With the phased re-opening of schools, the thorny issue of school gate/pick-up parking may well become an issue again for some schools, particularly with the advice to avoid public transport wherever possible. In reality it will not always be feasible for pupils to walk or cycle to and from school, particularly in rural areas.
Problematic parking and data protection law are not usually 2 subjects we might associate with one another. However they were linked in this query from a headteacher last term in relation to inconsiderate parking:
“Are we allowed, under GDPR, to publish in newsletters the registration details of cars who are parking inconsiderately and not abiding by the procedures put in place?”
An interesting question
Car registration numbers should be considered personal data in this context as they may allow the driver/owner to be identified. As personal data, the General Data Protection Regulation (GDPR) applies to how we use (process) these numbers.
Purpose
GDPR requires us to have a clear purpose for our processing of personal information and to have considered whether that purpose could be achieved another way.
The purpose behind this headteacher’s desire to publish the car numbers of inconsiderate drivers was the safety of the children entering and leaving the school site, as well as the wider issue of everyone’s safety. She had tried everything else she could think of, including having staff patrolling the area, but the school did not have sufficient members of staff to be able to continue doing this.
So, the purpose was clear; it was about the risk to everyone’s safety, and other ways had been tried without success, or could not be maintained.
Lawful Basis
GDPR requires that a lawful basis for personal data processing is identified. There are a number we can choose from and in this instance the one of ‘legitimate interests’ would be appropriate.
When we use legitimate interests, the GDPR asks us to assess whether the purpose and necessity of the processing outweigh the privacy rights of the individuals involved. In this situation, I believe they do: the safety of the children and others being paramount.
Outcome
My advice was that, with a clear purpose and lawful basis identified, it was permissible under the GDPR to publish car registration details in the school newsletters of cars parking inconsiderately and not following the school’s parking procedures.
I also advised that the school should keep a record of this decision, with the reasoning behind it, as evidence of its compliance with the GDPR; which is required under the principle of accountability.
It is important to consider this type of scenario on a case by case basis and the fact that the GDPR is a flexible, risk-based law is very helpful. If you would like any support considering the GDPR implications of any actions your school or trust would like to take, please don’t hesitate to get in touch. I would be pleased to help you.