Consent / permission and working with others - DfE new guidance

Advice from DfE: asking consent (permission) to share information, the EYFS and GDPR

We asked for clarity on 2 different sections of the EYFS: 2.5 and 3.68.

2.5 states, in relation to the 2 year progress check: ‘Providers must have the consent of parents and/or carers to share information directly with other relevant professionals.’

3.68 states, in relation to information sharing: ‘Providers must enable a regular two-way flow of information with parents and/or carers, and between providers, if a child is attending more than one setting.’

DfE state in recent advice (06.2018):

‘Although paragraphs 2.5 and 3.68 in the EYFS are both about sharing information about individual children they serve different purposes.

The context of paragraph 2.5 is the progress check at age two, where the intention is that parents should be encouraged to discuss their child’s progress in detail at this crucial stage of development. The context for paragraph 3.68 is much wider and can deal with any information sharing “as appropriate”, so this could, for example, deal with any cases where there is a concern about a child’s safety.

The requirement for parental consent applies to the two year old check but it doesn’t necessarily apply to the sharing required by paragraph 3.68.

For complying with both paragraphs providers always need to ensure they act lawfully and comply with data protection requirements. For sharing information under paragraph 3.68, which doesn’t require parental consent, providers can rely on (the legal basis of) ‘legal obligation’ which is a condition under Article 6(1)(C) of the GDPR. This allows for the processing of personal data in order to comply with common law or statutory obligation. The EYFS is a statutory framework and so it sets out the legal requirements on providers which includes the sharing of information with ‘other professionals working with the child, the police, social services and Ofsted…’ about children particularly where there are safeguarding concerns. The specific legal obligation is to ensure no offence is being committed against a child.’

What does this mean to us?

As we know there are different legal bases for processing data about children and their families. If data processing is required by the statutory framework (in our case, the EYFS) then we do not need to ask permission to process it – we can use a different legal basis. DfE are telling us that, to share information with ‘other professionals working with the child, the police, social services and Ofsted’ we can use the legal basis of ‘legal obligation’ and we do not need to ask permission from children’s parents.

However, when sharing information about the 2 year progress check we do need parents consent. This then leaves the thorny question of what to do if parents refuse – especially if we are required by our Local Authority to share the check as part of the Integrated Review at 2. We need further advice I think!

Thank you Rebecca Martland for consulting with DfE :D