Handling Tricky Requests for Pupil Information SCHOOLS NorthEast SBM Conference 22 June 2017 Emma Dewar, Associate To update date go to Insert menu then choose Header & Footer in text group

Tricky requests – what do I mean? A former pupil asks for copies of all information held about him on file. The father of a year 8 pupil comes in to the school office and asks for his son's academic and attendance records The school's CCTV cameras capture a pupil fight in the cafeteria at lunchtime. The mother of one of the pupils involved asks to see the footage. The police ask to see the attendance records of a Year 10 pupil 22 June 2017

MASSIVE Goal My Massive Goals for you from this session: Gain an awareness of the legal framework that applies to schools when handling requests for pupil information Know how to respond, or where to go for guidance 22 June 2017

Overview Requests from individuals – legal framework Data Protection Act 1998 Pupil Information Regulations (SI 2005/1437) Requests from authorities Changes on the horizon Any Questions? 22 June 2017

Requests from individuals

Legal framework Data Protection Act 1998 Imposes duties on schools to protect personal data Provides a legal right for individuals to request their own personal data Education (Pupil Information) (England) Regulations 2005/1437 Provides a legal right for parents to see their child's educational record (only applies to maintained schools and non-maintained special schools) 22 June 2017

Data Protection Act 1998 Imposes duties on schools to protect personal data Personal data includes any information which identifies a living individual (whether on its own or together with other information). Eg. pupil records,employee records, staff or pupil emails, CCTV footage, photos, videos etc  Special protection given to certain categories of sensitive personal data. Eg. health data, information about criminal offences or alleged offences, data on race and ethnicity  Schools must comply with the 8 Data Protection Principles Includes ensuring you handle (and share) personal data lawfully and fairly eg. with consent or where you have a legal obligation (eg court order or other strict obligation) to do so 22 June 2017

Data Protection Act 1998 Provides a right for an individual to access his/her own personal data – Subject Access Right Applies to all schools Request must be in writing (but needn't refer to the Act) Deadline for response: 40 calendar days as standard Reduced to 15 school days if the request includes the educational record (NB. maintained & non-maintained special schools only) Fee can be charged (but school can waive) Can redact other peoples' personal data – can only disclose a 3rd party's data with their consent, or where you think it reasonable to disclose it without their consent 22 June 2017

Data Protection Act 1998 Subject Access Right – potential exemptions: the disclosure of health data is likely to cause serious harm to the physical or mental health of the pupil or another individual information is contained in adoption and parental order records examination scripts are requested examination marks are requested before they are officially announced disclosure would prejudice crime prevention and detection there are ongoing negotiations with the pupil and disclosure would prejudice those negotiations it relates to staff and management forecasts; it comprises of confidential references given by you (but not ones given to you) the information is covered by legal professional privilege Further info, see: ICO Subject Access Code of Practice - https://ico.org.uk/media/for- organisations/documents/2014223/subject-access-code-of-practice.pdf 22 June 2017

Case study 1 A former pupil asks for copies of all information held about him on file. 22 June 2017

Subject Access – Tricky issue 1 Verifying the identity of the requester If you are unfamiliar with the requester (eg a pupil who left 15 years ago, or parent the school has no contact with) don’t be afraid to ask them to bring in suitable ID If you need time to verify the identify of the requester, or to clarify what they are asking for, this 'stops the clock' for the purpose of the timescales, and it only re-starts when you have sufficient information to proceed. 22 June 2017

Subject Access – Tricky issue 2 Requests made on behalf of children Remember: the legal right belongs to the child Does the pupil have the capacity to make the request themselves? Consider: Their age (age 12 generally used as a guide) Their maturity and ability to understand their right if explained to them Any duty of confidence owed to the pupil The consequences of disclosing/not disclosing to their parent/solicitor If the pupil is capable, the school should ask for the pupil's written consent, or the pupil should make the request themselves. If the pupil is not capable, consider the suitability of the person making the request (eg. does the person have parental responsibility? Are there any relevant court orders?) 22 June 2017

Case study 2 The father of a year 8 pupil at an academy comes in to the school office and asks for his son's academic and attendance records. 22 June 2017

Pupil Information Regulations 2005 Parent's right to access their child's educational record A right that belongs to the parent Applies only to maintained and non-maintained special schools (i.e. does not apply to academies, free schools or independents) Entitles a parent to view their child's educational record (no fee) or to request a copy of it (can charge a fee) Educational record includes information relating to a pupil which comes from a teacher, other staff, the pupil or parent, processed by the school's governing body, education authority or a teacher except information solely for the teacher's own use. Deadline: 15 school days Exemptions may apply 22 June 2017

Case study 3 The father of a year 8 pupil comes in to the (maintained school) office and asks for his son's academic and attendance records 22 June 2017

Case study 4 The school's CCTV cameras capture a pupil fight in the cafeteria at lunchtime. The mother of one of the pupils involved asks to see the footage. 22 June 2017

Requests from authorities

Requests from authorities There is no general right of access to personal information by organisations. Unless the school has a legal obligation to provide the information (eg. a court order addressed to the school for this information), you are not legally compelled to provide it. The organisation (eg. police, local authority, other authority) may have a legitimate need to access to it, but it is up to them to demonstrate this to you. 22 June 2017

Requests from authorities (2) The DPA does not prevent you from providing information in appropriate circumstances. Examples: Section 29 DPA allows disclosures where these are required in connection with prevention/detection of crime or prosection of an offence. Action: ask the police for a 'section 29 form' in which they clearly identify why they need the information in connection with the prevention/detection of crime. Ask for this to be signed by a supervising officer. Section 35 DPA allows disclosures where these are necessary for a legal obligation, court order, legal proceedings or to obtain legal advice. Seek advice if you are unsure. 22 June 2017

Useful resources ICO Data Sharing Code of Practice ICO Subject Access Code of Practice https://ico.org.uk/media/for- organisations/documents/2014223/subje ct-access-code-of-practice.pdf ICO Helpline: 0303 123 1113  ICO Data Sharing Code of Practice https://ico.org.uk/media/for- organisations/documents/1068/data_s haring_code_of_practice.pdf 22 June 2017

Case study 5 The police ask to see the attendance records of a Year 10 pupil. 22 June 2017

Changes on the horizon General Data Protection Regulation (GDPR) New European data protection legislation will replace the Data Protection Act 1998 from 25 May 2018. Key changes for schools – Subject access right remains, but £10 fee to be abolished Current exemptions are likely to be reviewed and may be amended Consent – needs to specific, informed, freely given, unambiguous and capable of being withdrawn. Pre-ticked boxes will not suffice. If school offers certain social media services, it will need to obtain parental consent for children under 16 (UK may lower, no younger than 13). No need to notify annually to the ICO… …but need to keep own detailed records about what data you hold and what you do with it, and be able to demonstrate you comply with the GDPR Much larger fines for non-compliance – up to 4% turnover or EUR 20m 22 June 2017

Any Questions?

Set Your Goal Key points to remember:

Contact us Emma Dewar Associate 0191 230 8309 emma.dewar@bonddickinson.com 22 June 2017

Thank you