Education data

In more detail

• What is education data?
• How can education data be accessed?
• Can I charge a fee for providing subject access to education data?
• How long do we have to comply if a SAR is received in school holidays?
• Is education data ever exempt from subject access?
• Is education data exempt if it is processed by a court?
• Is education data exempt if disclosure could cause serious harm?
• Is there a restriction if you are an education authority in Scotland?

What is education data?

The DPA 2018 defines ‘education data’ as:

• personal data which consists of information that forms part of an educational record; and
• is not data concerning health.

The definition of ‘educational record’ in the DPA 2018 differs between England and Wales, Scotland and Northern Ireland. Broadly speaking, however, the expression has a wide meaning and includes most information about current and past pupils that is processed by or on behalf of a school. The definition applies to nearly all schools including maintained schools, independent schools and academies.

However, information a teacher keeps solely for their own use does not form part of the educational record. It is likely that most of the personal information a school holds about a particular pupil forms part of the pupil’s educational record. However it is possible that some of the information could fall outside the educational record, eg information a parent of another child provides about the pupil is not part of the educational record.

How can individuals access education data?

There are two distinct rights to information schools hold about pupils:

• The pupil’s right of access under Article 15 of the UK GDPR.
• The parent’s right of access to their child’s ‘educational record’.
  • In England and Wales, this right only applies to maintained schools.
  • In Northern Ireland, this right applies to all grant-aided schools.
  • In Scotland, this right applies to all schools regardless of sector.
  • The ICO does not regulate this right to information.

Although this guidance only concerns the right of access under the UK GDPR, it is important to be aware of a parent’s right to access their child’s educational records. This is because the information you provide may differ depending on which right applies, ie the parent’s right is only to access their child’s educational record, whereas a SAR also enables access to the personal data a school processes that does not fall into the definition of an educational record. The two rights also have different time limits for compliance. You must respond to a parent’s right of access to their child’s educational records within 15 school days, whereas you must comply with a SAR within one month. The law on a parent’s right to their child’s educational records does not lie within the ICO’s regulatory responsibilities, but we refer to it here for completeness.

Unlike the parent’s right of access to their child’s educational record, it is the pupil’s right to make a SAR. Parents can only submit a SAR for information about their child if the child is not competent to act on their own behalf or has given their consent. For guidance about deciding whether a child is able to make their own SAR, see ‘What about requests for information about children and young people?’. If it is not clear whether a requester has parental responsibility for the child or is acting on their behalf, you should clarify this before responding to the SAR. If the school is in England, Wales or Northern Ireland, the school should deal with the SAR. If the school is in Scotland, the relevant education authority or the proprietor of an independent school should deal with the SAR.

Can I charge a fee for providing subject access to education data?

No. There are no special rules which allow you to charge fees if you are complying with a SAR for education data. For more information about when you can charge a fee please see ‘Can we charge a fee?’.

How long do we have to comply if we receive a SAR in school holidays?

There are no special rules which allow you to extend the time period for dealing with a SAR you receive it during school holidays. Regardless of whether a school is closed, if you receive a SAR then you have the normal time period to comply. Please see ‘How long do we have to comply?’ for more information.

Is education data ever exempt from subject access?

The exemptions and restrictions that apply to other types of personal data also apply to education data. So, for example, if an educational record contains personal data relating to someone other than the requester (such as a family member), you must consider the rules about third-party data before disclosing it to the requester. However, you should not normally withhold information that identifies a teacher. See ‘What should we do if the request involves information about other individuals?’ for more information.

There are also further exemptions and restrictions that apply to education data in particular. These are explained in the next sections.

Is education data exempt if a court processes it?

This exemption can apply to education data that a court processes.

You are exempt from providing education data in response to a SAR if the education data is:

• supplied in a report or given as evidence to the court in the course of proceedings; and
• certain specific statutory rules apply to those proceedings that allow the withholding of the data from the individual it relates to.

If you think this exemption might apply to your processing of personal data, see paragraph 18(2) of Schedule 3, Part 4 of the DPA 2018 for full details of the statutory rules.

Is education data exempt if disclosure could cause serious harm?

Yes. In most circumstances, you are exempt from providing education data in response to a SAR to the extent that complying with the request would be likely to cause serious harm to the physical or mental health of any individual. This is known as the “serious harm test” for education data. However, this exemption does not apply to independent schools in Scotland.

Is there a restriction if you are an education authority in Scotland?

This is a restriction rather than an exemption. It applies if you process education data as an education authority in Scotland (as defined by the Education (Scotland) Act 1980), and you receive a SAR for that data.

It restricts you from disclosing education data in response to a request if:

• you believe that the data came from the Principal Reporter (as defined by the Children’s Hearings (Scotland) Act 2011) in the course of their statutory duties; and
• the individual whom the data is about is not entitled to receive it from the Principal Reporter.

If there is a question as to whether you need to comply with a SAR in this situation, you must inform the Principal Reporter within 14 days of the question arising.

You may only disclose the education data in response to the request if the Principal Reporter has told you they think the serious harm test for education data is not met.