The SOFA is an assessment program designed by The Australian Council for Educational Research Ltd (ABN 19 004 398 145) (“ACER Ltd”) and is licensed for commercial use by ACER International Ltd (ACER UK) for use within the United Kingdom (UK) and the European Economic Area (EEA )for students in years 1 to 10 or P2 to S1 in Scotland.

The SOFA seeks to measure students’ levels of proficiency in English literature, reading, writing and/or performance against Curriculum for Excellence, and allows comparisons to be made in relation to other school students at the same year level with similar students or other socio-economic factors taken into consideration (“the Aims”). De-identified or anonymous data from the Assessments may be used for the purpose of Scientific Educational Research by ACER Ltd.

The above sets out the purpose (“the Purpose”) for which your child’s personal data may be collected and processed by ACER UK from their respective institution. This privacy notice details the data collected, what ACER UK processes and why, and where it obtains this data from.

Your privacy is very important and ACER UK takes great care to ensure your personal data is protected. ACER UK is based in London UK. The following information is set out to comply with applicable privacy and data law including:

  • The Data Protection Act (2018) which incorporates the UK modifiedGeneralDataProtectionRegulation”(EU) 2016/679 (GDPR).
  • The UK Privacy in Electronic Communications Regulation (PECR) or e-Privacy Regulation.

 

The Data

In pursuit of the Purpose, ACER UK gathers the following data (‘The Data’) directly from your child’s school by virtue of the institution participating within the SOFA project:

  • Name;
  • Date of birth;
  • Gender;
  • English as a second language;
  • School ID number (Unique Pupil Number);
  • Tags (any useful category the teacher adds);
  • Year;
  • School year;
  • Gifted and talented indicator;
  • Free School Meals and associated socio-economic data as requested from the school
  • Child ethnicity;
  • Type of disability;
  • Raw test data;

If you attend a school participating in the project, they will have held meetings to explain the project and asked every parent/guardian to sign explicit consent for your child to participate within the project, and provided you with a parental privacy guide to explain the role of ACER UK.

The Privacy Act

To the extent of the applicability of the DPA 2018 to the Data:

  • the collection of your child’s Data by ACER UK was not required by Education Law. The only consequence of your child’s data not being provided is that your child will not be able to participate in the SOFA project and assist in achieving the Aims;
  • ACER UK only discloses your child’s data and assessment results to:
    • Your child’s school who provided the data originally and they will subsequently distribute to parents and guardians as required
    • ACER UK contractors assisting ACER UK in pursuing the Purpose with the school;
  • if your child’s school is not within the UK or EEA, ACER UK will take steps to ensure the school complies with the DPA 2018, as if it was within the jurisdictions, but in any event ensure the following as a minimum:
    • The school has obtained your explicit consent (as defined within the DPA 2018) to the disclosure of your child’s data to ACER UK and has completed the required safeguarding mechanism for the transfer to the EEA jurisdiction, and provided parents with the required privacy and project information as required.
    • They also acknowledge their role in receiving the assessment data and subsequent reports derived from the assessment data and its distribution back to the required parties.
    • They take responsibility to providing your data subject rights afforded to you under the DPA 2018, and ACER UK will assist in connection with the provision of these rights by assisting where required with data collected.
    • Each individual school is responsible for compliance with its own jurisdictional data protection requirements and shall ensure ACER UK is held indemnified against any breaches in this legislation.
    • ACER Ltd may use the assessment data once anonymised for the pursuance of Scientific Educational Research for the benefit of the public interest/good.

 

Your rights as a data subject

Under the Privacy Act you and your child have the right to:

  • Inspect his or her personal information; request the legal basis of processing; request to whom the data has been shared (if anyone), and request to know any safeguarding mechanism if the data is allowed outside the EEA.
  • Request amendment of personal information if believed to be in error; and request right to be forgotten given legal basis was explicit consent.
  • Request restriction of processing or additional information in regards to any profiling activities carried out with the data.
  • You have the right to withdraw consent at any time.
  • You can make a complaint in respect of a breach of your child’s privacy if you believe this has occurred and you have the right to complain to your supervisory authority if you believe your School or ACER UK have not complied with your correctly requested data subject rights.

