Add privacy notice guidance to Patterns and components

[kerryalyons]

##What

Add information to patterns and components section so that service teams know there is only 1 single departmental privacy notice. Include a link to the guidance.

Link to guidance on DfE intranet: https://educationgovuk.sharepoint.com/sites/lvewp00158/SitePages/Privacy-Notices.aspx

We will also add this information to ASSiDfE issue, in patterns and components.

##Why

We've seen confusion in service teams about conflicting privacy notices they have seen. Service teams reached out to DesignOps for reassurance.

###User feedback

Hi lovely DesignOps team,

I am working on a privacy notice for our digital certificates project. I am not able to find any specific department guidance and I came across a couple of different examples within DfE. I appreciate some of these are in services and on GOV.UK, and privacy notices do vary, but where we have similar headings, it could be easier for users if they were consistent. Examples:

https://my.apprenticeships.education.gov.uk/Privacy

https://www.gov.uk/government/publications/lrs-privacy-notices/lrs-privacy-notice

https://www.gov.uk/government/publications/privacy-notice-skills-and-training-programme-employer-case-studies
(with the bonus of PDFs)

I’m involving the Data Protection team to sign off the content I’m working on obviously. Still, if we are working on privacy notices within different services in our department, it would be helpful to have some guidance so we’re covering everything that’s required and can have consistent headings.

And if I’ve missed the guidance, please let me know 😊

###DesignOps response

We have a single departmental privay notice which services are meant to link to, and it’s managed by the DPO team.

It’s essentially this: https://www.gov.uk/government/publications/privacy-information-members-of-the-public/privacy-information-members-of-the-public

The guidance is here: https://educationgovuk.sharepoint.com/sites/lvewp00158/SitePages/Privacy-Notices.aspx

The data subject privacy notices (PNs) cover all DfE’s processing activities. They provide a high-level view of the personal data processing activities for those data subjects. For example, I am a learner in KS4 and this is the data that DfE processes about me.

There will be no more separate privacy notices – unless a more granular privacy notice is required (and agreed with ODPO), e.g. NPD, LEO, ILR, LRS.

Hope this helps.