Scottish Online Formative Assessments

SOFA is an assessment programme designed by The Australian Council for Educational Research Ltd (ABN 19 004 398 145) (“ACER Ltd”) and is licensed for commercial use by ACER International Ltd (ACER UK) for use within the United Kingdom (UK) and the European Economic Area (EEA) for students in P2 to S1 in Scotland.

SOFA seeks to measure students’ levels of proficiency in English reading and writing and/or performance against the Curriculum for Excellence, and allows comparisons to be made in relation to other school students at the same year level, with similar students or with socio-economic factors taken into consideration (“the Aims”). De-identified or anonymous data from the Assessments may be used for the purpose of Scientific Educational Research by ACER Ltd.

The above sets out the purpose (“the Purpose”) for which a pupil’s personal data may be collected and processed by ACER UK from their respective institution. This privacy notice details the data collected, what ACER UK processes and why, and where it obtains this data from.

Your privacy is very important and ACER UK takes great care to ensure your personal data is protected. ACER UK is based in London, UK. The following information is set out to comply with applicable privacy and data law including:

• The Data Protection Act (2018) which incorporates the UK modified  "General Data Protection Regulation" (EU) 2016/679 (GDPR).
• The UK Privacy in Electronic Communications Regulation (PECR) or e-Privacy Regulation.

The Data

In pursuit of the Purpose, ACER UK gathers the following data (‘The Data’) directly from the pupil’s school by virtue of the institution subscribing to and participating in the SOFA assessments:

• Name;
• Date of birth;
• Gender;
• English as a second language;
• School ID number (Unique Pupil Number);
• Tags (any useful category the teacher adds);
• Year;
• School year;
• Gifted and talented indicator;
• Free School Meals and associated socio-economic data as requested from the school
• Child ethnicity;
• Type of disability;
• Raw test data;

If a pupil attends a school participating in the SOFA Programme, the school may, or will, have held meetings to explain the assessments prior to commencement. Depending on the legal basis upon which the school has chosen to share the participant personal data with ACER UK, they may have asked every parent/guardian to sign explicit consent for their child to participate within the project, or informed you that the school is treating participation in the SOFA Programme as a part of normal classroom activities in line with their legal authority as educators. In any event they will have provided you with this parental privacy guide to explain the role of ACER UK as a data processor for the SOFA Programme.

The Data Processing Act

To the extent of the applicability of the DPA 2018 to the Data:

• the collection of pupil Data by ACER UK was not a mandated requirement by Education Law, but was required by the participation of the School/Institution in the SOFA Programme. The only consequence of a pupil’s data not being collected is that s/he will not be able to participate in the SOFA Programme and assist in achieving the Aims;
• ACER UK is a processor in this programme and therefore only discloses pupil’s data and assessment results to:
  • The pupil’s School/Institution who provided the data originally and they will subsequently distribute to parents and guardians and pupils as required
  • ACER UK contractors assisting ACER UK in pursuing the Purpose with the School/Institution;
• if the pupil’s Institution is not within the UK or EEA, ACER UK will take steps to ensure the Institution complies with the DPA 2018, as if it was within the jurisdiction, but in any event ensure the following as a minimum:
  • The School/Institution has provided the legal basis upon which it has entered into the SOFA project, and if it has chosen consent, then it will have obtained explicit consent (as defined within the DPA 2018) to the disclosure of pupil’s data to ACER UK and has completed the required safeguarding mechanism for the transfer to the EEA or UK jurisdiction, and provided parents or guardians with the required privacy and project information as required.
  • They also acknowledge their role in receiving the assessment data and subsequent reports derived from the assessment data and its distribution back to the required parties.
  • They take responsibility to providing your data subject rights afforded to you under the DPA 2018, and ACER UK will assist in connection with the provision of these rights by facilitating access where required with the data collected.
  • Each individual School/Institution is responsible for compliance with its own jurisdictional data protection requirements and shall ensure ACER UK is held indemnified against any breaches in this legislation.
  • ACER Ltd may use the assessment data once anonymised for the pursuance of Scientific Educational Research for the benefit of the public interest/good.

Your rights as a data subject

Under the Data Processing Act a Data Subject (individual) has the following rights:

• Inspect his or her personal information; request the legal basis of processing; request to whom the data has been shared (if anyone), and request to know any safeguarding mechanism if the data is allowed outside the EEA.
• Request amendment of personal information if believed to be in error; and request right to be forgotten if the legal basis was explicit consent.
• Request restriction of processing or additional information in regards to any profiling activities carried out with the data.
• You have the right to withdraw consent at any time, if you were asked to provide it.
• You can make a complaint in respect of a breach of your privacy if you believe this has occurred and you have the right to complain to your supervisory authority if you believe your School/Institution or ACER UK have not complied with your correctly requested data subject rights.

To exercise any or all of the above rights, please review firstly your Institution Privacy Policy or web site Privacy Notice, or ACER UK’s Privacy Notice, which sets out the processes of how you may attend to the same. The Notice can be viewed at www.acer.org/privacy. For any query in respect of the consent referred to above (if used) use the Institution contact number details available via their web site.

The Processing Activities by ACER UK

As mandated within the DPA 2018 the controller of the data (Institution) must make sure it’s processing activities are legal; transparent and accountable with regard to the legislation. Thus, the extent of the processing is as follows:

• The Data is processed by ACER UK (acting as Processor) solely to for the Purpose above and no other ancillary processing is carried out.
• The legal basis for the Institution to share and allow processing of the data in this regard has been chosen by itself on entering into the programme; however, ACER UK legal basis for the use of anonymised data for research purposes is performance of a task carried out in the public interest.
• ACER UK will only share the collected data with your Institution, or any contractors working for ACER UK in supplying the service to the Institution (e.g., printers for papers if required; trainers for staff at schools; report designers for output requests, Service Desk for help and support etc.)
• ACER Ltd in Australia may carry out scientific educational research on anonymised data, thus this is for the public benefit or interest and is outside of DPA 2018 as data is not able to identify any individual at this point. However, ACER Ltd has a standard contractual clause agreement in place with ACER UK to comply fully with foreign transfer safeguards in any event.
• ACER UK has an appointed DPO within the UK and can be contacted in regards to this processing at either phone number +(44)7989 305294 or DPO@acer.org.

Contacts