations. You must:

1. Make environmental information available proactively.
2. Respond to requests for environmental information.

What is Environmental Information?

The term Environmental information is defined in regulation 2(1) of the Environmental Information Regulations 2004.

In short, it refers to all information which relates to the environment in any way, please see a non-exhaustive list of the types of requests schools could expect below:

• Requests for information about buildings and constructions on school sites.
• Requests for information relating to planning permissions and land sales.
• Requests for information relating to waste and contamination.
• Any financial data in relation to environmental information / land use of school sites.

If you are not sure whether a request falls under environmental information, please ask your Data Protection Officer for assistance.

Who can make a request?

Anyone can make a request for information under the Regulations, including members of the public, journalists, researchers, and campaign groups.

An EIR request can be made either in writing or verbally, and they do not need to specifically quote the Environmental Information Regulations, if the request relates to Environmental information, you treat it as such.

Do we have to respond to every request?

Yes, you are required to respond to every request, even if your response is that you do not hold that information.

There are exceptions to consider under the Regulations which allow you to withhold information if it is deemed in the public interest to do so. In this case you are still required to respond to the request with your reasoning for withholding the data.

Your Data Protection Officer will help you decide if an exception applies.

What if I don’t know the answer?

You only have to disclose information you hold in a reportable format; you do not need to create information merely to respond to the request. If you do not hold recorded information, you do not have to respond to that question.

You are obligated to offer the requester guidance and support. If you do not have the requested recorded information, you must inform the requester of this. You should clarify why that information is unavailable and share any relevant details you do hold that might assist with their request.

When do we have to respond by?

Under the Regulations, you must respond to the request within 20 working days, however there is provision to extend the response time to 40 working days if the request is complex and voluminous.

How do we respond to a EIR Request?

Here at Education Data Hub, we provide schools with a ‘How to Guide’ for dealing with Environmental Information Requests.

This works in a similar way to our Freedom of Information process, the first step is for the school to log the request and from there you will receive correspondence from us, as your data protection officer, with advice on how to deal with the request. This will contain a template acknowledgement letter and a response template for your answer.

If you are unsure whether a request falls under Freedom of Information Act 2000 or Environmental Information Regulations 2004, our client schools can forward the request to us, and we will decide for you.

It is good practice to keep a log of all requests you have received, the relevant dates and your response, to produce an audit trail from your school.

If you require any assistance dealing with Environmental Information Requests, or any other Requests, please get in touch at [email protected]

The DfE’s Keeping Children Safe in Education statutory guidance states that Designated Safeguarding Leads (DSLs) are required to ‘act as a source of support, advice and expertise for all staff’*

Annex C of the KCSIE outlines that one of the roles of DSLs is to ‘understand relevant data protection legislation and regulations, especially the Data Protection Act 2018 and the UK General Data Protection Regulation’*

Added to that, the concluding report and recommendations of the Independent Inquiry into Child Sexual Abuse suggest significant changes need to be made in the way school staff report concerns.

It has never been more important to ensure your DSLs are equipped to navigate this area of data protection and UK GDPR.

We have devised a training session to bolster and embed DSL knowledge in this area which will enable them to confidently instruct and advise the remainder of the school staff.

Delivered by our Education Data Hub Team Manager, Clare Wilson, this session is aimed at DSL’s and Deputy DSLs and will explore:

• KCSIE 2024
• the IICSA Recommendations
• Information Sharing Advice for Practitioners May 2024
• ICO 10 Steps to Information Sharing to Safeguard Children
• DfE Dealing with Subject Access Requests Apr 2024
• and the latest case law

to provide you with a thorough understanding of:

• Recording concerns
• Retaining records
• Transferring records
• Securing records
• Sharing information
• Responding to requests for records

We have an upcoming session that individuals can book onto HERE.

Please contact us at [email protected] to enquire about bespoke sessions for MATs.

*information taken from KCSIE May 2024 pending publication Sept 2024

In an age where transparency is highly valued, it is understandable that schools want to keep parents, students, and staff well-informed about what’s going on. However, when it comes to security, it’s best to keep things under wraps.

