Introduction

This Quick Guide provides information on the law and practice of a young person's right to obtain their school file and other information.

For directions on making requests for information, see the Step-by-Step Guide: Education records

What relevant information rights are there for excluded young people?

Subject Access

The statutory process for obtaining information that an organisation holds about a data subject is known as a subject access request ("SAR"). It might also be referred to as the ‘right of access’. It is the process for obtaining information through which the person requesting the information can be identified. Schools keep a file for every student. This file, correspondence relating to that student, and any multimedia data, such as school CCTV, is personal information that can be requested through an SAR. SAR is the most generally applicable right of access. SARs can be made to every school and any other organisation that "processes" personal data. Processing data refers to a range of activities, including creating files of data, storing data, sharing data, and reviewing data.

The right of subject access is included in the Data Protection Act 2018 at section 45 ("DPA") and in the General Data Protection Regulations at Article 15(3) (“GDPR”).

Maintained schools - right to the school file

Maintained schools have a separate duty to share personal information, which is contained in the Education (Pupil Information) (England) Regulations 2005 at regulation 5(2). This right is less comprehensive than the right to subject access under the Data Protection Act because a "school file" does not necessarily include all personal information held by a school. For example, it might not include relevant correspondence between teachers or CCTV.

This duty is not shared by academies, free schools or independent schools.

Freedom of Information

Section 1 of the Freedom of Information Act contains the right for any person to request information from a public body that is not personal to an individual. This includes statistics or unpublished policies. Only public bodies and some private bodies that are funded to perform a public function are bound by the Freedom of Information Act. In practice, this means that maintained schools, academies, and government-funded free schools are bound by FOI. However, independent schools are not.

The “Panel Pack”

Once a school has excluded someone, they should compile the evidence they want to rely on to support that decision and provide it to the school’s governing board. The governing board then have a responsibility under paragraph 112 of the exclusions guidance to circulate that information at least five school days before they meet to hear the exclusion. This is sometimes referred to as the "panel pack ". There is no specific right for the family to have any information included in this pack, and it is no duty for the school to provide anything if they don't want to provide evidence in support of their decision to exclude.

When can children request their own information?

Children nominally have the same right of access to their records as an adult does. A child can therefore make a request for themselves. The ICO’s guidance explains that a request cannot be denied simply because the person making it is a child. However, it can be denied if the data controller is not satisfied that the child has the "competence" to understand their own data rights.

As a general rule of thumb, the ICO points to the rules in Scotland, which state that a child aged under 12 is not competent to access their own information, and those aged 12 and over are.

Anyone can make a Freedom of Information Act request, regardless of age.

What are the time limits for complying with a request?

Subject Access

The time limit for data controllers to provide information is known as the "relevant period". It is set out in s. 54 of the Data Protection Act 2018 as being 1 month. The limit limit starts from when the request for information is received by the data controller. Within this period, data controllers still have to provide information "without undue delay", so they cannot use the whole month if the request is straightforward enough to be satisfied sooner.

Article 12(3) GDPR allows data controllers to extend the one-month time limit to three months where "necessary", taking into account the complexity of the request and the number of requests. If the data controller wants to exercise this option, they must give notice to the data subject within the initial one-month time limit.

The ICO has provided guidance on this matter, explaining that the threshold needed for extending the time limit sets a high bar. The ICO says in their guidance that it is unlikely that this will be satisfied if:

• it is manifestly unfounded or excessive;
• an exemption applies; or
• the data controller is delaying requesting proof of identity before considering the request.

In practice, this will likely mean that unless the student has an exceptionally complex record requiring extensive compiling and redaction, there shouldn’t be a reason for the school to extend the time needed.

Maintained schools - right to the school file

Under the Education (Pupil Information) (England) Regulations 2005, maintained schools and all special schools must provide pupil files within 15 school days. There is no exception or extension available.

Freedom of Information

An FOI must also be responded to as soon as possible, and in any event, within the maximum number of days allowed under the Freedom of Information Act. For most organisations, the deadline is 20 working days from the date of the request. Under the Freedom of Information (Time for Compliance with Request) Regulations 2004, Regulation 3, the time limit for schools is 20 school days or 60 working days, whichever is sooner.

