As University beckons this month, thousands of students will be putting the well-publicised issues that surrounded their 2020 A Level and GCSE results behind them as they look to their futures.
However, for education providers the issues surrounding this year’s results may lead to an increase in subject access requests from students seeking to obtain a copy of their personal data.
When such requests are received, it is important that education providers ensure that they recognise such requests and comply with them in accordance with the General Data Protection Regulation 2016/679 (GDPR). Solicitor Emma Hastings-Braylooks at this in more detail:
Subject access requests, an overview:
Students are entitled to submit subject access requests about their exam results to education providers, however this does not mean they are entitled to access all of the information used to determine their grade;
The time an education provider will have to respond to a student’s request depends on when the request was received. Requests received before the results are published should be responded to within five months of the date of the request; or within 40 days of the exam results being published, whichever date is earliest. Requests received after the results are published should be responded to as a normal subject access request, i.e. within one month of receipt of the request; and
Education providers should take care to ensure that any information they release as part of a response does not fall within one of the exemptions contained in the Data Protect Act 2018 (DPA).
The Information Commissioner’s Office (ICO) has issued guidance in light of COVID-19 to provide assistance on this subject.
So, what are students entitled to receive?
Students are entitled to exercise their rights of access to their personal data under Article 15 of the GDPR – this is what is commonly known as the ‘right of access’ or ‘subject access request’. Students may have the right to request information from their education provider concerning them and their performance.
This does not mean that a student is entitled to receive all of the information used to decide their grade as some of the information may fall under an exemption set out in the DPA.
Particularly relevant to education providers and this article is that contained in schedule 2, Part 4, paragraph 25 of the DPA. This states that the right of access does not “apply to personal data consisting of information recorded by candidates during an exam.” Therefore, as clarified in the ICO’s guidance on how this exemption applies this year “students do not have a right to get copies of their answers from mock exams or assignments used to assess their performance.”
However, not all the personal data requested may fall under an exemption - the ICO is clear that students do have the right to request certain information about themselves and their exam performance. For example, this might include a student’s mark, written comments made by the examiner and (if appealed) minutes of any examination appeals panels.
Equally, in terms of the information used to assess during the pandemic the ICO has clarified that the “exam script exemption does not exempt you from providing the teacher assessments and/or rank orders to students.”
What should education providers consider when responding to such requests?
Education providers need to consider whether the information they are disclosing would reveal information about other individuals. One area where this might prove problematic is disclosing information about the requestee’s rank order.
The ICO makes it clear that disclosing, for example, that a requestee came top of their class is unlikely to reveal information about other individuals apart from the fact that they came below the requestee.
However, this may be problematic if such requestees are received from small cohorts (they use the example of 2-3 students) and the disclosure of this information would likely reveal information about other students.
In such cases the ICO says such requests should be considered on a case by case basis. In their guidance the ICO suggest considering whether it is feasible to obtain consent from other students in the cohort to release cohort information, or, if it is reasonable to respond to the requestee and provide the requested information without obtaining such consent. The ICO also suggests that when considering such requests the education providers will need to consider whether “it’s fair to treat students differently in small cohorts, by refusing to release their rank order, when that information is available to students in larger cohorts”.
What are the timescales to respond to a student’s request?
The timescales for which students must make a request vary depending on whether the student’s exam results have been published. According to the ICO’s guidance if a request has been made once the results have been published then the provider must respond to the request within one month of receipt of the request.
If however, the request was made prior to the results being published then the provider must respond (depending on whichever is earlier) either within five months of the date of the students request or within 40 days from when the results are published .
What does this mean in practice for education providers?
Students who do submit subject access requests must be clear that this does NOT mean they can access their results early. The ICO has made it clear that students cannot get information about their “provisional grades (which includes the teachers’ assessments and/or rank orders) prior to the publication of the results.”
Equally, education providers should take care when deciding whether to release the information requested. For example, and as above, careful thought needs to be given where disclosure of the information might reveal information about other students or other third parties. In these situations, the ICO has said that organisations will need to “think about whether it would be reasonable to disclose it rather than withhold it” depending on each specific circumstance. Furthermore, careful thought should also be given as to whether the personal information requested falls within another exemption contained in the DPA.
Further advice and information:
Please note that the information contained within this article is for guidance purposes only and is not intended to constitute legal advice. If you would like our assistance in relation to anything contained within this article, then please contact Emma Hastings-Bray either by e-mail at Emma.Hastings-Bray@wilkinchapman.co.uk or by phone 01522 515595.