[COVID-19] Data Protection FAQs for School Counselling & Health

When reporting COVID-19 confirmed cases, how can we ensure we meet the requirements of the GDPR? Can online school counselling sessions be recorded? Find out in our latest blog written by 9ine's Senior Data Protection Consultant, Judith Downing.

When reporting COVID-19 confirmed cases, how can I ensure we meet the requirements of the GDPR?

You should always make sure you have a lawful basis for processing personal data. COVID-19 is a notifiable disease and therefore your organisation will have a legal obligation to report cases of COVID-19 to the appropriate authorities. Specific details, amounting to special category data, can also be shared with the authorities as there are provisions for ‘substantial public interest’ and ‘public interest in the area of public health’ within the GDPR to allow this.

A member of our organisation’s community has tested positive for COVID 19 can I send out an all school bulletin?

Where you are seeking to share personal data within your organisation’s community you must always remember that you still need a lawful basis to do so. Always consider what you are seeking to achieve by sharing the personal data and what amount of data you need to share to achieve that purpose (because you should always use the minimum amount of personal data necessary to achieve the purpose). In most cases, it will only be necessary to inform your community that a member of staff/parent or student has tested positive for the virus. 

I’m a school counsellor, can I record my sessions with students?

Given the confidential nature of these sessions we recommend that these sessions are not recorded as, depending on the nature of the counselling session, it may refer to special category data and/or safeguarding concerns. More information about recording virtual meetings read our recent blog, FAQs: Video Conferencing, Remote Learning and Data Protection.

ABOUT THE AUTHOR:

Judith Downing, Senior Data Protection Consultant, has almost 20 years of experience working in the field of data protection and has a BCS Practitioner Certificate in Data Protection and is also a certified GDPR practitioner. She currently advises schools in the UK, Europe and internationally on all aspects of data protection compliance either through our service desk or on-site audits.