Can a school charge a fee for complying with a request?

Subject Access

Under Article 12(4) GDPR, an organisation cannot charge for complying with an SAR as long as it is the first request to that organisation and it is not excessively complex.

The ICO's guidance explains that the data-controller will be able to charge a fee if:

• [the request] is manifestly unfounded or excessive; or
• an individual requests further copies of their data following a request.

In practice, there are very few situations in which you should be charged a fee for a properly made SAR, particularly for a school file that should be simply retrievable. It may be more difficult for schools to compile relevant correspondence for you, but it should still be very rare for a fee to be requested.

Maintained schools - right to the school file

The right under the Education (Pupil Information) (England) Regulations 2005 must be fulfilled without charge.

Freedom of Information

Under section 13(1) – (3) of the Freedom of Information Act, costs can be applied to respond to an FOI where fulfilling the request would cost more than the “appropriate limit” to provide the information. For schools that limit is £450. Any request that costs less than £450 to fulfill must be fulfilled without charge.

What information is a data subject entitled to?

Subject Access

Under Regulation 15(3) GDPR, the information a person is entitled to is "a copy of the personal data undergoing processing". The only exception is in Regulation 15(4), which stipulates that this will not include any information that would breach another person’s right to privacy.

This means that the data subject has the right to all personal information, save for that which might include the personal information of another person. Schools should normally provide disclosure, but with redactions where other children are mentioned.

Personal information is information that relates to an "identified individual". This is a very broad definition that will pick up most documents and correspondence that relate to a person, as long as, on a common-sense reading of that document, it is about that person.

This will include emails and letters about a child, whether they were sent internally between staff or externally to agencies. It also includes CCTV, although if the school cannot provide it without breaching the data rights of other visible children, they may decline to do so.

Maintained schools - right to the school file

Under the Education (Pupil Information) (England) Regulations 2005, the documents provided are no more or less than what is in the "school file". This can be limited because correspondence, notes about additional support, and records of day-to-day interactions with the young person may not routinely make it to the school file.

Freedom of Information

Section 1 of the Freedom of Information Act contains the right for any person to request information from a public body. This right is limited by the 24 exceptions set out in sections 21–44 of the Freedom of Information Act.

The exceptions most relevant for excluded young people are:

• Information restricted for law enforcement purposes (s.31);
• Information that is intended for future publication anyway (s.22);
• Information that can already be accessed by means other than FOI (s.21);
• Information restricted for health and safety reasons (s.38);
• Personal information (s.40).

The reality is that most relevant information should be obtainable. For example, statistics about the use of exclusions between different groups to identify trends, or obtaining internal guidance to staff about how to address SEND or other relevant situations, should be disclosable without falling into any of the exemptions.

What recourse do families have when schools fail to satisfy a request?

Subject Access and Freedom of Information

If a family is not satisfied with a response because it is late, it constitutes a refusal to provide records, or the records are incomplete, then the ICO will consider a complaint made about a data controller.

The ICO will expect you to have first made your complaint directly to the organisation and given them time to reply. If they have replied, the ICO will expect you to provide a reply in support of the complaint.

The ICO aims to process 90% of complaints within 6 months. A June 2019 Freedom of Information request showed that the ICO completed work on a complaint regarding data protection issues in an average of 68 days.

The ICO is not an enforcement body and, even where wrongdoing is found, may not take any action to provide the individual with redress. In their own words, the ICO explains that:

Our role is not to investigate or adjudicate on every individual complaint. It is up to us to decide whether or not we should take further action. If you are seeking personal redress or compensation for the way an organisation has dealt with your personal information, you will need to pursue this independently through the courts or with an industry's own ombudsman or regulatory body.

The “Panel Pack”

If you do not receive a panel pack or receive an incomplete panel pack, you do not have a right to have more information added. However, you can add your own evidence and submit documents to the governors, which are covered in the Step-by-Step Guide: Preparing written arguments for the governing board hearing

In addition, you can ask the governors to seek additional evidence or to discard arguments made by the school that are not supported by any of the evidence they have submitted.