This briefing gives National Education Union (NEU) advice on the information that should be shared by school leaders in the event of a confirmed or suspected case of Covid-19.
It seeks to ensure that a policy of maximum transparency is adopted and that the provisions of data protection legislation are not misunderstood or misused in such a way as to prevent the sharing of necessary information with parents and staff.
What does Government guidance say?
While Government guidance is not explicit, it very clearly implies a preference for openness and transparency. Current DfE guidance provides that:
“Where a child, young person or staff member develop symptoms, they are encouraged to alert the school and people with whom they have had close contact over the last 48 hours.”
The DfE is not encouraging individuals to disclose symptoms to schools so that schools may keep that information secret. It is so that schools can take charge of notifying all those within the setting who may have come into ‘close contact’ with the individual concerned and adopt measures to ensure that they “take extra care in practicing social distancing and good hygiene.”
The DfE defines close contact as:
“anyone that you have had face-to-face contact with, less than one metre away or have been within 2 metres of for more than 15 minutes. It also includes people you have been in a small vehicle with.”
What does data protection legislation require?
It is not the case, as some reps have been told, that data protection legislation prevents schools from disclosing the name, class and/or year group of a pupil or staff member with Covid-19 or symptoms of the virus.
Although there is an automatic prohibition against the sharing of health data under the GDPR, the legislation also provides for circumstances in which that prohibition may be overridden. One of these is where a school directly or indirectly identifies an individual under the direction of a health authority, such as the local health protection team (if supervised by a medical professional), or the NHS test and trace team. Health data may also be shared if the data subject, or in the case of pupils under 13 years of age, the data subject’s legal guardian, has explicitly consented to such sharing. Explicit consent should not be relied on as the basis for sharing information, however, particularly about staff, because the imbalance of power between the data controller and the data subject (e.g. employer and employee) will always give rise to the issue of whether consent has been freely given.
Furthermore, data controllers, i.e., head teachers on behalf of school governing bodies, are obliged to weigh the privacy rights of the person whose data is to be disclosed against the interests of the school community in knowing of the potential risk to their health and the health of those with whom they may have been in close contact.
What information should schools/colleges therefore disclose?
Head teachers/principals must do what data protection legislation requires before deciding whether or not to inform the school/college community, or pockets of it, of an infected or potentially infected individual’s identity, whether directly i.e. by naming them, or indirectly i.e. by mentioning their class or year group. As noted above, the NEU recommends that in order to ensure maximum adherence to safety precautions, maintain confidence and encourage calmness, a policy of maximum transparency should be adopted wherever possible. The NEU recommends the following steps:
Decide on the lawful basis for disclosing the information
If you do not intend to rely on explicit consent as your lawful basis for disclosure – and we would encourage you not to – you should ask the local health protection team or the NHS test and trace team for their advice about how much information you should disclose in the circumstances. Make sure that any advice you receive is confirmed in writing.
School leaders are also encouraged to seek advice from their legal representatives if they are unsure of the lawful basis for disclosing information.
Disclose only what is necessary
Just because data may be lawfully disclosed does not always mean that it should be. Can you provide the school community with sufficient notification of risks to staff and students without directly or indirectly identifying the individual concerned? Only disclose the minimum amount of information required to address the issue at hand. Furthermore, only identify the person exhibiting symptoms or tested positive if the school community, or cohorts within it, need to know that information. Furthermore, do not undertake to keep the person’s identity confidential unless the health authorities confirm that it is fine to do so in the circumstances.
Consider the data subject’s rights and freedoms
Consider what might happen to the individual, both mentally and physically, if you were to disclose their identity. Would disclosing the person’s year and/or class reveal their identity? Is disclosure likely to deter others from notifying the school/college of symptoms? Is there a history of mental illness which might be exacerbated by disclosure? Is there a risk of harassment, bullying and/or ostracisation and, if so, could the risk be mitigated? If the answer is yes to any of these questions, set out the steps you intend to take to mitigate the risk, e.g. frequent talks with students and staff about treating each other with compassion and respect, or limiting disclosure to staff pending the outcome of a Covid-19 test by the individual concerned. You should also consider whether it is possible for people who have been in close contact with the individual(s) concerned to realise that they may have been infected without knowing their year, class or name, e.g. in the event of a whole school shutdown.
Consider the interests of those who have been in close contact with the individual concerned
Consider what might happen to them, both mentally and physically, if you do not disclose the identity of the individual concerned. Is the lack of disclosure likely to fuel insecurity, mistrust, fear and a lack of trust in the school/college’s system of track and trace? Conversely, will notifying parents and students create a climate of fear? Do any of those concerned have a history of mental illness which might be exacerbated if you do not engage in open and transparent dialogue? Taking into account the individual health and safety risk assessments of staff, are they or members of their household likely to be seriously injured (e.g. because they are higher risk) if you do not disclose the identity of the individual concerned and they are unable to discern (from the information that you do disclose) that they should be taking additional protective measures?
Have a discussion with the data subject and/or their legal guardian
Although consent is not a prerequisite to disclosure (unless it’s the lawful basis for processing you intend to rely on), it is considered good practice to inform data subjects of your intention to disclose their personal data and your reasons for doing so, and to take any objections they may have into account when weighing their interests against those of others. Keep a record of any objections made, but don’t automatically give an individual’s objections greater weight than may be warranted in the circumstances.
Make a decision
Remember that this is a difficult time for everyone, particularly for staff who are very stressed and anxious for their safety and the safety of their loved ones. There are no hard and fast rules about the right thing to do, particularly in the absence of national guidance. As long as you can demonstrate that the decision you’ve made is a considered one, the Information Commissioner’s Office is likely to take a sympathetic view in the event of a complaint against you and/or the school/college.
For further guidance on how to make a sound decision, read the ICO’s ‘Data Sharing Code of Practice’.