Published on 21 January 2019
National Child Measurement Programme and GDPR
The GDPR became UK law on 25 May 2018. All processing of personal data – meaning all aspects of the collection, analysis and dissemination of data about identifiable individuals1 – must have a lawful basis under the GDPR.
All local authorities in England are required to collect information on the height and weight of Reception and Year 6 schoolchildren. The statutory authority for the NCMP means that the lawful basis for processing this data is considered to be provided by the GDPR Articles covering ‘compliance with a legal obligation’ and ‘the provision of health care or treatment’.
Consent is not the lawful basis for the processing of NCMP data under the GDPR. However, parents must still be provided with:
• information about the processing of their children’s height and weight measurements, AND • provided with the opportunity to withdraw their child from the measurements (see section 3.32).
No change is needed to the way the NCMP data is processed by local authorities for the 2018/19 school year onwards for this to be lawful under the GDPR.
As consent is not the lawful basis for processing NCMP data, there is no requirement for schools to obtain the consent of parents for childen’s personal information to be used to manage the height and weight measurements. This includes the provision of class lists to school nursing teams and other providers undertaking the measurements on behalf of the local authority.
More inforamtionc an be found in the two uploaded documents.
If you have any queries realting to NCMP and GDPR then please contact Vikki Tolley at Walsall Public Health on email@example.com
Number of views (23)