The interface between Data Protection and the legitimate access to educational records of school children is worthy of note as problems often arise in practice.
BBC Scotland reported this week that an investigation has been launched after sensitive files about teenagers were left strewn around a special school when it closed last month. The special school in Penicuik closed its doors at the end of last term because of dwindling numbers. However, staff apparently left behind educational and social work records of many of the pupils. The residential school, which taught 13 to 16 year old boys, had been secured against trespassers. However, the documents had not been locked away or stored elsewhere. The Office of the Information Commissioner will undoubtedly be looking at the circumstances of this potential breach of the Data Protection Act 1998 (DPA).
The interface between data protection and the legitimate access to the educational records of school children is worthy of note as problems arise surprisingly frequently in practice. The position was thought to be unclear after the DPA came into force and consequently new legislation was brought in to clarify that. There are two distinct rights in respect of pupils’ records.
- the pupil’s right of subject access under the DPA; and
- the parent’s right of access to their child’s ‘educational record’
Under The Pupils’ Educational Records (Scotland) Regulations 2003, the basic rule is that parents are entitled to apply for disclosure of their children’s educational records. The term parent is widely defined and includes anyone caring for a child (even temporarily), anyone with parental rights or a duty to maintain a child. For the avoidance of doubt this will include a divorced parent even if the child is not mainly resident with them.
Such a request should be made in writing to the school or education authority. The education authority can refuse to comply only if the disclosure would cause significant distress or harm to the child or any other person.
It is sensible for any parent leaving the family home as a result of a separation to make a written application to the children’s school so that information about the children’s education including details of parents’ nights and other events are known.
Exam results
Parents should note that the normal time limit for responding to a subject access request under the DPA within 40 days, does not apply to examination results. The time limit in respect of examination results and markers comments is 5 months or 40 days from the date of exam results being issued, this is to prevent use of the DPA to obtain information about exam results prior to their official release.
Biometric Data
The use of biometric data for control of access to schools, for cashless catering and for library access is becoming increasingly common. This usually involves the use of a software system that takes a partial fingerprint from the pupil and stores it against their personal data. The Protection of Freedoms Act 2012 came into effect on 1 September 2013. This legislation made it necessary for schools to obtain informed consent from parents in respect of the use of biometric data for children under the age of 18. Parents and children of any age can withhold consent of biometric data. Schools are obliged to provide an alternative means of confirming the identity of pupils for whom consent has not been obtained.
This blog post is co-written
by Lesley Gordon (right)
and Lindsay Urquhart (left).
