Data protection aims to protect people’s personal information from misuse by placing controls on organisations and people who handle personal information. The principal piece of legislation is the Data Protection Act 1998 (DPA). Early years settings must comply with the DPA in respect of all the personal information that it holds about individuals whether they are an employee, child, parent or member of the public.
The DPA places a number of obligations on settings when they process personal data.
For example, settings must notify the Information Commissioner about the information it holds and the purpose for holding such information and it must also comply with 8 data protection principles. To check whether you need to register with the Information Commissioner you can go through their quick self assessment tool. If your setting is registered as a charity, you are automatically exempt.
Personal data must be:
- Fairly and lawfully processed
- Processed for limited purposes
- Adequate, relevant and not excessive
- Not kept for longer than is necessary
- Processed in line with your rights
- Not transferred to countries without adequate protection
Furthermore the Early Years Foundation Stage statutory guidance places specific requirements on childcare providers in storing and protecting information and records, as well as the need for staff to be aware of their obligations to protect the privacy of children and the legal requirements which underpin this (paragraphs 3.68-3.71). Any provider which retains electronic records and/or digital photographs of the children in their setting must register with the Information Commissioner's Office.
The Early Years Foundation Stage statutory guidance (paragraphs 3.72 and 3.76) states that the following records must be held and in accordance with the DPA:
Information about the child
- full name;
- date of birth;
- name and address of every parent and/or carer who is known to the provider (and information about any other person who has parental responsibility for the child);
- which parent(s) and/ or carer(s) the child normally lives with; and
- emergency contact details for parents and/or carers.
Information about the provider
- name, home address and telephone number of the provider and any other person living or employed on the premises (this requirement does not apply to childminders);
- name, home address and telephone number of anyone else who will regularly be in unsupervised contact with the children attending the early years provision;
- a daily record of the names of the children being cared for on the premises, their hours of attendance and the names of each child's key person; and
- their certificate of registration (which must be displayed at the setting and shown to parents and/or carers on request).
Moreover, providers must make the following information available to parents and/or carers (paragraph 3.73):
- how the EYFS is being delivered in the setting, and how parents and/or carers can access more information (for example, via the DfE website);
- the range and type of activities and experiences provided for children, the daily routines of the setting, and how parents and carers can share learning at home;
- how the setting supports children with special educational needs and disabilities;
- food and drinks provided for children;
- details of the provider's policies and procedures (all providers except childminders must make copies available on request) including the procedure to be followed in the event of a parent and/or carer failing to collect a child at the appointed time, or in the event of a child going missing at, or away from, the setting; and
- staffing in the setting; the name of their child’s key person and their role; and a telephone number for parents and/or carers to contact in an emergency.