Data Protection Guidelines for Childcare Service Providers under the NCIP Community Childcare Subvention Scheme (2008-2010)
The personal information which parents will be required to provide on the Parent Declaration Forms, including their Personal Public Service Number (PPSN) and details of the social benefits which they are in receipt of, is protected by law. The Data Protection Acts 1988 and 2003 convey certain responsibilities on organisations/individuals collecting personal information which must be adhered to. This guidelines document provides details of these obligations and practical advice on the measures needed to be undertaken by Childcare Service Providers to be in compliance with this legislation.
The following principles should be observed by your service to ensure that it meets the required levels of data protection.
- Obtain and process information fairly
To fairly obtain the data the data subject must, at the time the personal data is being collected, be made aware of the identity of the data controller/the purpose in collecting the data, and the persons or categories of persons to whom the data may be disclosed. To fairly process the data it must have been fairly obtained and in this case, the data subject must have consented to the processing.
Parents who return completed Declaration Forms to a service provider for the purpose of the Subvention Scheme should be aware of and consent to the transmission of the information to the OMC, as outlined in the Parents Letter and the Parent Declaration.
Where a parents declaration is not verified by the OMC’s checks, Services will be issued with a letter to inform them that the subvention applied for does not apply. Services should correct their register of the subventions due to parents, and supply the parent with the letter, stating that as a result you will not receive grant aid to reduce the fee charged. You should not retain this letter, or a copy of it, for more than 1 month.
If in the verification of information a parent disputes the outcome, they should contact the OMC directly.
- Keep it only for one or more specified, explicit and lawful purposes use and disclose it only in ways compatible with these purposes
Under data protection legislation, you may only keep data for specific, lawful and clearly stated purposes and the data should only be processed in a manner compatible with the purpose(s).
In this case, only information required on the Parent Declaration Form is to be requested from parents for the purposes of the Subvention Scheme. The service provider should use the information provided on the Parent Declaration Form to complete the summary form and should then attach them to the summary form and return these to the OMC. A copy of the summary form should be retained by the service provider but no other record or copy of Declaration Forms should be retained by the service provider. The only record you should retain is of the subvention level which applies to the individual parents. It should be noted that the OMC will forward the information provided to the Department of Social and Family Affairs to confirm that the details given are true and accurate.
The information contained in these forms should not be used for further purposes or disclosed to third parties, other than the OMC, by the Service Provider. Requests for information from third parties should be referred to the OMC for reply. The PPSN in particular is also protected under Social Welfare legislation.
- Keep it safe and secure
The security of personal information is a very important consideration under the Data Protection Acts. Appropriate security measures must be taken by service providers against unauthorised access to the data it is collecting and storing on behalf of the OMC.
A minimum standard of security would include the following measures:
- Access to the information should be restricted to authorised staff on a “need-to-know” basis.
- Manual files should be stored in a lockable filing cabinet located away from public areas
- Any information which needs to be disposed of, should be done so carefully and thoroughly
- Premises should be secured when unoccupied
- Keep it accurate, complete and up-to-date & ensure that it is adequate, relevant and not excessive
The Declaration Forms set out the relevant information required by the OMC for the Scheme. Supplementary information should not be requested from parents for this purpose.
- Retain the information for no longer than is necessary for the purpose
In order to comply with this requirement, service users should comply with the retention period set out for this Scheme by the OMC. The OMC itself will retain the Declaration Forms and summary sheets for a period of 5 years. A copy of the summary form should be retained by the Service providers but no other record or copy of Declaration Forms should be retained by the service provider. The Service Provider should implement procedures to ensure that this retention period is complied with.
- Give a copy of his/her personal data to that individual, on request
Every individual about whom a data controller keeps personal information has a right to request a copy of the data which is kept about them. The service provider should only hold limited personal information on an individual in relation to the Scheme. A copy of this information should be included along with other personal information held about the individual making the access request. A request for more detailed information relating to this Scheme should be redirected to the OMC for reply.