We’ve had a few questions recently in the education sector, one of which keeps coming up is Subject Access Requests made by or on behalf of pupils.
- What is the difference between a Subject Access Request and a Freedom of Information Request?
- Do we have to respond?
- What do we have to provide?
- Can a pupil ask to see the calculations used to arrive at their exam results during the COVID-19 pandemic?
The difference between Freedom of Information Requests and Subject Access Requests
Freedom of Information applies to non-personal information, such as processes, procedures, policies or statistical/reporting information.
A Subject Access Request is explicitly requesting information that relates to or identifies an individual person, be it the requestor themselves, or someone who has authorised the requestor to make that request.
You must however be careful as people for not always use the correct terminology. You may indeed receive a “Freedom of Information Request for all information you hold about me”, or likewise “A Subject Access request for information on how many people achieved what grade for each year between 2015 and 2020”.
If you are not a Public Body, you may not be obliged to respond to a Freedom of Information request. If you are unsure if the law applies to you, if you say provide services under contract to a public body, contact an expert like one of the team at Xynics who can advise you accordingly.
When should you respond?
In general you must respond to all Subject Access Requests. These may be made to a teacher, teaching assistant or any other representative of the school and you should have a procedure in place to recognise and escalate such requests to the appropriate person(s).
A child under the GDPR and Data Protection Act has as much right as an adult. They are for all purposes, an independent data subject and that means that a parent for example, has no right to make a subject access request about their child.
You have the same obligations with a child to verify their identity and authority to make such a request. In Scotland, a child under 12 cannot make a Subject Request on their own behalf however in the rest of the UK, this presumption does not apply and every request must be assessed based on the capability of each child to understand and exercise that request.
If a child is too young, or unable to properly understand and exercise their rights themselves, a parent or legal guardian may exercise those rights on behalf of the child.
What do we have to provide?
When responding, you are required to confirm processing and supply access to, or copies of all information held which identifies, or relates to the identified child. This may include School Reports, Disciplinary Action, Registers and Records of Attendance, Emails or other correspondence between staff, or staff and parents discussing the child.
You do not have to provide anything which does not directly relate to the child. In the context of the COVID-19 Exam Results, the requestor is entitled to see the results, any comments or notes written by the examiner, or minutes of any appeals meetings.
As with any SAR, you must ensure any information you intend to disclose is suitably redacted so as not to identify another person. Where information identifies another individual, you must try and seek permission from that individual to release that information and only where that permission cannot be obtained or reasonably sought, can you withhold it from disclosure.
Where a source of data contains information identifying another individual, or the existence of that data itself would reasonably identify the author, you may need to redact identifying information, or withhold it outright. Before redaction or withholding, you must seek to obtain the permission of the identified third-party to release their identifying information.
Only where permission cannot be sought, obtained, or the person objects to the release of what is their personal data, should you redact the information, or if this is impractical or insufficient to protect their identity, withholding the data outright.
If you do withhold information you must inform the requestor that information existed which has been withheld due to its identifying another individual and therefore being their personal data and exempt from disclosure.
Can a pupil ask to see the calculations used to arrive at their exam results during the COVID-19 pandemic?
We consider that any calculations used by the school which affects any grades given, are by virtue related to that individual person, so should be included as they describe how a particular decision about that individual has been taken. Calculations used by an examination board however are not includable as it is not the school that determines the means of that processing.
Where teachers have provided exam boards with correspondence about a child for a grade to be calculated, those correspondence are also included as the child’s personal data and should be included in any response.
We would expect that any response where information has been shared with an exam board, should include details of that exam board such that the requestor can make a separate Subject Access Request to that body to obtain information processed about them by that body.