Question: When I stop being a registered childminder but I still retain some data on children for insurances purposes, then do I have to continue to pay the £42 a year ICO annual fee as a data controller?
Answer: Yes you do if you continue to keep the data in any electronic form, such as on a memory stick, but No if you have printed out the information and have it just in paper form. So if you keep a box of paper in your loft after de-registering as a childminder, then you do NOT have to continue to pay the ICO fee.
Question: If a parent enquires about using my service and I take a few details from them while I think about it, or they think about it, do I have to give them a Privacy Notice because I am holding a few bits of information about a potential client?
Answer: Yes, GDPR requires you to tell the person what you will do with their information and how long you will keep it. So rather than give them a full Privacy Notice you could add a couple of lines of explanation…..for example, if you give enquiring parents a little bit of blurb about your setting, you could add a couple of GDPR lines OR you could direct them to your Privacy Notice on your website, if you have one. You can think of a simple solution, but you do have to let them know how long you will keep their information while they are deciding whether or not to use your service … say a month… this is up to you.
Question: Do I have to give the parent’s emergency contact a Privacy Notice?
Answer: No… first of all you have the parent’s contact details and their emergency contact details under the lawful basis of ‘ legal obligation’, because it says you must in the EYFS. It is not consent-based information from the childminder’s point of view, although obviously it is courtesy for the parent to ask the permission of their emergency contact. You do not need to give the parent’s emergency contact person a Privacy Notice to tell them what you are doing with their information because “measures should be risk-based and proportionate” (ICO website) but, as a matter of good practice, you might ask the parent to tell the emergency contact what you do with the emergency contact’s information and how long you keep it, OR you could add this to your Privacy Notice and ask the parent to point it out to their emergency contact person. In your Privacy Notice to the parent you could explain that you take the emergency contact information out of the house when you are out and about with the children and, for example, you might share it with a forest school leader and that you would delete the emergency contact details when the child moves on from your setting.