18 June, 2021
The ICO has recently published guidance for schools regarding what information they should publish proactively in order to comply with the Freedom of Information Act 2000 (FOIA) - ICO's blog on its information rights work | ICO.
Public authorities (such as maintained schools and academies) have a legal obligation under the FOIA to proactively publish certain information such as what you spend and how you spend it, your priorities, your policies and procedures and information relating to your decision-making processes. These documents should be made available to the public and in most circumstances can be found on your website.
Since the introduction of teacher assessed grades due to the coronavirus pandemic, our education clients have seen a significant rise in both FOIA requests and subject access requests (under data protection law) from students and parents seeking further information about the decisions made relating to teacher assessed grades. The ICO guidance states that schools can pre-empt some of these FOIA requests by proactively publishing some of this information, such as the policies, processes and methods you have in place for determining teacher assessed grades. The guidance goes on to recommend schools get prepared for the influx of FOIA requests by:
We would therefore recommend that you familiarise yourself with your Freedom of Information Policy to understand the steps that need to be taken in the event a FOIA request is received and review the information that is proactively published and consider whether there is any further information you can publish to enhance the transparency of how grades are assessed.
Our education clients have also seen a rise in the number of subject access requests. The use of subject access requests to attempt to obtain exam results ahead of the official results day is nothing new. There is an exemption in the Data Protection Act 2018 which permit schools or exam boards to delay providing information relating to exam marks and scripts until after the exam results have been announced.
This exemption is found within Schedule 2 (Paragraph 25) of the Data Protection Act 2018. It states that where personal data consists of information collated by a data controller (e.g. a school/college or exam board) "for the purposes of determining the results of an exam" or "in consequence of the determination of the results of an exam" then the timescales for providing this information are extended to either a period of 5 months from the date of the request or a period of 40 days following the announcement of the exam result, whichever is earlier.
This exemption should provide comfort to schools and colleges that should you receive such a request, you are able to delay the disclosure of information relating to assessments of grades until after results day. However, it is important to note that this is not a blanket exemption and it only permits schools or colleges to delay providing the information - it does not allow you to refuse to deal with the subject access request in its entirety.
Whilst schools and colleges will be able to delay responding to subject access request relating to exam marks, we envisage that subject access requests will be used as a tool to gain information about how the assessments were made in the event pupils are unhappy with their exam results once they have been announced.
We would therefore recommend that you familiarise yourself with your Data Protection Policy and/or Subject Access Request Policy to understand the steps that need to be taken in the event a subject access request is received. In particular, we would remind schools/colleges that the majority of pupils sitting GCSE and A-Level exams are old enough to make subject access requests on their own behalf. Therefore if a subject access request is received from a parent/carer, you will need to ensure the pupil has given permission to their parent/carer to make the request and consents to you disclosing the information to them. You should also be mindful that any personal information recorded may have to be disclosed at a later date if a pupil makes a subject access request.