Should exam results be treated as subject access requests? This year, because of COVID – 19, pupils will be unable to sit their exams as usual. Instead, they will receive calculated grades. These will be based on a combination of teacher assessment, class ranking and past performance of the school. As such, it is more likely than previous years that pupils will ask their teachers what grade they are likely to receive.
How could these requests be regarded as Subject Access Requests (SARs)?
Arguably, the requests could be regarded as Subject Access Requests because:
- It is ok for SARs to be made verbally
- They do not have to be submitted in any specific format
- SARs do not have to quote the relevant law
- Children can make SARs (not just adults), providing they are deemed to be competent to exercise their own data protection rights.
In Scotland children who are aged 12 and over are presumed to be competent. There is no such presumption in England and Wales. Generally, children old enough to take GCSE exams will be regarded as competent.
The information they are asking for is their personal data. They do not need to insist upon access to all their personal data. They are simply narrowing their request down to their exam results.
So, if a pupil asks a teacher what grade they are likely to receive in lieu of exam results this year, and the teacher decides to treat this as a Subject Access Request…
What action should the teacher take?
The Data Protection Act 2018 (DPA) provides an exemption which should be used in this situation. Paragraph 25 of Schedule 2 to the DPA 2018 provides that if this information is requested before the exam results are announced, the school only needs to release the information either:
- Within 5 months of the request being made or
- Within 40 days of the results being announced
Whichever is earlier. Therefore, if a school receives a Subject Access Request relating to exam results in June or July, it would be able to legally withhold the information until the information is announced. This is 13 August for A Levels and AS Levels and 20 August for GCSEs.
Should schools should treat every request from their pupils for information on likely grades as SARs? I would suggest not. I would advise adpoting a common-sense approach – what is reasonable in the given circumstances?
Common Sense Approach
Example: if a pupil asks his/her teacher what grade they think they will be awarded this year, the teacher needs to make a judgement using reasonable belief. Does pupil wish to exercise their right of access under Article 15 of the GDPR? Or are they simply ‘fishing’ for information because they know that the teacher’s assessment will be considered when Ofqual award the final calculated grades?
Mostly, my guess is that most requests will fall within latter scenario.
If the teacher honestly believes that a SAR is being made, then the request needs to be considered and treated appropriately. This will create a huge amount of work. The exemption referred to under the DPA 2018 means that the school will not have to respond within one month (as is the usual time limit for SARs). However, they still need to fulfil all other requirements that are necessary when processing a SAR.
For example, the teacher will need to clarify with the pupil that they do not require any other personal data. When responding to a SAR, the GDPR requires that the data subject (the pupil in this case) must be provided with supplemental information such as details about their rights, including a right to complain to the Information Commissioner’s Office (ICO).
In addition to this, the school as a controller will need to log full details of all the SARs they receive. This should be in a register, and copies of their responses kept. The register should be available for inspection by the ICO upon request. This is necessary for the school to fulfil the Accountability Principle under the GDPR.
Recording SARs
If any requests are to be treated as SARs it will be necessary for the school to:
- Record exactly who made the request and when
- Ensure that the reply includes the supplementary information required under the GDPR
- Keep a copy of the response, along with the date and method of provision
- Ensure the register is updated and is available for ICO inspection, if necessary
Therefore, I would suggest that the most appropriate way of dealing with such requests is to keep it as informal as possible. By doing this, the school will be able to avoid a great deal of work and expense, yet the pupils will still be provided with the information they are looking for.
Written by Sandy May, Head of GDPR Consultancy at DPAS.
DPAS are supporting Schools and Multi-Academy Trusts with additional resource SAR support and redaction services.
If you Trust or School needs support, please get in touch on info@dataprivacyadvisory.com or fill out a contact form.
You can keep up to date with legal changes and refresh your knowledge by attending our Data Protection In Practice For Schools training course. Check out the latest dates and book your place today!