To exercise any or all of the above rights, please review firstly your schools Privacy Policy or web site Privacy Notice, or ACER UK’s Privacy Notice, which sets out the processes of how you may attend to the same. The Notice can be viewed at www.acer.org/privacy. For any query in respect of the consent referred to above use the school contact number details available via their web site.

 

The Processing Activities by ACER UK

As mandated within the DPA 2018 the controller of the data must make sure it’s processing activities are legal; transparent and accountable with regard to the legislation. Thus, the extent of the processing is as follows:

  • The Data is processed by ACER UK solely to for the Purpose above and no other ancillary processing is carried out.
  • The legal basis for the school to process the data in this regard is consent; however, ACER UK legal basis is performance of a task carried out in the public interest.
  • ACER UK will only share the collected data with your school, or any contractors working for ACER UK in supplying the service to the school (e.g. printers for papers if required; trainers for staff at schools; report designers for output requests, Service Desk for help and support etc.)
  • ACER Ltd in Australia may carry out scientific educational research on anonymised data, thus this is for the public benefit or interest and is outside of DPA 2018 as data is not able to identify any individual at this point. However, ACER Ltd has a standard contractual clause agreement in place with ACER UK to comply fully with foreign transfer safeguards in any event.
  • ACER UK has an appointed DPO within the UK and can be contacted in regards to this processing at either phone number +(44)7989 305294 or DPO@acer.org.

 

Cross-Border Data Transfers

The Data is transferred to ACER’s UK main office and it is in turn stored within the secure EEA data centres in line with DPA 2018. There are no data transfers outside the EEA allowed, except in a specific situation; the institution supplying the data initially resides outside of the EEA, in which case ACER UK will ensure the transfer to and from the institution is compliant with required safeguarding methods as part of the project initiation process.  If ACER Ltd in Australia is going to process anonymised data for scientific educational purposes for the public interest then although this data transfer is outside of the scope of DPA 2018, ACER Ltd already has a safeguarding arrangement in place with its subsidiary based on the EU’s Standard Contractual Clauses, thus all safeguards for data subject rights are maintained.  As described above ACER UK is a controller for that purpose. The transfer of data occurs to satisfy your school’s contract with ACER UK. As controller in respect of the transfer your school should ensure such transfer is compliant with the GDPR or any other applicable local law.

Data Retention Periods

Unless otherwise requested by the school utilising the SOFA, the Data is retained in accordance with the table below:

Type of Data

Retention Time

Notes

Physical exam booklets (if used)

Eight months after the testing date.

The test booklets are shredded. Scanned images of the test booklets are retained as per below.

Electronic scans and copies of any data files.

Ten years after the testing date.

This timeframe allows ACER UK to provide your school with longitudinal data analysis allowing your school to track student progress as they move through each year level.
After this 10 year period, statistical and research data generated from the SOFA project are retained indefinitely, however all data contributing to the programme is anonymised so no individual can be identified whatsoever.

Electronic individual reports

Eight years after the testing date.

This timeframe covers the eight years of the SOFA assessment (Primary 2 to Secondary 1) and allows ACER UK to provide copies of reports to schools and respond to queries regarding student performance.

Electronic class and school reports

Eight years after the testing date.

This timeframe covers the eight years of the SOFA assessment (Primary 2 to Secondary 1) and allows ACER UK to provide copies of reports to schools and respond to queries regarding their performance.

 

 

Contacts

 

The Company

ACER’s office within the European Union is:

ACER International UK Ltd
13-15 Canfield Place
London NW6 3BT
United Kingdom
Phone: +44 (0) 2038295924

ACER’s office within Australia is:

Street address:
19 Prospect Hill Rd Camberwell VIC 3124
Australia

Postal address:
Private Bag 55
Camberwell VIC 3124
Australia
Phone: +61 3 9277 5555
Fax: +61 3 9277 5500

Data Protection Officer

Raymond Ford
Contact number: (+ 44) (0) 7989305294
Email: DPO@acer.org