Guidance

• School suspensions and permanent exclusions
• Data protection in schools
• Understanding and dealing with issues relating to parental responsibility
• Accessing pupils’ information (ICO)

Subject Access

Unlike a parent’s right of access to their child’s educational record (explained in the section below), pupils at any type of school have the right to access their own information. This is known as the right of subject access, and it covers all personal data held about the data subject (it is not limited to the educational record). The statutory process for obtaining such information is called a Subject Access Request (SAR).

The right of subject access is included in Section 45 Data Protection Act 2018 and Article 15(3) General Data Protection Regulation.

What information is a data subject entitled to?

Under Regulation 15(3) GDPR, the information a person is entitled to is “a copy of the personal data undergoing processing”. The only exception is in Regulation 15(4), which states that this does not include information that would breach another person’s right to privacy. The school should redact personal information that identifies anyone other than the person the SAR is about. This is known as removing third party information.

A SAR entitles a person to access their own personal information but does not entitle them to access full documents. The school may extract personal information from a document to include in the SAR response, and provide context of where the information is held.

Personal information is information that relates to an ‘identified individual’. This is a broad definition that covers most documents and correspondence about a person, provided that, on a common-sense reading, the document is about them. It includes emails and letters concerning a child, whether exchanged internally between staff or externally with other agencies. It also includes CCTV, although a school may refuse to provide footage if doing so would breach the data rights of other children who are visible.

Guidance concerning a child making a SAR

There aren’t any age requirements attached to the right of subject access, but in the UK we tend to consider 12 as the age where young people can exercise their own legal rights. However, when a child of any age submits a SAR, the school should assess if they can understand the information they will receive in response to their request. If the school believes the child has the maturity and understanding to request and receive the information, they should respond directly to the child, regardless of their age.

The school should not respond directly to the child if they believe they:

• do not have the maturity or competence to act independently
• have a health condition that limits their understanding
• have given consent for a representative or someone with parental responsibility to act on their behalf

In these cases, the school should contact the child and ask if they agree for their parent or carer to make the request on their behalf.

Can parents make a SAR to get information on their child?

Parents may only submit a SAR on behalf of their child if the child is not competent to act for themselves, or if the child has given their consent.

How can an individual make a SAR?

Individuals can make a SAR in any format. They could make a verbal request, or a written request via a letter, text, or email. Once an individual has made a request, the school cannot ask them to change the format they made the request in. The person requesting information does not need to refer to the process as a SAR.

What is the timeframe for providing a SAR?

A full SAR response must be sent to the requester within one calendar month. There are no special rules which allow schools to extend the time period for dealing with a SAR if it is received during school holidays.

A school can extend the SAR deadline if they have to wait for the requester to provide identification, authority and any clarification they might need. If the request is complex, the response time can be extended by up to a further 2 calendar months, making the response deadline 3 months in total.

Can a SAR be refused?

Schools can refuse to comply with a SAR if:

• a data protection exemption can be applied to all the personal information in scope of the request
• the request is manifestly unfounded or manifestly excessive

Examples of exemptions that may apply include:

• releasing the information would cause serious harm to a child
• releasing information would not be in the best interests of a child
• information relating to third parties
• legal advice sought and received from a lawyer
• information that may prejudice an investigation

Right in education law for a parent to access their child’s education record

The Education (Pupil Information) (England) Regulations 2005 give parents of pupils at Local Education Authority maintained schools the right to access their child’s educational records. The Education (Pupil Information) (England) Regulations 2005 do not apply to non-maintained schools (e.g. academies, free schools and independent schools).

Who is considered a parent?

For the purposes of education law, Section 576 Education Act 1996 defines a ‘parent’ as:

• all natural (biological) parents, whether they are married or not;
• any person who, although not a natural parent, has parental responsibility for a child or young person (this could be a step-parent, guardian or other relative);
• any person who, although not a natural parent, has care of a child or young person.

What is included in an education record?

Educational records may include information such as the records of the pupil’s academic achievements as well as correspondence from teachers, local education authority employees and educational psychologists.

This right is less comprehensive than the right to subject access under the Data Protection Act, because an education record does not necessarily include all personal information held by a school. For example, it might not cover relevant correspondence between teachers or CCTV footage.

How can a parent make a request and how long does it take?

A parent should make a written request for the education record to the chair of the school’s governing board. IPSEA provides a template letter on their website. The school has a duty to provide the record within 15 school days of receiving the request.

Can the child concerned refuse access?

Parents have a right to access their child’s educational record under this legislation, even if their child does not wish them to access it. Schools do, however, have the right to refuse a parent’s request for information in some circumstances – for example, where the information might cause serious harm to the physical or mental health of the pupil or another individual.

Independent schools and Academies

The Education (Independent School Standards) Regulations 2014 set out certain minimum standards that all independent schools (including academies and free schools) must meet. The standards on information provision require that an annual written report of each registered pupil’s progress and attainment in the main subject areas taught is provided to the parents of that registered pupil.

Further information can be found in Part 6 of the guidance Independent school standards: Guidance for independent schools.

Freedom of Information

The Freedom of Information Act 2000 provides public access to information held by public authorities. The Act does not give people access to their own personal data. Only public bodies, and some private bodies funded to perform a public function, are bound by the Freedom of Information (FOI) Act. In practice, this means that maintained schools, academies, and government-funded free schools are covered by FOI, while independent schools are not.

What type of information could be accessed?

Section 1 of the FOI Act contains the right for any person to request information from a public body. This right is limited by the 24 exceptions set out in sections 21–44 of the FOI Act.

The exceptions most relevant for young people attending school are:

• Information restricted for law enforcement purposes (s.31);
• Information that is intended for future publication anyway (s.22);
• Information that can already be accessed by means other than FOI (s.21);
• Information restricted for health and safety reasons (s.38);
• Personal information (s.40).

In reality, most relevant information should be obtainable. For example, statistics on the use of exclusions across different groups to identify trends, or internal guidance to staff on addressing SEND or other relevant situations, should be disclosable without falling under any exemptions.

How to make a FOI request?

A FOI request must be made in writing, for example, via:

• letter
• email
• social media
• online form – check the organisation’s website or the government department’s page to see if they have an online form
• WhatDoTheyKnow

What are the time limits for complying with an FOI request?

A FOI request must be responded to as soon as possible, and in any event, within the maximum number of days allowed under the FOI Act. For most organisations, the deadline is 20 working days from the date of the request. Under Regulation 3 The Freedom of Information (Time for Compliance with Request) Regulations 2004, the time limit for schools is 20 school days or 60 working days, whichever is sooner.

What recourse is available when schools fail to satisfy an information request?

A parent or young person may address concerns or make a complaint directly with the school involved. For FOI requests and SARs, a complaint can also be submitted to the Information Commissioner’s Office. The Information Commissioner is the UK’s independent regulator for Data Protection and Freedom of Information.