Under data protection law, there are two ways for parents to access information that a school or academy holds about their child: either via the Education (Pupil Information) (England) Regulations 2005 and/or the UK GDPR and the Data Protection Act 2018.
-
The Education (Pupil Information) (England) Regulations 2005
In the regulations, the “educational record” means any record of information about a current or former pupil which is processed by or on behalf of the governing body of, or a teacher at, the school. It also includes any statement of special educational needs and any personal education plan.
The governing body has fifteen school days from receipt of the parent’s written request for access to make a pupil’s educational record available for inspection by the parent, free of charge. This is subject to exceptions such as that the governing body won’t disclose the information of third parties.
-
Subject access request (SAR) under the UK GDPR and the Data Protection Act 2018.
The right to access information a school holds about a child is the child’s right, rather than anyone else’s.
Before responding to a SAR for information held about a child, schools should consider whether the child is mature enough to understand their rights. If the request is from a child and the school is confident that the child can understand their rights, the school should respond directly to the child. The school may allow the parent or guardian to exercise the child’s rights on their behalf if the child authorises this or if the child isn’t competent.
When considering competency, what matters is that the child can understand (in broad terms) what it means to make a SAR and how to interpret the information they receive. Schools need to consider, among other things:
- the child’s level of maturity and their ability to understand what they are asking for and what they will receive or to understand the consequences of authorising someone to act on their behalf; and
- the nature of the personal data.
If a parent or guardian, or someone authorised by the child, makes a SAR on the child’s behalf, the school should consider:
- any court orders relating to parental access or responsibility;
- any duty of confidence owed to the child;
- any consequences of allowing those with parental responsibility access to the child’s information (this is particularly important if there have been allegations of abuse or ill-treatment);
- any detriment to the child if those with parental responsibility cannot access this information; and
- any views the child has on whether their parents/guardians should have access to information about them.
In Scotland, a person aged 12 years or over is presumed to be of sufficient age and maturity to be able to exercise their right of access, unless the contrary is shown. This does not apply in England, Wales or Northern Ireland but would be a reasonable starting point.
How long will the process take?
Schools have 15 school days (excluding school holidays) to comply with a request.
For more information on how to handle a SAR, please see our blog on SARs: How to deal with Subject Access Requests
SARs can be tricky – you can make a mistake if you disclose too little data or if you disclose too much. It’s wise not to ‘dabble’ with a SAR – the law on them is complex, so seek advice from the experts where possible.
We can help with your SARs, every step of the way.
Book a free consultation today – our team is highly knowledgeable when it comes to GDPR compliance, and our specialism is making our knowledge yours.
Got a different question? Feel free to browse our FAQs.