Here are just a few reasons why schools shouldn’t post their Critical Incident Plans or IT Disaster Recovery Plans on their websites:

1. You don’t have to!

There is government guidance available to all schools that informs them exactly what must or should be published on a school websites. It is regularly updated, and you can find it using the links below:

What maintained schools must or should publish online

What academies and further education colleges must or should publish online

2. Keep Your Plans Secret – Increase Your Cyber Resilience

Imagine if someone who wanted to cause trouble knew exactly how the school handles emergencies or IT Disasters. When security plans are posted online, it’s like giving potential attackers a blueprint of the school’s defences. Perpetrators could find weak spots and take advantage of them or target individuals to gain access to school systems. By not sharing this information online, schools reduce that risk and immediately increase cyber resilience.

3. Protecting Personal Information

School security plans often include information about the people who keep the school safe. This might encompass names, roles, access levels, and even personal contact details. If these details are shared online, not only could this be a potential breach of UK GDPR, but those individuals could be at risk of being targeted, perhaps by phishing.

4. Insurance Policies

If you left a note on your car that let someone know where the keys were, would you expect your insurance company to pay out if it was stolen?  Publishing detailed school security and recovery plans on your school website may void insurance policies so please check the small print. To be on the safe side – don’t publish them!

Transparency is crucial in many aspects of school administration, but security information should be handled with the utmost discretion so that schools can better protect their students, staff, and wider school community from potential threats.

We support schools and MATs all over the UK. CONTACT US today to find out how Education Data Hub could support you.

What is a Freedom of Information Request?

A Freedom of Information (FOI) Request is a request made by any member of the public for information held by public authorities or publicly owned companies. Therefore, schools fall under this Act.

1. Under the Act public authorities are obliged to publicly publish certain information about their activities in a publication scheme. Every organisation is required to have a publication scheme which sets out what information the public authority hold and if that information is public where it can be found.
2. Under the Act public authorities must provide information to anyone making a written request.

This Act does not give people access to their own personal data.

Who can make a Freedom of Information Request?

Anyone can make a valid freedom of information request – they do not have to be UK citizens, or resident in the UK.

Freedom of information requests can also be made by organisations, for example a newspaper, a campaign group, or a company.

If you are concerned about the validity of a request see the ICO guidance (What makes a valid request? | ICO) and talk to your DPO. However, it is likely that any request in writing will be valid.

Do we have to respond to every Freedom of Information Request?

Yes, under the Act you must release the information unless there is good reason not to.

There are two scenarios where you may not have to answer an FOI, that is if you have a right to refuse the request or an exemption applies.

Your Data Protection Officer will help you decide if either of these options apply.

What if I don’t know the answer?

You only have to disclose information you hold in a reportable format, you do not need to create information merely to respond to the request. If you do not hold recorded information, you do not have to respond to that question.

When do we have to respond by?

Under the FOI Act 2000, you must respond to requests for information within 20 working days, counting the first working day after the request is received as the first day. The time allowed for complying with a request starts when your organisation receives it, not when it reaches the relevant member of staff.

Section 1 (3) of the Act states that if you require clarification from the requester the time does not start until you receive the extra information you required to complete the request.

How do we respond to a Freedom of Information Request?

Here at Education Data Hub, we provide schools with a ‘How to Guide’ for dealing with FOIs.

Following this guide, the first step is to log the request. It is good practice to keep a log of all requests you have received, the relevant dates and your response, to produce an audit trail for your school.

Once the school have logged the FOI request, they will receive correspondence from us, as their data protection officer, with advice on how to deal with the request. This will contain, a template acknowledgement letter and a response template for your answer.

If you require any assistance with dealing with Freedom of Information Requests, or any other Information Requests, please get in touch at [email protected]

Updates to the DfE Cyber Security Standards for schools and colleges were published today (20th May 2024) and our EDH Cyber Team are proud to have been involved and referenced in them as a source of help for schools aiming to improve their cyber resilience.

Given the increasing reliance on technology in education, the importance of cyber security in schools cannot be overstated. It is essential for numerous reasons, from protecting sensitive information, to supporting business continuity, to maintaining trust in your digital systems.

The updated cyber security standards address tasks that should be completed by both the senior leadership team in a school and IT support. It is recognised that cyber security is not something that IT teams can carry out alone – it is a shared responsibility between multiple roles and teams. They contain the same key information that the previous cyber security standards held, but the format of this has changed to make them more accessible to staff without cyber expertise.

A human layer of cyber security is integral to school cyber defences. Fostering a culture of awareness, education, and vigilance, significantly reduces the risk of cyber threats and can improve cyber security posture and data protection obligations.

To find out how we can help you improve your school cyber resilience, have a look at the services we offer or email us at [email protected]