This year, because of COVID – 19, pupils will be unable to sit their exams as usual and, instead, they will receive calculated grades which will be based on a combination of teacher assessment, class ranking and past performance of the school. In view of this, it is even more likely than previous years that pupils will be asking their teachers what grade they are likely to receive.
Should all such requests be regarded as Subject Access Requests (SARs)?
Arguably, the requests could be regarded as SARs because:
- It is ok for SARs to be made verbally
- SARs do not have to be submitted in any specific format
- SARs do not have to quote the relevant law
- SARs can be made by children (not just adults), providing those children are deemed to be competent to exercise their own data protection rights. (In Scotland children who are aged 12 and over are presumed to be competent and although there is no such presumption in England and Wales, it is a useful guide and generally, children old enough to take GCSE exams will be regarded as competent).
- The information they are asking for is their personal data. They do not need to insist upon access to all their personal data. They are simply narrowing their request down to their exam results.
So, if a pupil asks a teacher what grade they are likely to receive this year and the teacher decides to treat this as a SAR, what action should the teacher take?
The Data Protection Act 2018 (DPA) provides an exemption which should be relied upon in this situation. Paragraph 25 of Schedule 2 to the DPA 2018 provides that if this information is requested before the exam results are announced, the school only needs to release the information either:
- Within 5 months of the request being made or
- Within 40 days of the results being announced, whichever is earlier.
Therefore, if a school receives a SAR relating to exam results in June or July, it would be able to legally withhold the information until the information is announced (13 August for A Levels and AS Levels and 20 August for GCSEs).
In terms of whether schools should treat every request they receive from their pupils for information on their likely grades as SARs, I would suggest not. I would advise that a common-sense approach should be adopted ie: what is reasonable in the given circumstances.
For example, if a pupil asks his/her teacher what grade they think they will be awarded this year, the teacher needs to make a judgement on whether they reasonably believe that the pupil wishes to exercise their right of access under Article 15 of the General Data Protection Regulation (GDPR) or whether they are simply ‘fishing’ for information because they know that the teacher’s assessment will be taken into consideration when Ofqual award the final calculated grades. For the most part, my guess is that most requests will fall within latter scenario.
If the teacher honestly considers that a SAR is being made, then the request needs to be considered as such and treated appropriately. This will create a huge amount of work. Whilst the exemption referred to above under the DPA 2018 means that the school will not have to respond within one month (as is the usual time limit for SARs), they will still need to fulfil all the other requirements that are necessary when processing a SAR.
For example, the teacher will need to clarify with the pupil that they do not require any other personal data and, when responding to a SAR, the GDPR requires that the data subject (the pupil in this case) must be provided with supplemental information such as details about their rights, including a right to complain to the Information Commissioner’s Office (ICO).
In addition to this, the school, as a controller, will need to log full details of all the SARs they receive in a register and keep copies of their responses and have this available for inspection by the ICO upon request. This is necessary for the school to fulfil the Accountability Principle under the GDPR.
If any requests are to be treated as SARs it will be necessary for the school to:
- Record exactly who made the request and when
- Ensure that the reply includes the supplementary information required under the GDPR
- Keep a copy of the response, the date it was provided, how it was provided etc
- Ensure the SAR register is updated and is available for the ICO to inspect, if necessary
Therefore, I would suggest that the most appropriate way of dealing with requests for information on grades is to keep it as informal as possible. By doing this, the school will be able to avoid a great deal of work and expense yet, the pupils will still be provided with the information they are looking for.
Written by Sandy May, Head of GDPR Consultancy at DPAS.
DPAS are supporting Schools and Multi-Academy Trusts during August and Septemeber with additional resource SAR support and redaction services.
If you Trust or School needs support over the next few months, please get in touch on firstname.lastname@example.org visit our website www.dataprivacyadvisory.com