Agenda item

To present the report of the Director of Education, Skills and Young People.

The report of the Director of Education, Skills and Young People which provided the Governance and Audit Committee with annual assurance on the effectiveness of information governance and data protection in the Council’s maintained schools during 2024/25 was presented for consideration. The report summarised key activities and outputs, identified  risks, mitigation measures, future priorities, and an overall assurance opinion.

The Director of Education, Skills and Young People reported that during the reporting period, the Schools Data Protection Officer role was covered on a temporary basis (on average one day per week or more when required) due to the long-term absence of the substantive postholder. Due to the limited capacity, work has focused on statutory duties, incidents and high risk issues rather than proactive audit or development activities. The priority has been to maintain statutory compliance, manage live risks and incidents, provide consistent advice and support to schools and act as a central escalation and assurance point.

Based on the work completed, the temporary DPO offers reasonable assurance that schools generally have appropriate data protection policies and procedures in place. Day to day information handling is largely sound, incidents and breaches are being identified and managed appropriately and escalation routes to corporate services and the SIRO are functioning effectively.

The Director of Education, Skills and Young People also highlighted the strategic risks identified, confirming that they are recognised, proportionately managed and escalated where necessary. While key controls are in place to support ongoing compliance, they  would benefit from further strengthening. The issues identified are consistent with previous reports and remain manageable with continued focus and appropriate resourcing.

In discussing the report, the committee raised the following issues –

·      The long-term plan for ensuring capacity within the Schools DPO role

·      The generalised nature of the report and lack of concrete data to evidence outputs, making it difficult to measure progress or improvement

·      Whether issuing a reasonable assurance opinion despite identified strategic risks suggests that the threshold for reasonable may be set too low.

·      The absence of quantified risks and overall lack of preciseness in the information presented.

·      Concern that the 20% temporary replacement for the Schools DPO hours is inadequate with some members feeling that statutory compliance has been maintained more by good fortune than by robust oversight.

The Director of Education, Skills and Young People responded to the issues raised confirming that the Schools DPO remains a permanent post within the Council structure. The intention going forward is to stabilise the Schools DPO capacity and support more proactive assurance activity, bringing in additional support where required. The lack of detailed data in the report reflects the limited capacity during the period and the need to prioritise statutory and high risk work. He agreed to include the requested data and greater detail in the next annual report.

He noted that the temporary Schools DPO has drafted the report and has provided ongoing support for schools and that her reasonable assurance opinion is trusted. The report aims to set out clearly what has been delivered and the measures in place based on the  foundations established by the permanent Schools DPO prior to her absence. The issues identified will be addressed following the meeting. He further acknowledged that an additional action arising from the discussion is to review how capacity and support for schools can be increased to return to a more proactive level of assurance.

It was resolved that the committee notes the assurance provided by the Temporary Schools Data Protection Office’s report subject to the understanding that the assurance relates to a temporary period, and that additional support will be provided during this period.